| (a) How to provide notices. A covered entity shall provide
any notices that this subchapter requires so that each consumer can reasonably
be expected to receive actual notice in writing or, if the consumer agrees,
electronically.
(b) Examples of reasonable expectation of actual notice. A
covered entity satisfies the reasonable expectation that a consumer will receive
actual notice if the covered entity:
(1) hand-delivers a printed copy of the notice to the consumer;
(2) mails a printed copy of the notice to the last known address
of the consumer separately, or in a policy, billing or other written communication;
(3) for a consumer who conducts transactions electronically,
posts the notice on the electronic site and requires the consumer to acknowledge
receipt of the notice as a necessary step to obtaining a particular insurance
product or service; or
(4) for an isolated transaction with a consumer, such as the
covered entity providing an insurance quote or selling the consumer single-event
types of coverage including, but not limited to, auto rental liability, travel,
and short-term non-resident auto liability insurance, presents the notice
and requires the consumer to acknowledge receipt of the notice as a necessary
step to obtaining the particular insurance product or service.
(c) Examples of unreasonable expectation of actual notice.
A covered entity has not met the reasonable expectation that a consumer will
receive actual notice of its privacy policies and practices if it:
(1) only posts a sign in its office or generally publishes
advertisements of its privacy policies and practices; or
(2) sends the notice via electronic mail to a consumer who
does not obtain an insurance product or service from the covered entity electronically.
(d) Annual notices only. A covered entity satisfies the reasonable
expectation that a customer will receive actual notice of the covered entity's
annual privacy notice if:
(1) the customer uses the covered entity's Web site to access
insurance products and services electronically and agrees to receive notices
at the Web site and the covered entity posts its current privacy notice continuously
in a clear and conspicuous manner on the Web site; or
(2) the customer has requested that the covered entity refrain
from sending any information regarding the customer relationship, and the
covered entity's current privacy notice remains available to the customer
upon request.
(e) Oral description of notice insufficient. A covered entity
may not provide any notice required by this subchapter solely by orally explaining
the notice, either in person or over the telephone.
(f) Retention or accessibility of notices for customers.
(1) For customers only, a covered entity shall provide the
initial notice required by §22.8(a)(1) of this title (relating to Initial
Privacy Notice), the annual notice required by §22.9(a) of this title
(relating to Annual Privacy Notice), and the revised notice required by §22.12
of this title (relating to Revised Privacy Notices) so that the customer can
retain them or obtain them later in writing or, if the customer agrees, electronically.
(2) A covered entity provides a privacy notice to the customer
so that the customer can retain it or obtain it later if the covered entity:
(A) hand-delivers a printed copy of the notice to the customer;
(B) mails a printed copy of the notice to the last known address
of the customer; or
(C) makes its current privacy notice available on a Web site
(or a link to another Web site) for the customer who obtains an insurance
product or service electronically and agrees to receive the notice at the
Web site.
(g) Joint notice with other financial institutions. A covered
entity may provide a joint notice from the covered entity and one or more
of its affiliates or other financial institutions, as identified in the notice,
so long as the notice is accurate with respect to the covered entity and the
other institutions. A covered entity also may provide a notice on behalf of
another financial institution.
(h) Joint relationships. If two or more consumers jointly obtain
an insurance product or service from a covered entity, the covered entity
may satisfy the initial, annual and revised notice requirements of §§22.8(a),
22.9(a), and 22.12(a) of this title, respectively, by providing one notice
to those consumers jointly.
|
