(a) The commissioner, upon the commissioner’s own initiative or upon request by an insurer, shall waive any requirement of this chapter if such waiver does not contradict the objective or intent of the rule and:

1. (1) Applying the rule provision would cause confusion or would be misleading to consumers;
2. (2) The rule provision is in whole or in part inapplicable to the given circumstances;

3. (3) There are specific circumstances unique to the situation such that strict compliance with the rule would be onerous without promoting the objective or intent of the rule

   provision; or

4. (4) Any other similar extenuating circumstances exist such that application of an alternative standard or procedure better promotes the objective or intent of the rule provision.

(d) A request for a waiver shall specify the basis for the waiver and proposed alternative, if any.

1. 1. How the Model Privacy Form is used.
2. (a) The Model Form may be used, at the option of a “licensee”, including a group of licensees or other financial institutions that use a common privacy notice, to meet the content requirements of the privacy notice and opt-out notice set forth in Ins 3002.03 and Ins 3002.04.
3. (b) The Model Form is a standardized form, including page layout, content, format, style, pagination, and shading. Licensees seeking to obtain the safe harbor through use of the Model Form may modify it only as described in these Instructions.
4. (c) Note that disclosure of certain information, such as assets, income, and information from a consumer reporting agency, may give rise to obligations under the federal Fair Credit Reporting Act (FCRA), codified at 15 U.S.C. §§ 1681-1681x, such as a requirement to permit a consumer to opt out of disclosures to affiliates, or designation as a consumer reporting agency if disclosures are made to nonaffiliated third parties.
5. (d) The word “customer” may be replaced by the word “member,” whenever it appears in the Model Form, as appropriate.

6. 2. The Contents of the Model Privacy Form

   The Model Form consists of two pages, which may be printed on both sides of a single sheet of paper or may appear on two separate pages. Where a licensee provides a long list of licensees or financial institutions at the end of the Model Form in accordance with Instruction B3(a)(i), or provides additional information in accordance with Instruction B3(c) and such list or additional information exceeds the space available on Page Two of the Model Form, such list or additional information may extend to a third page.

7. (a) Page One. The first page consists of the following components:

   1. (1) Date last revised (upper right-hand corner)
   2. (2) Title
   3. (3) Key frame (Why? What? How?)
   4. (4) Disclosure table (“Reasons we can share your personal information”)
   5. (5) “To limit our sharing” box, as needed, for the licensee’s opt-out information
   6. (6) “Questions” box, for customer service contact information
   7. (7) Mail-in opt-out form, as needed

8. (b) Page Two. The second page consists of the following components:

   1. (1) Heading (Page 2)
   2. (2) Frequently Asked Questions (“Who we are” and “What we do”)
   3. (3) Definitions
   4. (4) “Other important information” box, as needed

   5. 3. The format of the Model Privacy Form.

      The format of the Model Form may be modified only as described below.

   6. (a) Easily readable type font. Licensees that use the Model Form must use an easily readable type font. While a number of factors together produce easily readable font, licensees are required to use a minimum of 10- point font (unless otherwise expressly permitted in these Instructions) and sufficient spacing between lines.
   7. (b) Logo. A licensee may include a corporate logo on any page of the notice, so long as it does not interfere with the readability of the Model Form or the space constraints of each page.
   8. (c) Page size and orientation. Each page of the Model Form must be printed in portrait orientation, the size of which must be sufficient to meet the layout and minimum font size requirements, with sufficient white space on the top, bottom, and sides of the content.
   9. (d) Color. The Model Form must be printed on white or light color paper (such as cream) with black or other contrasting ink color. Spot color may be used to achieve visual interest, so long as the color contrast is distinctive and the color does not detract from the readability of the Model Form. Logos may also be printed in color.

   10. (e) Languages. The Model Form may be translated into languages other than English.

       1. 1. Name of licensee or group of affiliated licensees or institutions providing the notice

          Insert the name of the licensee providing the notice, or a common identity of the affiliated licensees or financial institutions jointly providing the notice on the form, wherever [name of licensee] appears.

       2. 2. Page One
       3. (a) Last revised date. The licensee must insert in the upper right-hand corner the date on which the notice was last revised. The information shall appear in minimum 8-point font as “rev. [month/year]” using either the name or number of the month, such as “rev. July 2016” or “rev. 7/16.”

       4. (b) General instructions for the “What?” box

          1. (i) The bulleted list identifies the types of personal information that the licensee collects and shares. All licensees must use the term “Social Security Number” in the first bullet.
          2. (ii) A licensee must use five (5) of the following terms, to complete the bulleted list: income; account balances; payment history; transaction history; transaction or loss history; credit history; credit scores; assets; investment experience; credit-based insurance scores; insurance claim history; medical information; overdraft history; purchase history; account transactions; risk tolerance; medical-related debts; credit card or other debt; mortgage rates and payments; retirement assets; checking account information; employment information; wire transfer instructions.

       5. (c) General instructions for the disclosure table. The left column lists reasons for sharing or using personal information. Each reason correlates to a specific legal provision described in Paragraph 2(d) of this Instruction. In the middle column, each licensee must provide a “Yes” or “No” response that accurately reflects its information-sharing policies and practices with respect to the reason listed on the left. In the right column, each licensee must provide in each box one of the following three (3) responses, as applicable, that reflects whether a consumer can limit such sharing:

          “Yes,” if it is required to or voluntarily provides an opt-out; “No,” if it does not provide an opt-out; or

          “We don’t share,” if it answers “No” in the middle column.

          Only the sixth row (“For our affiliates to market to you”) may be omitted at the option of the licensee. See Paragraph 2(d)(6) of this instruction.

       6. (d) Specific disclosures and corresponding legal provisions

          1. (i) For our everyday business purposes. This reason incorporates sharing information under Ins 3004.02 and Ins 3004.03 and with service providers pursuant to Ins 3004.01 other than the disclosures described in Paragraphs (2)(d)(ii) or (2)(d)(iii) of this instruction.
          2. (ii) For our marketing purposes. This reason incorporates sharing information with service providers by a licensee for its own marketing pursuant to Ins 3004.01. A licensee that shares for this reason may choose to provide an opt-out.
          3. (iii) For joint marketing with other financial companies. This reason incorporates sharing information under joint marketing agreements between 2 or more licensees or financial institutions and with any service provider used in conjunction with such agreement pursuant to Ins 3004.01. A licensee that shares for this reason may choose to provide an opt-out.
          4. (iv) For our affiliates’ everyday business purposes – information about transactions and experiences. This reason incorporates sharing information specified in Sections 603(d)(2)(A)(i) and (ii) of the FCRA. A licensee that shares information for this reason may choose to provide an opt-out.
          5. (v) For our affiliates’ everyday business purposes – information about creditworthiness. This reason incorporates sharing information pursuant to Section 603(d)(2)(A)(iii) of the FCRA. A licensee that shares information for this reason must provide an opt-out.
          6. (vi) For our affiliates to market to you. This reason incorporates sharing information specified in Section 624 of the FCRA. This reason may be omitted from the disclosure table when: the licensee does not have affiliates (or does not disclose personal information to its affiliates); the licensee’s affiliates do not use personal information in a manner that requires an opt-out; or the licensee provides the affiliate marketing notice separately. Licensees that include this reason must provide an opt-out of indefinite duration. A licensee that is required to provide an affiliate marketing opt-out, but does not include that opt-out in the Model Form under this part, must comply with Section 624 of the FCRA and Ins 3000, with respect to the initial notice and opt-out and any subsequent renewal notice and opt-out. A licensee not required to provide an opt-out under this subparagraph may elect to include this reason in the Model Form.
          7. (vii) For nonaffiliates to market to you. This reason incorporates sharing described in Ins 3002.04 and Ins 3003.01(a). A licensee that shares personal information for this reason must provide an opt-out.
       7. (e) To limit our sharing. A licensee must include this section of the Model Form only if it provides an opt-out. The word “choice” may be written in either the singular or plural, as appropriate. Licensees must select one or more of the applicable opt-out methods described: telephone, such as by a toll-free number; a web site; or use of a mail-in opt-out form. Licensees may include the word “toll-free” before telephone, as appropriate. A licensee that allows consumers to opt out online must provide either a specific web address that takes consumers directly to the opt-out page or a general web address that provides a clear and conspicuous direct link to the opt-out page. The opt-out choices made available to the consumer who contacts the licensee through these methods must correspond accurately to the “Yes” responses in the third column of the disclosure table. In the part entitled “Please note,” licensees may insert a number that is 30 days or greater in the space marked “[30].” Instructions on voluntary or state privacy law opt-out information are in Paragraph 2(g)(v) of these Instructions.
       8. (f) Questions box. Customer service contact information must be inserted as appropriate where [phone number] or [web site] appear. Licensees may elect to provide either a phone number, such as a toll-free number, or a web address, or both. Licensees may include the words “toll-free” before the telephone number, as appropriate.

       9. (g) Mail-in opt-out form. Licensees must include this mail-in form only if they state in the “To limit our sharing” box that consumers can opt out by mail. The mail-in form must provide opt-out options that correspond accurately to the “Yes” responses in the third column of the disclosure table. Licensees that require consumers to provide only name and address may omit the section identified as “[account #].” Licensees that require additional or different information, such as a random opt-out number or a truncated account number to implement an opt-out election should modify the “[account #]” reference accordingly. This includes licensees that require customers with multiple accounts to identify each account to which the opt-out should apply. A licensee must enter its opt-out mailing address in the far right of this form (see version 3); or below the form (see version 4). The reverse side of the mail-in opt-out form must not include any content of the Model Form.

          1. (i) Joint accountholder. Only licensees that provide their joint accountholders the choice to opt out for only one accountholder, in accordance with Paragraph 3(a)(5) of these Instructions, must include in the far left column of the mail-in form the following statement:

             If you have a joint account, your choice(s) will apply to everyone on your account unless you mark below.

             □ Apply my choice(s) only to me.

             The word “choice” may be written in either the singular or plural, as appropriate. Licensees that provide insurance products or services, provide this option, and elect to use the Model Form may substitute the word “policy” for “account” in this statement. Licensees that do not provide this option may eliminate this left column from the mail-in form.

          2. (ii) FCRA Section 603(d)(2)(A)(iii) opt-out. If the licensee shares personal information pursuant to Section 603(d)(2)(A)(iii) of the FCRA, it must include in the mail-in opt-out form the following statement:

             □ Do not share information about my creditworthiness with your affiliates for their everyday business purposes.

          3. (iii) FCRA Section 624 opt-out. If the licensee uses Section 624 of the FCRA, in accord with paragraph 2(d)(6) of these Instructions, it must include in the mail-in opt-out form the following statement:

             □ Do not allow your affiliates to use my personal information to market to me.

          4. (iv) Nonaffiliate opt-out. If the licensee shares personal information pursuant to Ins 3003.01(a), it must include in the mail-in opt-out form the following statement:

             □ Do not share my personal information with nonaffiliates to market their products and services to me.

          5. (v) Additional opt-outs. Licensees that use the disclosure table to provide opt-out options beyond those required by Federal law must provide those opt-outs in this section of the Model Form. A licensee that chooses to offer an opt-out for its own marketing in the mail-in opt-out form must include one of the two following statements:

             □ Do not share my personal information to market to me. or

             □ Do not use my personal information to market to me.

             A licensee that chooses to offer an opt-out for joint marketing must include the following statement:

             □ Do not share my personal information with other financial institutions to jointly market to me.

       10. (h) Barcodes. A licensee may elect to include a barcode and/or “tagline” (an internal identifier) in 6-point type at the bottom of page one, as needed for information internal to the licensee, so long as these do not interfere with the clarity or text of the form.
       11. 3. Page Two

       12. (a) General Instructions for the Questions. Certain Questions on the Model Form may be customized as follows:

           1. (i) “Who is providing this notice?” This question may be omitted where only one licensee provides the Model Form and that licensee is clearly identified in the title on Page One. Two or more licensees or financial institutions that jointly provide the Model Form must use this question to identify themselves as required by Ins 3002.07(f). Where the list of licensees or financial institutions exceeds four (4) lines, the licensee must describe in the response to this question the general types of licensees or financial institutions jointly providing the notice and must separately identify those licensees or financial institutions, in minimum 8-point font, directly following the “Other important information” box, or, if that box is not included in the licensee’s form, directly following the “Definitions.” The list may appear in a multi- column format.
           2. (ii) “How does [name of licensee] protect my personal information?” The licensee may only provide additional information pertaining to its safeguards practices following the designated response to this question. Such information may include information about the licensee’s use of cookies or other measures it uses to safeguard personal information. Licensees are limited to a maximum of 30 additional words.

           3. (iii) “How does [name of licensee] collect my personal information?” Licensees must use five (5) of the following terms to complete the bulleted list for this question: open an account; deposit money; pay your bills; apply for a loan; use your credit or debit card; seek financial or tax advice; apply for insurance; pay insurance premiums; file an insurance claim; seek advice about your investments; buy securities from us; sell securities to us; direct us to buy securities; direct us to sell your securities; make deposits or withdrawals from your account; enter into an investment advisory contract; give us your income information; provide employment information; give us your employment history; tell us about your investment or retirement portfolio; tell us about your investment or retirement earnings; apply for financing; apply for a lease; provide account information; give us your contact information; pay us by check; give us your wage statements; provide your mortgage information; make a wire transfer; tell us who receives the money; tell us where to send the money; show your government-issued ID; show your driver’s license; order a commodity futures or option trade.

              Licensees that collect personal information from their affiliates and/or credit bureaus must include the following statement after the bulleted list: “We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.” Licensees that do not collect personal information from their affiliates or credit bureaus but do collect information from other companies must include the following statement instead: “We also collect your personal information from other companies.” Only licensees that do not collect any personal information from affiliates, credit bureaus, or other companies can omit both statements.

           4. (iv) “Why can’t I limit all sharing?” Licensees that describe state privacy law provisions in the “Other important information” box must use the bracketed sentence: “See below for more on your rights under state law.” Other licensees must omit this sentence.
           5. (v) “What happens when I limit sharing for an account I hold jointly with someone else?” Only licensees that provide opt-out options must use this question. Other licensees must omit this question. Licensees must choose one of the following two statements to respond to this question: “Your choices will apply to everyone on your account.” or “Your choices will apply to everyone on your account-unless you tell us otherwise.” Licensees may substitute the word “policy” for “account” in these statements.

       13. (b) General Instructions for the Definitions. The licensee must customize the space below the responses to the three definitions in this section. This specific information must be in italicized lettering to set off the information from the standardized definitions.

           1. (i) Affiliates. As required by Ins 3002.03(a)(3), where [affiliate information] appears, the licensee must:
           2. a. If it has no affiliates, state: “[name of licensee] has no affiliates”;
           3. b. If it has affiliates but does not share personal information with them, state: “[name of licensee] does not share with our affiliates”; or
           4. c. If it shares with its affiliates, state, as applicable: “Our affiliates include companies with a [common corporate identity of licensee] name; financial companies such as [insert illustrative list of companies]; nonfinancial companies, such as [insert illustrative list of companies]; and others, such as [insert illustrative list].”
           5. (ii) Nonaffiliates. As required by Ins 3002.03(c)(3), where [nonaffiliate information] appears, the licensee must:
           6. a. If it does not share with nonaffiliated third parties, state: “[name of licensee] does not share with nonaffiliates so they can market to you”; or
           7. b. If it shares with nonaffiliated third parties, state, as applicable: “Nonaffiliates we share with can include [list categories of companies such as mortgage companies, insurance companies, direct marketing companies, and nonprofit organizations].”
           8. (iii) Joint Marketing. As required by Ins 3004.01, where [joint marketing] appears, the licensee must:
           9. a. If it does not engage in joint marketing, state: “[name of licensee] doesn’t jointly market”; or
           10. b. If it shares personal information for joint marketing, state, as applicable: “Our joint marketing partners include [list categories of companies such as credit card companies].”

       14. (c) General instructions for the “Other important information” box. This box is optional. The space provided for information in this box is not limited, and an additional page may be used if necessary. Only the following types of information can appear in this box:

           1. (i) State and/or international privacy law information; and/or

           2. (ii) A form by which the consumer may acknowledge receipt of the notice.

              [if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f"> <v:stroke joinstyle="miter"/> <v:formulas> <v:f eqn="if lineDrawn pixelLineWidth 0"/> <v:f eqn="sum @0 1 0"/> <v:f eqn="sum 0 0 @1"/> <v:f eqn="prod @2 1 2"/> <v:f eqn="prod @3 21600 pixelWidth"/> <v:f eqn="prod @3 21600 pixelHeight"/> <v:f eqn="sum @0 0 1"/> <v:f eqn="prod @6 1 2"/> <v:f eqn="prod @7 21600 pixelWidth"/> <v:f eqn="sum @8 21600 0"/> <v:f eqn="prod @7 21600 pixelHeight"/> <v:f eqn="sum @10 21600 0"/> </v:formulas> <v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/> <o:lock v:ext="edit" aspectratio="t"/> </v:shapetype><v:shape id="Picture_x0020_1" o:spid="_x0000_i1025" type="#_x0000_t75" style='width:468pt;height:606pt;visibility:visible'> <v:imagedata src="ins3000_files/image001.png" o:title=""/> </v:shape><![endif]if !vml?endif?
              

              [if gte vml 1]><v:shape id="Picture_x0020_2" o:spid="_x0000_i1026" type="#_x0000_t75" style='width:468pt; height:606pt;visibility:visible'> <v:imagedata src="ins3000_files/image003.png" o:title=""/> </v:shape><![endif]if !vml?endif?

              [if gte vml 1]><v:shape id="Picture_x0020_3" o:spid="_x0000_i1027" type="#_x0000_t75" style='width:468pt; height:606pt;visibility:visible'> <v:imagedata src="ins3000_files/image005.png" o:title=""/> </v:shape><![endif]if !vml?endif?

              [if gte vml 1]><v:shape id="Picture_x0020_4" o:spid="_x0000_i1028" type="#_x0000_t75" style='width:468pt; height:606pt;visibility:visible'> <v:imagedata src="ins3000_files/image007.png" o:title=""/> </v:shape><![endif]if !vml?endif?

              [if gte vml 1]><v:shape id="Picture_x0020_5" o:spid="_x0000_i1029" type="#_x0000_t75" style='width:468pt; height:606pt;visibility:visible'> <v:imagedata src="ins3000_files/image009.png" o:title=""/> </v:shape><![endif]if !vml?endif?

              [if gte vml 1]><v:shape id="Picture_x0020_6" o:spid="_x0000_i1030" type="#_x0000_t75" style='width:468pt; height:606pt;visibility:visible'> <v:imagedata src="ins3000_files/image011.png" o:title=""/> </v:shape><![endif]if !vml?endif?

              [if gte vml 1]><v:shape id="Picture_x0020_7" o:spid="_x0000_i1031" type="#_x0000_t75" style='width:468pt; height:606pt;visibility:visible'> <v:imagedata src="ins3000_files/image013.png" o:title=""/> </v:shape><![endif]if !vml?endif?

              APPENDIX I

              Rule

              Specific State Statute the Rule Implements

              Ins 3001.01

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3001.02

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3001.03

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3001.04

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3002.01

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3002.02

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3002.03

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3002.04

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3002.05

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3002.06

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3002.07

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3003.01

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3003.02

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3003.03

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3004.01

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3004.02

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3004.03

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3005.01

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3005.02

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3005.03

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3005.04

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3005.05

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3006.01

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3006.02

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16

              Ins 3006.03

              RSA 400-A:15, I; RSA 406-C:9; RSA 406-C:16; RSA 417:13

              Ins 3007.01

              RSA 400-A:15, I; RSA 406-C:16; RSA 541-A:22, IV

              Appendix A

              RSA 400-A:15, I

              Appendix B

              RSA 400-A:15, I

       B. Information Required in the Model Privacy Form

       The information in the Model Form may be modified only as described below:

Source. #12749, eff 5-6-19

APPENDIX A - SAMPLE CLAUSES

Licensees, including a group of financial holding company affiliates that use a common privacy notice, may use the following sample clauses, if the clause is accurate for each institution that uses the notice. (Note that disclosure of certain information, such as assets, income, and information from a consumer reporting agency, may give rise to obligations under the federal Fair Credit Reporting Act, such as a requirement to permit a consumer to opt out of disclosures to affiliates or designation as a consumer reporting agency if disclosures are made to nonaffiliated third parties.)

A-1-Categories of information a licensee collects (all institutions)

A licensee may use this clause, as applicable, to meet the requirement of Ins 3002.03 to describe the categories of nonpublic personal information the licensee collects.

Sample Clause A-1:

We collect nonpublic personal information about you from the following sources:

if !supportLists?· endif?Information we receive from you on applications or other forms;

if !supportLists?· endif?Information about your transactions with us, our affiliates or others; and

if !supportLists?· endif?Information we receive from a consumer reporting agency.

A-2-Categories of information a licensee discloses (institutions that disclose outside of the exceptions)

A licensee may use one of these clauses, as applicable, to meet the requirement of Ins 3002.03 to describe the categories of nonpublic personal information the licensee discloses. The licensee may use these clauses if it discloses nonpublic personal information other than as permitted by the exceptions in Ins 3004.01, Ins 3004.02 and Ins 3004.03.

Sample Clause A-2, Alternative 1:

We may disclose the following kinds of nonpublic personal information about you:

if !supportLists?· endif?Information we receive from you on applications or other forms, such as [provide illustrative examples, such as “your name, address, social security number, assets, income, and beneficiaries”];

if !supportLists?· endif?Information about your transactions with us, our affiliates or others, such as [provide illustrative examples, such as “your policy coverage, premiums, and payment history”]; and

if !supportLists?· endif?Information we receive from a consumer reporting agency, such as [provide illustrative examples, such as “your creditworthiness and credit history”].

Sample Clause A-2, Alternative 2:

We may disclose all of the information that we collect, as described [describe location in the notice, such as “above” or “below”].

A-3-Categories of information a licensee discloses and parties to whom the licensee discloses (institutions that do not disclose outside of the exceptions)

A licensee may use this clause, as applicable, to meet the requirements of Ins 3002.03 to describe the categories of nonpublic personal information about customers and former customers that the licensee discloses and the categories of affiliates and nonaffiliated third parties to whom the licensee discloses. A licensee may use this clause if the licensee does not disclose nonpublic personal information to any party, other than as permitted by the exceptions in Ins 3004.02 and Ins 3004.03.

Sample Clause A-3:

We do not disclose any nonpublic personal information about our customers or former customers to anyone, except as permitted by law.

A-4-Categories of parties to whom a licensee discloses (institutions that disclose outside of the exceptions)

A licensee may use this clause, as applicable, to meet the requirement of Ins 3002.03 to describe the categories of affiliates and nonaffiliated third parties to whom the licensee discloses nonpublic personal information. This clause may be used if the licensee discloses nonpublic personal information other than as permitted by the exceptions in Ins 3004.01, Ins 3004.02 and Ins 3004.03, as well as when permitted by the exceptions in Ins 3004.02 and Ins 3004.03.

Sample Clause A-4:

We may disclose nonpublic personal information about you to the following types of third parties:

if !supportLists?· endif?Financial service providers, such as [provide illustrative examples, such as “life insurers, automobile insurers, mortgage bankers, securities broker-dealers, and insurance agents”];

if !supportLists?· endif?Non-financial companies, such as [provide illustrative examples, such as “retailers, direct marketers, airlines, and publishers”]; and

if !supportLists?· endif?Others, such as [provide illustrative examples, such as “nonprofit organizations”].

We may also disclose nonpublic personal information about you to nonaffiliated third parties as permitted by law.

A-5-Service provider/joint marketing exception

A licensee may use one of these clauses, as applicable, to meet the requirements of Ins 3002.03 related to the exception for service providers and joint marketers in Ins 3004.01. If a licensee discloses nonpublic personal information under this exception, the licensee shall describe the categories of nonpublic personal information the licensee discloses and the categories of third parties with whom the licensee has contracted.

Sample Clause A-5, Alternative 1:

We may disclose the following information to companies that perform marketing services on our behalf or to other financial institutions with whom we have joint marketing agreements:

if !supportLists?· endif?Information we receive from you on applications or other forms, such as [provide illustrative examples, such as “your name, address, social security number, assets, income and beneficiaries”];

if !supportLists?· endif?Information about your transactions with us, our affiliates or others, such as [provide illustrative examples, such as “your policy coverage, premium, and payment history”]; and

if !supportLists?· endif?Information we receive from a consumer reporting agency, such as [provide illustrative examples, such as “your creditworthiness and credit history”].

Sample Clause A-5, Alternative 2:

We may disclose all of the information we collect, as described [describe location in the notice, such as “above” or “below”] to companies that perform marketing services on our behalf or to other financial institutions with whom we have joint marketing agreements.

A-6-Explanation of opt out right (institutions that disclose outside of the exceptions)

A licensee may use this clause, as applicable, to meet the requirement of Ins 3002.03 to provide an explanation of the consumer’s right to opt out of the disclosure of nonpublic personal information to nonaffiliated third parties, including the method(s) by which the consumer may exercise that right. The licensee may use this clause if the licensee discloses nonpublic personal information other than permitted by the exceptions in Ins 3004.01, Ins 3004.02 and Ins 3004.03.

Sample Clause A-6:

If you prefer that we do not disclose nonpublic personal information about you to nonaffiliated third parties, you may opt out of those disclosures, that is, you may direct us not to make those disclosures (other than disclosures permitted by law). If you wish to opt out of disclosures to nonaffiliated third parties, you may [describe a reasonable means of opting out, such as “call the following toll-free number: (insert number)”].

A-7-Confidentiality and security (all institutions)

A licensee may use this clause, as applicable, to meet the requirement of Ins 3002.03 to describe its policies and practices with respect to protecting the confidentiality and security of nonpublic personal information.

Sample Clause A-7:

We restrict access to nonpublic personal information about you to [provide an appropriate description, such as “those employees who need to know that information to provide products or services to you”]. We maintain physical, electronic, and procedural safeguards that comply with federal regulations to guard your nonpublic personal information.

APPENDIX B – FEDERAL MODEL PRIVACY FORM

Licensees, including a group of financial holding company affiliates that use a common privacy notice, may use the Federal Model Privacy Form, if the Form is accurate for each institution that uses the Form. (Note that disclosure of certain information, such as assets, income, and information from a consumer reporting agency, may give rise to obligations under the federal Fair Credit Reporting Act, such as a requirement to permit a consumer to opt of disclosures to affiliates or designation as a consumer reporting agency if disclosures are made to nonaffiliated third parties.)

A. General Instructions