50 Ill. Adm. Code 4002.80
Revised Privacy Notices
Section 4002
Section 4002.80 Revised
Privacy Notices
a) General rule. Except as otherwise authorized in this Part, a
licensee shall not, directly or through an affiliate, disclose any nonpublic
personal financial information about a consumer to a nonaffiliated third party
other than as described in the initial notice that the licensee provided to
that consumer under Section 4002.40 of this Part, unless:
1) The licensee has provided to the consumer a clear and
conspicuous revised notice that accurately describes its policies and
practices;
2) The licensee has provided to the consumer a new opt out
notice;
3) The licensee has given the consumer a reasonable opportunity,
before the licensee discloses the information to the nonaffiliated third party,
to opt out of the disclosure; and
4) The consumer does not opt out.
b) Pursuant to subsection (a) of this Section, except as
otherwise permitted by Sections 4002.130, 4002.140 and 4002.150 of this Part, a
licensee is required to provide a revised notice before any amendments or
changes are made to its privacy policies or practices concerning disclosure as
set forth in the initial notice, or the most recently issued notice, such as:
1) Disclosing a new category of nonpublic personal financial
information to any nonaffiliated third party;
2) Disclosing nonpublic personal financial information to a new
category of nonaffiliated third party; or
3) Disclosing nonpublic personal financial information about a
former customer to a nonaffiliated third party, if that former customer has not
had the opportunity to exercise an opt out right regarding that disclosure.
c) A revised notice is not required if the licensee discloses
nonpublic personal financial information to a new nonaffiliated third party
that the licensee adequately described in its prior notice.
d) Delivery. When a licensee is required to deliver a revised
privacy notice by this Section, the licensee shall deliver it according to
Section 4002.90 of this Part.