191—90.7(505) Revised privacy notices.
	90.7(1) Except as otherwise authorized in this rule, a licensee shall not, directly or through an affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party other than as described in the initial notice that the licensee provided to that consumer under rule 191—90.3(505) unless the following occur:
	a. 	The licensee has provided to the consumer a clear and conspicuous revised privacy notice that accurately describes its policies and practices;
	b. 	The licensee has provided to the consumer a new opt-out notice;
	c. 	The licensee has given the consumer a reasonable opportunity, before the licensee discloses the information to the nonaffiliated third party, to opt out of the disclosure; and
	d. 	The consumer does not opt out.
Except as permitted by rules 191—90.12(505), 191—90.13(505), and 191—90.14(505), a licensee shall provide a revised notice before the licensee does any of the following:
	●	Discloses a new category of nonpublic personal financial information to any nonaffiliated third party;
	●	Discloses nonpublic personal financial information to a new category of nonaffiliated third party; or
	●	Discloses nonpublic personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt-out right regarding that disclosure.
	90.7(2) A revised privacy notice is not required if the licensee discloses nonpublic personal financial information to a new nonaffiliated third party that the licensee adequately described in its prior notice.
	90.7(3) When a licensee is required to deliver a revised privacy notice by this rule, the licensee shall deliver it according to rule 191—90.8(505).
[ARC 7741C, IAB 3/20/24, effective 4/24/24]