Current through Register Vol. 35, No. 6, March 26, 2024
A.
Nonpublic
personal financial information the licensee receives under an exception.
If a licensee receives nonpublic personal financial information from a
nonaffiliated financial or other institution under an exception in 13.1.3.18
NMAC or 13.1.3.19 NMAC, the licensee's disclosure and use of that information
is limited as follows:
(1) The licensee may
disclose the information to the affiliates of the financial or other
institution from which the licensee received the information;
(2) The licensee may disclose the information
to its affiliates, but the licensee's affiliates may, in turn, disclose and use
the information only to the extent that the licensee may disclose and use the
information; and
(3) The licensee
may disclose and use the information pursuant to an exception in 13.1.3.18 NMAC
or 13.1.3.19 NMAC, in the ordinary course of business to carry out the activity
covered by the exception under which the licensee received the
information.
(4)
Example. If a licensee receives information from a nonaffiliated
financial or other institution for claims settlement purposes, the licensee may
disclose the information for fraud prevention, or in response to a properly
authorized subpoena. The licensee may not disclose that information to a third
party for marketing purposes or use that information for its own marketing
purposes.
B.
Nonpublic personal financial information a licensee receives outside of an
exception. If a licensee receives nonpublic personal financial
information from a nonaffiliated financial institution other than under an
exception in 13.1.3.18 NMAC or 13.1.3.19 NMAC, the licensee may disclose the
information only:
(1) To the affiliates of
the financial or other institution from which the licensee received the
information;
(2) To its affiliates,
but its affiliates may, in turn, disclose the information only to the extent
that the licensee may disclose the information; and
(3) To any other person, if the disclosure
would be lawful if made directly to that person by the financial institution
from which the licensee received the information.
(4)
Example. If a licensee
obtains a customer list from a nonaffiliated financial or other institution
outside of the exceptions in 13.1.3.18 NMAC or 13.1.3.19 NMAC:
(a) The licensee may use that list for its
own purposes; and
(b) The licensee
may disclose that list to another nonaffiliated third party only if the
financial or other institution from which the licensee purchased the list could
have lawfully disclosed the list to that third party. That is, the licensee may
disclose the list in accordance with the privacy policy of the financial or
other institution from which the licensee received the list, consistent with
the authorization of each consumer whose nonpublic personal financial
information the licensee intends to disclose, and the licensee may disclose the
list in accordance with an exception in 13.1.3.18 NMAC or 13.1.3.19 NMAC, such
as to the licensee's attorneys or accountants.
C.
Nonpublic personal
financialinformation a licensee discloses under an exception. If a
licensee discloses nonpublic personal financial information to a nonaffiliated
third party under an exception in 13.1.3.18 NMAC or 13.1.3.19 NMAC, the third
party may disclose and use that information only as follows:
(1) The third party may disclose the
information to the licensee's affiliates;
(2) The third party may disclose the
information to its affiliates, but its affiliates may, in turn, disclose and
use the information only to the extent that the third party may disclose and
use the information; and
(3) The
third party may disclose and use the information pursuant to an exception in
13.1.3.18 NMAC or 13.1.3.19 NMAC in the ordinary course of business to carry
out the activity covered by the exception under which it received the
information.
D.
Nonpublic personal financial information a licensee discloses pursuant to
consumer authorization outside of an exception. If a licensee discloses
nonpublic personal information to a nonaffiliated third party pursuant to
13.1.3.14 NMAC, the third party may disclose the information only:
(1) To the licensee's affiliates;
(2) To the third party's affiliates, but the
third party's affiliates, in turn, may disclose the information only to the
extent the third party can disclose the information; and
(3) To any other person, if the disclosure
would be lawful if the licensee made it directly to that person.
E.
Nonpublic personal
health information.
(1) If a licensee
receives nonpublic personal health information from an affiliate or a
nonaffiliated third party under an exception in 13.1.3.18 NMAC or 13.1.3.19
NMAC, the licensee may disclose and use the information pursuant to an
exception in 13.1.3.18 NMAC or 13.1.3.19 NMAC in the ordinary course of
business to carry out the activity covered by the exception under which the
licensee received the information.
(2) If a licensee receives nonpublic personal
health information other than under an exception in 13.1.3.18 NMAC or 13.1.3.19
NMAC, the licensee may disclose the information only to any other person, if
the disclosure would be lawful if made directly to that person by the
individual from whom the licensee received the information.
(3) If a licensee discloses nonpublic
personal heath information to an affiliate or to a nonaffiliated third party
under an exception in 13.1.3.18 NMAC or 13.1.3.19 NMAC, the affiliate or third
party may only disclose and use that information pursuant to an exception in
13.1.3.18 NMAC or 13.1.3.19 NMAC in the ordinary course of business to carry
out the activity covered by the exception under which it received the
information.
(4) If a licensee
discloses nonpublic personal health information to an affiliate or a
nonaffiliated third party pursuant to 13.1.3.14 NMAC, the affiliate or third
party may disclose the information only to any other person if the disclosure
would be lawful if the licensee made it directly to that person.
