Section 22.12 - Revised Privacy Notices(a) Except as otherwise authorized in this subchapter, a covered entity shall not, directly or through an affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party other than as described in the initial notice that the covered entity provided to that consumer under § 22.8 of this title (relating to Initial Privacy Notice), unless: (1) the covered entity has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;(2) the covered entity has provided to the consumer a new opt out notice;(3) the covered entity has given the consumer a reasonable opportunity, before the covered entity discloses the information to the nonaffiliated third party, to opt out of the disclosure; and(4) the consumer does not opt out.(b) Except as otherwise permitted by § 22.17 of this title (relating to Exception to Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information for Service Providers and Joint Marketing), § 22.18 of this title (relating to Exceptions to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information for Processing and Servicing Transactions) and § 22.19 of this title (relating to Other Exceptions to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information), a covered entity shall provide a revised notice before it:(1) discloses a new category of nonpublic personal financial information to any nonaffiliated third party;(2) discloses nonpublic personal financial information to a new category of nonaffiliated third party; or(3) discloses nonpublic personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt out right regarding that disclosure.(c) A revised notice is not required if the covered entity discloses nonpublic personal financial information to a new nonaffiliated third party that the covered entity adequately described in its prior notice.(d) When a covered entity is required to deliver a revised privacy notice by this section, the covered entity shall deliver it according to § 22.13 of this title (relating to Delivery).28 Tex. Admin. Code § 22.12
The provisions of this §22.12 adopted to be effective December 17, 2001, 26 TexReg 10316