3601.1A licensee shall provide a clear and conspicuous notice that accurately reflects the licensee's privacy policies and practices to:
(a) Any person who becomes a licensee's customer, not later than when the time that the licensee establishes a customer relationship, except as provided in § 3601.6; and(b) A consumer, before a licensee discloses any nonpublic personal information about the consumer to any nonaffiliated third party, if a licensee makes such a disclosure other than as authorized by §§ 3607 and 3608.3601.2A licensee is not required to provide an initial notice to a consumer under § 3601.1(b) if:
(a) The licensee does not disclose any nonpublic personal information about the consumer to any nonaffiliated third party, other than as authorized by §§ 3607 and 3608; and(b) The licensee does not have a customer relationship with the consumer.(c) A notice has been provided by an affiliated licensee, as long as the notice clearly identifies all licensees to whom the notice applies and is accurate with respect to the licensee and the other institutions.3601.3A licensee establishes a customer relationship at the time the licensee and the consumer enter into a continuing relationship.
3601.4A licensee establishes a customer relationship when the consumer:
(a) Agrees to obtain insurance related financial, economic or investment advisory services from the licensee for a fee; or(b) Becomes a policyholder of the licensee that is an insurer when the insurer delivers an insurance policy or contract to the consumer, or in the case of a licensee that is an insurance producer or insurance broker, obtains insurance through that licensee.3601.5A licensee shall provide the privacy notice when required by § 3601.1(b) so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, in electronic form.
3601.6A licensee may provide the initial notice required by § 3601.1 within a reasonable time after the licensee establishes a customer relationship if:
(a) A licensee purchases the right to the continuing income from an insurance policy or assumes a policy from another insurer and the customer of that policy does not have a choice about the purchase or assumption; or(b) A licensee and the consumer orally agree to enter into a customer relationship and the consumer agrees to receive the notice thereafter.3601.7A licensee may not satisfy the initial notice requirement of § 3601.1 solely by orally explaining, either in person or over the telephone, the privacy policies and practices.
3601.8For customers only, a licensee shall provide the initial notice required by § 3601.1 so that it can be retained or obtained at a later time by the customer, in a written form or, if the customer agrees, in electronic form.
3601.9A licensee may reasonably expect that a consumer will receive actual notice of the licensee's privacy policies and practices if the licensee:
(a) Hand-delivers a printed copy of the notice to the consumer;(b) Mails a printed copy of the notice to the last known address of the consumer separately, or in a policy, billing, or other written documentation; or(c) For the consumer who conducts transactions electronically, posts the notice on the electronic site and requires the consumer to acknowledge receipt of the notice as a necessary step to obtaining a particular financial product or service.3601.10A licensee may not, however, reasonably expect that a consumer will receive actual notice of the licensee's privacy policies and practices if the licensee:
(a) Only posts a sign in the licensee's branch or office or generally publishes advertisements of its privacy policies and practices; or(b) Sends the notice via electronic mail to a consumer who obtains a financial product or service with the licensee in person or through the mail and who does not agree to receive the notice electronically.3601.11A licensee or its affiliate provides the initial privacy notice to the customer so that it can be retained or obtained at a later time if the licensee,
(a) Hand-delivers a printed copy of the notice to the customer;(b) Mails a printed copy of the notice to the last known address of the customer; or(c) Maintains the notice on a web site (or makes the notice available on a link to another web site) for the customer who obtains a financial product or service electronically and who agrees to receive the notice electronically.3601.12The licensee shall have presented the information in the notice required in this section in clear, concise sentences, paragraphs and sections, if the notice is written:
(a) Using short explanatory sentences or bulleted lists, whenever possible;(b) Using definite, concrete, everyday words and active voice whenever possible;(c) Avoiding the use of multiple negatives;(d) Avoiding the use of legal and highly technical business terminology whenever possible; and(e) Avoiding the use of boilerplate explanations that are imprecise and readily subject to different interpretations.3601.13A licensee shall have designed its notice to call attention to the nature and significance of the information contained in the notice, if the notice is written:
(a) Using a plain-language heading to call attention to the notice;(b) Using a typeface and type size that are easy to read; and(c) Providing wide margins and ample line spacing.3601.14If a licensee provides a notice on the same form as another notice or other document, it shall have designed the notice to call attention to the nature and significance of the information contained in the notice, if the notice is written using:
(a) Larger type size, boldface or italics in the text;(b) Wider margins and line spacing in the notice; and(c) Shading or sidebars to highlight the notice, whenever possible.3601.15If a licensee provides a notice on a web page, it shall have designed the notice to call attention to the nature and significance of the information contained in the notice, if the notice is written:
(a) Using text or visual cues to encourage scrolling down the page if necessary to view the entire notice;(b) Ensuring that other elements on the web site such as text, graphics, hyperlinks, or sound do not distract attention from the notice; and(c) Placing the notice on a screen that consumers frequently access, such as a home page or a page on which transactions are conducted; or(d) Placing a link on a screen that consumers frequently access, such as a home page or a page on which transactions are conducted, that connects directly to the notice and is labeled appropriately to convey the importance, nature, and relevance of the notice.3601.16(a) A licensee may satisfy the initial notice requirements in §§ 3601.1(b) and 3605.7 for a consumer who is not a customer by providing a short-form initial notice at he same time as the licensee delivers an opt out notice as required by § 3605.(b) A short-form notice shall: (1) Be clear and conspicuous;(2) State that the licensee's privacy notice is available on request; and(3) Explain a reasonable means by which the consumer may obtain that notice.(c) The licensee shall deliver its short form initial notice in the same manner as an initial or annual notice. The licensee is not required to deliver its privacy notice with its short-form initial notice. The licensee instead may simply provide the consumer a reasonable means to obtain its privacy notice. If a consumer who receives the licensee's short-form notice requests the licensee's privacy notice, the licensee shall deliver it in the same manner as applicable for an initial or annual notice.(d) The licensee provides a reasonable means by which a consumer may obtain a copy of its privacy notice if the licensee:(1) Provides a toll-free telephone number that the consumer may call to request the notice; or(2) For a consumer who conducts business in person at the licensee's office, maintains copies of the notice on hand that the licensee provides to the consumer immediately upon request.D.C. Mun. Regs. tit. 26, r. 26-A3601
Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48 DCR 8005 (August 24, 2001)