(a) Exceptions to opt-out requirements. The requirements for initial notice to consumers in 23 CAR § 30-201(a)(2), the opt out in 23 CAR §§ 30-204 and 30-301, and service providers and joint marketing in 23 CAR § 30-401 do not apply when a licensee discloses nonpublic personal financial information:

1. (1) With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction;

2. (2) To protect the confidentiality or security of a licensee’s records pertaining to the:

   1. (A) Consumer;
   2. (B) Service;
   3. (C) Product; or
   4. (D) Transaction;
3. (3) To protect against or prevent actual or potential fraud or unauthorized transactions;
4. (4) For required institutional risk control or for resolving consumer disputes or inquiries;
5. (5) To persons holding a legal or beneficial interest relating to the consumer;
6. (6) To persons acting in a fiduciary or representative capacity on behalf of the consumer;

7. (7) To provide information to:

   1. (A) Insurance rate advisory organizations;
   2. (B) Guaranty funds or agencies;
   3. (C) Claims databases;
   4. (D) Agencies that are rating a licensee;
   5. (E) Persons that are assessing the licensee’s compliance with industry standards; and
   6. (F) The licensee’s attorneys, accountants, and auditors;

8. (8) To the extent specifically permitted or required under other provisions of law and in accordance with the federal Right to Financial Privacy Act of 1978, 12 U.S.C. § 3401 et seq.:

   1. (A) To law enforcement agencies including the:

(i) Federal Reserve Board;

1. (ii) United States Office of the Comptroller of the Currency;

   1. (iii) Federal Deposit Insurance Corporation;

      1. (iv) Office of Thrift Supervision;
      2. (v) National Credit Union Administration;
      3. (vi) United States Securities and Exchange Commission;
      4. (vii) United States Secretary of the Treasury, with respect to United States Code Title 31 , Chapter 53, Subchapter II (Records and Reports on Monetary Instruments and Transactions) and Title 12, Chapter 21 (Financial Recordkeeping);
      5. (viii) State Insurance Department; and
      6. (ix) Federal Trade Commission;
   2. (B) To self-regulatory organizations; or
   3. (C) For an investigation on a matter related to public safety;
2. (9) To a consumer reporting agency in accordance with the federal Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq.;
3. (10) From a consumer report reported by a consumer reporting agency;
4. (11) In connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal financial information concerns solely consumers of the business or unit;

5. (12) To comply with federal, state, or local:

   1. (A) Laws;
   2. (B) Rules; and
   3. (C) Other applicable legal requirements;
6. (13) To comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by federal, state, or local authorities;
7. (14) To respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance, or other purposes as authorized by law; or
8. (15) For purposes related to the replacement of a group benefit plan, a group health plan, or a group welfare plan.