26.1-02-27. Disclosing nonpublic personal information

26.1-02-27. Disclosing nonpublic personal information 1. An insurance company, nonprofit health service corporation, or health maintenance organization may not disclose to a nonaffiliated third party a customer's nonpublic personal information contrary to the provisions of title V of the Gramm-Leach-Bliley Act [Pub. L. 106-102; 113 Stat. 1436] or contrary to the rules adopted by the commissioner under this section. 2. The commissioner shall adopt rules necessary to carry out this section. a. The rules must be consistent with and not more restrictive than the model regulation adopted by the national association of insurance commissioners entitled "Privacy of Consumer Financial and Health Information Regulation". b. Notwithstanding subdivision a and subject to the exceptions, including the affiliate sharing exception provided for in the national association of insurance commissioners' model regulation, the rules may prohibit the disclosure of nonpublic personal health and financial information concerning an individual unless an authorization is obtained from the individual whose nonpublic personal health and financial information is sought to be disclosed. c. The rules may not require an insurance company, nonprofit health service corporation, or health maintenance organization to provide an annual privacy notice if the insurance company, nonprofit health service corporation, or health maintenance organization: (1) Complies with nonaffiliated third-party sharing rules adopted by the commissioner; and (2) Has not changed the insurance company's, nonprofit health service corporation's, or health maintenance organization's policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent notice sent to consumers. 3. This section does not create a private right of action.