Section 22.8 - Initial Privacy Notice(a) Initial notice requirement. A covered entity shall provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to: (1) an individual who becomes the covered entity's customer, not later than when the covered entity establishes a customer relationship, except as provided in subsection (e) of this section; and(2) a consumer, before the covered entity discloses any nonpublic personal financial information about the consumer to any nonaffiliated third party, if the covered entity makes a disclosure other than as authorized by § 22.18 of this title (relating to Exceptions to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information for Processing and Servicing Transactions) and § 22.19 of this title (relating to Other Exceptions to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information).(b) Initial notice not required. A covered entity is not required to provide an initial notice to a consumer under subsection (a)(2) of this section if:(1) the covered entity does not disclose any nonpublic personal financial information about the consumer to any nonaffiliated third party, other than as authorized by § 22.18 and § 22.19 of this title, and the covered entity does not have a customer relationship with the consumer; or(2) a notice has been provided by an affiliated covered entity, so long as the notice clearly identifies all covered entities to whom the notice applies and is accurate with respect to the covered entity and the other institutions.(c) Establishment of a customer relationship. (1) Generally, a covered entity establishes a customer relationship at the time the covered entity and the consumer enter into a continuing relationship.(2) Some examples of a covered entity establishing a customer relationship occur when the consumer: (A) becomes a policyholder of a covered entity that is an insurer when the insurer delivers an insurance policy or contract to the consumer, or in the case of a covered entity that is an insurance agent, obtains insurance through that covered entity; or(B) agrees to obtain financial, economic or investment advisory services relating to insurance products or services for a fee from the covered entity.(d) Existing customers. When an existing customer obtains a new insurance product or service from a covered entity that is to be used primarily for personal, family or household purposes, if the initial, revised or annual notice that the covered entity most recently provided to that customer was inaccurate with respect to the new insurance product or service, the covered entity shall, in accordance with the initial notice requirements of subsection (a) of this section, provide a revised privacy notice, under § 22.12 of this title (relating to Revised Privacy Notices), that covers the customer's new insurance product or service. If the initial, revised or annual notice that the covered entity most recently provided to that customer was accurate with respect to the new insurance product or service, the covered entity does not need to provide a new privacy notice under subsection (a) of this section.(e) Subsequent delivery of notice. (1) General rule. A covered entity may provide the initial notice required by subsection (a)(1) of this section within a reasonable time after the covered entity establishes a customer relationship if:(A) establishing the customer relationship is not at the customer's election; or(B) providing notice not later than when the covered entity establishes a customer relationship would substantially delay the customer's transaction and the customer agrees to receive the notice at a later time.(2) Not at customer's election. Establishing a customer relationship is not at the customer's election if a covered entity acquires or is assigned a customer's policy from another financial institution or residual market mechanism and the customer does not have a choice about the covered entity's acquisition or assignment.(3) Substantial delay of customer's transaction. Providing notice not later than when a covered entity establishes a customer relationship would substantially delay the customer's transaction when the covered entity and the individual agree over the telephone to enter into a customer relationship involving prompt delivery of the insurance product or service.(4) No substantial delay of customer's transaction. Providing notice not later than when a covered entity establishes a customer relationship would not substantially delay the customer's transaction when the relationship is initiated in person at the covered entity's office or through other means by which the customer may view the notice, such as on a Web site.(f) Delivery. A covered entity shall deliver any notices required by this section according to § 22.13 of this title (relating to Delivery). If the covered entity uses a short-form initial notice for non-customers according to § 22.10(d) of this title (relating to Information to be Included in Privacy Notices), the covered entity may deliver its privacy notice according to § 22.10(d)(3) of this title.28 Tex. Admin. Code § 22.8
The provisions of this §22.8 adopted to be effective December 17, 2001, 26 TexReg 10316