12 CFR 216.8 - Revised privacy notices.
(a) General rule. Except as otherwise authorized in this part, you must not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice that you provided to that consumer under § 216.4, unless:
(1) You have provided to the consumer a clear and conspicuous revised notice that accurately describes your policies and practices;
(3) You have given the consumer a reasonable opportunity, before you disclose the information to the nonaffiliated third party, to opt out of the disclosure; and
(4) The consumer does not opt out.
(b) Examples—(1) Except as otherwise permitted by §§ 216.13, 216.14, and 216.15, you must provide a revised notice before you:
(iii) Disclose nonpublic personal information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt out right regarding that disclosure.
(2) A revised notice is not required if you disclose nonpublic personal information to a new nonaffiliated third party that you adequately described in your prior notice.
Beta! The text on the eCFR tab represents the unofficial eCFR text at ecfr.gov.
This section’s status may have changed. It may have been renumbered, reserved, or removed.