a) General rule. Except as otherwise authorized in this Part, a licensee shall not, directly or through an affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party other than as described in the initial notice that the licensee provided to that consumer under Section 4002.40 of this Part, unless:

1. 1) The licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;
2. 2) The licensee has provided to the consumer a new opt out notice;
3. 3) The licensee has given the consumer a reasonable opportunity, before the licensee discloses the information to the nonaffiliated third party, to opt out of the disclosure; and
4. 4) The consumer does not opt out.

b) Pursuant to subsection (a) of this Section, except as otherwise permitted by Sections 4002.130, 4002.140 and 4002.150 of this Part, a licensee is required to provide a revised notice before any amendments or changes are made to its privacy policies or practices concerning disclosure as set forth in the initial notice, or the most recently issued notice, such as:

1. 1) Disclosing a new category of nonpublic personal financial information to any nonaffiliated third party;
2. 2) Disclosing nonpublic personal financial information to a new category of nonaffiliated third party; or
3. 3) Disclosing nonpublic personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt out right regarding that disclosure.