D.C. Mun. Regs. tit. 26, r. 26-A3605
If a licensee is required to provide an opt out notice under § 3604.1 through § 3604.4, the licensee shall provide a clear and conspicuous notice to each of its consumers that accurately explains the right to opt out under § 3604.1. The notice shall state:
A licensee provides adequate notice that the consumer can opt out of the disclosure of nonpublic personal information to a nonaffiliated third party if the licensee identifies all of the categories of nonpublic personal information that the licensee discloses or reserves the right to disclose to nonaffiliated third parties as described in § 3603 and states that the consumer can opt out of the disclosure of that information.
A licensee provides a reasonable means to exercise an opt out right if it:
A licensee does not provide a reasonable means of opting out if the only means of opting out is for the consumer to write his or her own letter to exercise the opt out right.
A licensee may not provide the opt out notice solely by orally explaining, either in person or over the telephone, the right of the consumer to opt out.
A licensee may provide the opt out notice together with or on the same written or electronic form as the initial notice it provides in accordance with § 3601.
If a licensee provides the opt out notice at a later time than required for the initial notice in accordance with § 3601, it shall also include a copy of the initial notice in writing or, if the consumer agrees, in an electronic form with the opt out notice.
Except as otherwise authorized in this regulation, a licensee shall not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice that the licensee provided to the consumer under § 3601, unless:
A licensee shall provide the revised notice of its policies and practices and opt out notice, if required under § 3605.8, to a consumer using the means permitted for providing the initial notice and opt out notice to that consumer under §§ 3601 and 3605, respectively.
Except as otherwise permitted by §§ 3606, 3607 and 3708, a revised notice is required if the licensee:
A revised notice is not required if the licensee discloses nonpublic personal information to a new nonaffiliated third party that is adequately described by its prior notice.
A consumer may exercise the right to opt out at any time, and the licensee shall comply with the consumer's direction as soon as reasonably practicable.
A consumer's direction to opt out under this section is effective until revoked by the consumer in writing, or if the consumer agrees, in electronic form.
If two or more consumers jointly obtain a financial product or service from a licensee, the licensee may provide a single opt out notice. The licensee's opt out notice shall explain how the licensee will treat an opt out direction by a joint consumer.
Any of the joint consumers may exercise the right to opt out. The licensee may either:
If the licensee permits each joint consumer to opt out separately, the licensee shall permit one of the joint consumers to opt out on behalf of all the joint consumers.
A licensee may not require all joint consumers to opt out before the licensee implements any opt out direction.
For example, if John and Mary are both named insureds on an insurance policy with a licensee and arrange for the licensee to send all correspondence about the policy to John's address, the licensee may do any of the following, but the licensee shall explain in its opt out notice which opt out policy it will follow:
A licensee shall provide any privacy notices and opt out notices, including short-form initial notices in § 3603.9, that this section requires so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically.
A licensee may reasonably expect that a consumer will receive actual notice if the licensee:
A licensee may not reasonably expect that a consumer will receive actual notice of the licensee's privacy policies and practices if the licensee:
A licensee may reasonably expect that a customer will receive actual notice of the licensee's annual privacy notice if:
A licensee may not provide any notice required by § 3605 solely by orally explaining the notice, either in person or over the telephone.
For customers only, a licensee shall provide the initial notice required by section 3601, the annual notice required by § 3602, and the revised notice required by § 3605.9, so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
The licensee provides a privacy notice to the customer so that the customer can retain it or obtain it later if the licensee:
A licensee may provide a joint notice from the licensee and one or more of the licensee's affiliates or other financial institutions, as identified in the notice, as long as the notice is accurate with respect to the licensee and the other institutions. A licensee also may provide notice on behalf of another financial institution.
Producers may deliver any notice required under this regulation on behalf of another licensee. A producer shall not otherwise be subject to the requirements of this section in any instance where the insurer, including affiliates, on whose behalf the producer is acting otherwise complies with the requirements contained herein, and the producer does not disclose any financial information to any person other than the insurer or its affiliates in a manner permitted by this regulation.
D.C. Mun. Regs. tit. 26, r. 26-A3605