Sec. 420.8. Revised privacy notices

(a) General rule.

Except as otherwise authorized in this Part, a licensee shall not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party, other than as described in the initial notice that the licensee provided to that consumer under section 420.4 of this Part, unless:

(1) the licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes the licensee's policies and practices;

(2) the licensee has provided to the consumer a new opt out notice;

(3) the licensee has given the consumer a reasonable opportunity, before the licensee discloses the information to the nonaffiliated third party, to opt out of the disclosure; and

(4) the consumer does not opt out.

(b) Examples.

(1) Except as otherwise permitted by sections 420.13, 420.14 and 420.15 of this Part, the licensee shall provide a revised notice before the licensee:

(i) discloses a new category of nonpublic personal financial information to any nonaffiliated third party;

(ii) discloses nonpublic personal financial information to a new category of nonaffiliated third party; or

(iii) discloses nonpublic personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt out right regarding that disclosure.

(2) A revised notice is not required if the licensee discloses nonpublic personal financial information to a new nonaffiliated third party that the licensee adequately described in the licensee's prior notice.

(c) Delivery.

When the licensee is required to deliver a revised privacy notice by this section, the licensee shall deliver it according to section 420.9 of this Part.