23 CAR § 30-403. Other exceptions to notice and opt-out requirements for disclosure of nonpublic personal financial information

(a) Exceptions to opt-out requirements. The requirements for initial notice to consumers in 23 CAR § 30-201(a)(2), the opt out in 23 CAR §§ 30-204 and 30-301, and service providers and joint marketing in 23 CAR § 30-401 do not apply when a licensee discloses nonpublic personal financial information: (1) With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction; (2) To protect the confidentiality or security of a licensee’s records pertaining to the: (A) Consumer; (B) Service; (C) Product; or (D) Transaction; (3) To protect against or prevent actual or potential fraud or unauthorized transactions; (4) For required institutional risk control or for resolving consumer disputes or inquiries; (5) To persons holding a legal or beneficial interest relating to the consumer; (6) To persons acting in a fiduciary or representative capacity on behalf of the consumer; (7) To provide information to: (A) Insurance rate advisory organizations; (B) Guaranty funds or agencies; (C) Claims databases; (D) Agencies that are rating a licensee; (E) Persons that are assessing the licensee’s compliance with industry standards; and (F) The licensee’s attorneys, accountants, and auditors; (8) To the extent specifically permitted or required under other provisions of law and in accordance with the federal Right to Financial Privacy Act of 1978, 12 U.S.C. § 3401 et seq.: (A) To law enforcement agencies including the: (i) Federal Reserve Board; (ii) United States Office of the Comptroller of the Currency; (iii) Federal Deposit Insurance Corporation; (iv) Office of Thrift Supervision; (v) National Credit Union Administration; (vi) United States Securities and Exchange Commission; (vii) United States Secretary of the Treasury, with respect to United States Code Title 31 , Chapter 53, Subchapter II (Records and Reports on Monetary Instruments and Transactions) and Title 12, Chapter 21 (Financial Recordkeeping); (viii) State Insurance Department; and (ix) Federal Trade Commission; (B) To self-regulatory organizations; or (C) For an investigation on a matter related to public safety; (9) To a consumer reporting agency in accordance with the federal Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq.; (10) From a consumer report reported by a consumer reporting agency; (11) In connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal financial information concerns solely consumers of the business or unit; (12) To comply with federal, state, or local: (A) Laws; (B) Rules; and (C) Other applicable legal requirements; (13) To comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by federal, state, or local authorities; (14) To respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance, or other purposes as authorized by law; or (15) For purposes related to the replacement of a group benefit plan, a group health plan, or a group welfare plan. (b) Example of revocation of consent. A consumer may revoke consent by subsequently exercising the right to opt out of future disclosures of nonpublic personal information as permitted under 23 CAR § 30-204(f).