Limits on disclosure of nonpublic personal financial information to nonaffiliated third parties

1. a. Conditions for disclosure. Except as otherwise authorized in this rule, a licensee may not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless: (1) The licensee has provided to the consumer an initial notice as required under section 45-14-01-05; (2) The licensee has provided to the consumer a notice as required in section 45-14-01-08; and (3) An authorization is obtained from the consumer whose nonpublic personal information is sought to be disclosed. b. A valid authorization to disclose nonpublic personal information pursuant to section 45-14-01-11 shall be in written or electronic form separate from that used for any other purpose and shall contain all of the following: (1) The identity of the consumer or customer who is the subject of the nonpublic personal information; (2) A specific description of the types of nonpublic personal information to be disclosed; (3) Specific descriptions of the parties to whom the licensee discloses nonpublic personal information, the purpose of the disclosure, and how the information will be used; (4) The signature of the consumer or customer who is the subject of the nonpublic personal information or the individual who is legally empowered to grant authority and the date signed; and (5) Notice of the length of time for which the authorization is valid and that the consumer or customer may revoke the authorization at any time and the procedure for making a revocation. 2. Application to all consumers and all nonpublic personal financial information. a. A licensee shall comply with this section, regardless of whether the licensee and the consumer have established a customer relationship. b. Unless a licensee complies with this section, the licensee may not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer that the licensee has collected, regardless of whether the licensee collected it before or after receiving the authorization from the consumer. 3. Partial authorization. A licensee may allow a consumer to select certain nonpublic personal financial information or certain nonaffiliated third parties with respect to which the consumer wishes to authorize disclosure.