1. (1) The purpose of this rule is to:

   1. (a) govern a licensee's treatment of an individual's nonpublic personal health information and nonpublic personal financial information;
   2. (b) require a licensee to provide notice to an individual about the licensee's privacy policies and practices;
   3. (c) describe the conditions under which a licensee may disclose an individual's nonpublic personal health information and nonpublic personal financial information to an affiliate or nonaffiliated third party; and
   4. (d) provide means by which an individual may prevent a licensee from disclosing the individual's nonpublic information.
2. (2) This rule applies to a licensee who obtains nonpublic personal financial information or nonpublic personal health information regarding a customer or consumer of a product or service primarily for a personal, family, or household purpose.

3. (3) This rule does not apply to:

   1. (a) a licensee with information about a person who obtains a product or service for a business, commercial, or agricultural purpose;

   2. (b) a person selling or providing:

      1. (i) a manufacturer warranty;
      2. (ii) a manufacturer service contract paid for with consideration, in addition to the consideration paid for the product; or
      3. (iii) a service contract for the repair or maintenance of goods, including motor vehicles, that is paid for with consideration in addition to consideration paid for the product;
   3. (c) a financial institution;
   4. (d) a securities broker or dealer; or
   5. (e) a credit union that engages in an activity or function that does not require a license from the commissioner.

KEY: insurance law

Date of Last Change: November 21, 2023

Notice of Continuation: May 19, 2026

Authorizing, and Implemented or Interpreted Law: 31A-2-201; 31A-23a-417; 15 U.S.C. 6801-6820