12 CFR 332.8 - Revised privacy notices.
(a) General rule. Except as otherwise authorized in this part, you must not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice that you provided to that consumer under § 332.4, unless:
(2) You have provided to the consumer a new opt out notice;
(4) The consumer does not opt out.
(b) Examples - (1) Except as otherwise permitted by §§ 332.13, 332.14, and 332.15, you must provide a revised notice before you:
(iii) Disclose nonpublic personal information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt out right regarding that disclosure.