44-915.

Notice and opt out requirements; additional exceptions.

The requirements for initial notice to consumers in subdivision (1)(b) of section 44-904, the opt out in sections 44-907 and 44-910, and service providers and joint marketing in section 44-913 do not apply when a licensee discloses nonpublic personal financial information:

(1) With the consent or at the direction of the consumer if the consumer has not revoked the consent or direction;

(2)(a) To protect the confidentiality or security of a licensee's records pertaining to the consumer, service, product, or transaction;

(b) To protect against or prevent actual or potential fraud or unauthorized transactions;

(c) For required institutional risk control or for resolving consumer disputes or inquiries;

(d) To persons holding a legal or beneficial interest relating to the consumer; or

(e) To persons acting in a fiduciary or representative capacity on behalf of the consumer;

(3) To provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating a licensee, persons that are assessing the licensee's compliance with industry standards, and the licensee's attorneys, accountants, and auditors;

(4) To the extent specifically permitted or required under other provisions of law and in accordance with 12 U.S.C. 3401 et seq., as such sections existed on January 1, 2019, to law enforcement agencies, including the Federal Reserve Board, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, National Credit Union Administration, Consumer Financial Protection Bureau, the Securities and Exchange Commission, the Secretary of the Treasury, with respect to 31 U.S.C. Chapter 53, Subchapter II, and 12 U.S.C. Chapter 21, as such federal laws existed on January 1, 2019, a state insurance authority, a state banking and state securities authority, and the Federal Trade Commission, to self-regulatory organizations, or for an investigation on a matter related to public safety;

(5)(a) To a consumer reporting agency in accordance with 15 U.S.C. 1681 et seq., as such sections existed on January 1, 2019; or

(b) From a consumer report reported by a consumer reporting agency;

(6) In connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal financial information concerns solely consumers of the business or unit;

(7)(a) To comply with federal, state, or local laws, rules, and other applicable legal requirements;

(b) To comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by federal, state, or local authorities;

(c) To respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance, or other purposes as authorized by law; or

(8) For purposes related to the replacement of a group benefit plan, a group health plan, a group welfare plan, or a workers' compensation plan.