Or. Admin. Code § 836-080-0655 - Revised Privacy Notices

(1) Except as otherwise authorized in OAR 836-080-0600 to 836-080-0700, a licensee shall not, directly or through an affiliate, disclose any personal financial information about a consumer to a nonaffiliated third party under 836-080-0675 other than as described in the initial notice that the licensee provided to the consumer under 836-080-0620, unless:

(a) The licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;

(b) The licensee has given the consumer a reasonable opportunity, before the licensee discloses personal financial information to the nonaffiliated third party, to opt out of the disclosure; and

(c) The consumer does not opt out.

(2) Except as otherwise allowed by OAR 836-080-0670, a licensee shall provide a revised notice to the consumer under section (1) of this rule before the licensee, for example:

(a) Discloses a new category of personal financial information to a nonaffiliated third party;

(b) Discloses personal financial information to a new category of nonaffiliated third party; or

(c) Discloses personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to indicate that the former customer does not want disclosure.

(3) A revised privacy notice under this rule shall be delivered according to OAR 836-080-0660.

(4) The prohibition in section (1) of this rule and the requirements of section (2) of this rule do not apply with respect to a revision of an initial notice, the sole purpose of which is to incorporate a notice of a disclosure of personal information for which authorization is not required by OAR 836-080-0670 or 836-080-0675.

Notes

Or. Admin. Code § 836-080-0655

ID 4-2005, f. & cert. ef. 4-1-05

Stat. Auth.: ORS 731.244 & 746.608

Stats. Implemented: ORS 746.600 & 746.607