| (B) a financial institution with whom the covered entity
has a joint marketing agreement.
(f) Short-form initial notice with opt out notice for
noncustomers.
(1) A covered entity may satisfy the initial notice
requirements in §22.8(a)(2) and §22.11(c) of this title
(relating to Form of Opt Out Notice to Consumers and Opt Out Methods)
for a consumer who is not a customer by providing a short-form initial
notice at the same time as the covered entity delivers an opt out
notice as required in §22.11 of this title.
(2) A short-form initial notice must:
(A) be clear and conspicuous;
(B) state that the covered entity's privacy notice
is available on request; and
(C) explain a reasonable means by which the consumer
may obtain that notice.
(3) The covered entity must deliver its short-form
initial notice according to §22.13 of this title (relating to
Delivery). The covered entity is not required to deliver its privacy
notice with its short-form initial notice. The covered entity may
instead provide the consumer with a reasonable means to obtain its
privacy notice. If a consumer who receives the covered entity's short-form
notice requests the covered entity's privacy notice, the covered entity
must deliver its privacy notice according to §22.13 of this title.
(4) The covered entity provides a reasonable means
by which a consumer may obtain a copy of its privacy notice if the
covered entity:
(A) provides a toll-free telephone number that the
consumer may call to request the notice; or
(B) for a consumer who conducts business in person
at the covered entity's office, maintains copies of the notice on
hand that the covered entity provides to the consumer immediately
on request.
(g) Reservation of right to disclose. The covered entity's
notice may include:
(1) categories of nonpublic personal financial information
the covered entity reserves the right to disclose in the future, but
does not currently disclose; and
(2) categories of affiliates or nonaffiliated third
parties to whom the covered entity reserves the right in the future
to disclose, but to whom the covered entity does not currently disclose,
nonpublic personal financial information.
(h) Model privacy form. A model privacy form that meets
the notice content requirements of this section appears in 74 Federal Register 62890 (December 1, 2009).
A covered entity may use the applicable model privacy form, consistent
with the instructions in §22.27 of this title (relating to General
Instructions).
|
