Or. Admin. Code § 836-080-0531 - Revised Privacy Notices

(1) Except as otherwise authorized in OAR 836-080-0501 to 836-080-0551, a licensee shall not, directly or through an affiliate, disclose any personal financial information about a consumer to a nonaffiliated third party under ORS 746.665(1)(k) other than as described in the initial notice that the licensee provided to the consumer under 746.620 and OAR 836-080-0501 to 836-080-0551, unless:

(a) The licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;

(b) The licensee has given the consumer a reasonable opportunity, before the licensee discloses personal financial information to the nonaffiliated third party, to opt out of the disclosure; and

(c) The consumer does not opt out.

(2) Except as otherwise allowed by ORS 746.665(1)(a) to (j) and (m) to (q), a licensee shall provide a revised notice to the consumer under section (1) of this rule before the licensee, for example:

(a) Discloses a new category of personal financial information to a nonaffiliated third party;

(b) Discloses personal financial information to a new category of nonaffiliated third party; or

(c) Discloses personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to indicate that the former customer does not want disclosure.

(3) A revised privacy notice under this rule shall be delivered according to OAR 836-080-0536.

(4) The prohibition in section (1) of this rule and the requirements of section (2) of this rule do not apply with respect to a revision of an initial notice, the sole purpose of which is to incorporate a notice of a disclosure of personal information for which authorization is not required by ORS 746.665.

Notes

Or. Admin. Code § 836-080-0531

ID 8-2002, f. & cert. ef. 2-15-02

Stat. Auth.: ORS 731.244, ORS 746.600 & ORS 746.620

Stats. Implemented: ORS 746.600, ORS 746.620, ORS 746.630 & ORS 746.665