| (a) Initial notice requirement. A covered entity shall provide
a clear and conspicuous notice that accurately reflects its privacy policies
and practices to:
(1) an individual who becomes the covered entity's customer,
not later than when the covered entity establishes a customer relationship,
except as provided in subsection (e) of this section; and
(2) a consumer, before the covered entity discloses any nonpublic
personal financial information about the consumer to any nonaffiliated third
party, if the covered entity makes a disclosure other than as authorized by §22.18
of this title (relating to Exceptions to Notice and Opt Out Requirements for
Disclosure of Nonpublic Personal Financial Information for Processing and
Servicing Transactions) and §22.19 of this title (relating to Other Exceptions
to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial
Information).
(b) Initial notice not required. A covered entity is not required
to provide an initial notice to a consumer under subsection (a)(2) of this
section if:
(1) the covered entity does not disclose any nonpublic personal
financial information about the consumer to any nonaffiliated third party,
other than as authorized by §22.18 and §22.19 of this title, and
the covered entity does not have a customer relationship with the consumer;
or
(2) a notice has been provided by an affiliated covered entity,
so long as the notice clearly identifies all covered entities to whom the
notice applies and is accurate with respect to the covered entity and the
other institutions.
(c) Establishment of a customer relationship.
(1) Generally, a covered entity establishes a customer relationship
at the time the covered entity and the consumer enter into a continuing relationship.
(2) Some examples of a covered entity establishing a customer
relationship occur when the consumer:
(A) becomes a policyholder of a covered entity that is an insurer
when the insurer delivers an insurance policy or contract to the consumer,
or in the case of a covered entity that is an insurance agent, obtains insurance
through that covered entity; or
(B) agrees to obtain financial, economic or investment advisory
services relating to insurance products or services for a fee from the covered
entity.
(d) Existing customers. When an existing customer obtains a
new insurance product or service from a covered entity that is to be used
primarily for personal, family or household purposes, if the initial, revised
or annual notice that the covered entity most recently provided to that customer
was inaccurate with respect to the new insurance product or service, the covered
entity shall, in accordance with the initial notice requirements of subsection
(a) of this section, provide a revised privacy notice, under §22.12 of
this title (relating to Revised Privacy Notices), that covers the customer's
new insurance product or service. If the initial, revised or annual notice
that the covered entity most recently provided to that customer was accurate
with respect to the new insurance product or service, the covered entity does
not need to provide a new privacy notice under subsection (a) of this section.
(e) Subsequent delivery of notice.
(1) General rule. A covered entity may provide the initial
notice required by subsection (a)(1) of this section within a reasonable time
after the covered entity establishes a customer relationship if:
(A) establishing the customer relationship is not at the customer's
election; or
(B) providing notice not later than when the covered entity
establishes a customer relationship would substantially delay the customer's
transaction and the customer agrees to receive the notice at a later time.
(2) Not at customer's election. Establishing a customer relationship
is not at the customer's election if a covered entity acquires or is assigned
a customer's policy from another financial institution or residual market
mechanism and the customer does not have a choice about the covered entity's
acquisition or assignment.
(3) Substantial delay of customer's transaction. Providing
notice not later than when a covered entity establishes a customer relationship
would substantially delay the customer's transaction when the covered entity
and the individual agree over the telephone to enter into a customer relationship
involving prompt delivery of the insurance product or service.
(4) No substantial delay of customer's transaction. Providing
notice not later than when a covered entity establishes a customer relationship
would not substantially delay the customer's transaction when the relationship
is initiated in person at the covered entity's office or through other means
by which the customer may view the notice, such as on a Web site.
(f) Delivery. A covered entity shall deliver any notices required
by this section according to §22.13 of this title (relating to Delivery).
If the covered entity uses a short-form initial notice for non-customers according
to §22.10(d) of this title (relating to Information to be Included in
Privacy Notices), the covered entity may deliver its privacy notice according
to §22.10(d)(3) of this title.
|
