| (a) This subchapter is effective July 12, 2001.
(b) By September 10, 2001, a covered entity shall provide an
initial notice, as required by §22.8 of this title (relating to Initial
Privacy Notice), to consumers who are the covered entity's customers on September
10, 2001. For example, a covered entity provides an initial notice to consumers
who are its customers on September 10, 2001, if, by that date, the covered
entity has established a system for providing an initial notice to all new
customers and has mailed the initial notice to all the covered entity's existing
customers.
(c) Until September 10, 2002, a contract that a covered entity
has entered into with a nonaffiliated third party to perform services for
the covered entity or functions on the covered entity's behalf satisfies the
provisions of §22.17(a)(1)(B) of this title (relating to Exception to
Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information
for Service Providers and Joint Marketing), even if the contract does not
include a requirement that the third party maintain the confidentiality of
nonpublic personal financial information, so long as the covered entity entered
into the agreement on or before September 10, 2000.
|
