Current through Reg. 50, No. 13; March 28, 2025
(a) How to provide notices. A covered entity
shall provide any notices that this subchapter requires so that each consumer
can reasonably be expected to receive actual notice in writing or, if the
consumer agrees, electronically.
(b) Examples of reasonable expectation of
actual notice. A covered entity satisfies the reasonable expectation that a
consumer will receive actual notice if the covered entity:
(1) hand-delivers a printed copy of the
notice to the consumer;
(2) mails a
printed copy of the notice to the last known address of the consumer
separately, or in a policy, billing or other written communication;
(3) for a consumer who conducts transactions
electronically, posts the notice on the electronic site and requires the
consumer to acknowledge receipt of the notice as a necessary step to obtaining
a particular insurance product or service; or
(4) for an isolated transaction with a
consumer, such as the covered entity providing an insurance quote or selling
the consumer single-event types of coverage including, but not limited to, auto
rental liability, travel, and short-term non-resident auto liability insurance,
presents the notice and requires the consumer to acknowledge receipt of the
notice as a necessary step to obtaining the particular insurance product or
service.
(c) Examples of
unreasonable expectation of actual notice. A covered entity has not met the
reasonable expectation that a consumer will receive actual notice of its
privacy policies and practices if it:
(1)
only posts a sign in its office or generally publishes advertisements of its
privacy policies and practices; or
(2) sends the notice via electronic mail to a
consumer who does not obtain an insurance product or service from the covered
entity electronically.
(d) Annual notices only. A covered entity
satisfies the reasonable expectation that a customer will receive actual notice
of the covered entity's annual privacy notice if:
(1) the customer uses the covered entity's
Web site to access insurance products and services electronically and agrees to
receive notices at the Web site and the covered entity posts its current
privacy notice continuously in a clear and conspicuous manner on the Web site;
or
(2) the customer has requested
that the covered entity refrain from sending any information regarding the
customer relationship, and the covered entity's current privacy notice remains
available to the customer upon request.
(e) Oral description of notice insufficient.
A covered entity may not provide any notice required by this subchapter solely
by orally explaining the notice, either in person or over the
telephone.
(f) Retention or
accessibility of notices for customers.
(1)
For customers only, a covered entity shall provide the initial notice required
by §
22.8(a)(1) of
this title (relating to Initial Privacy Notice), the annual notice required by
§
22.9(a) of this
title (relating to Annual Privacy Notice), and the revised notice required by
§
22.12 of this title (relating to
Revised Privacy Notices) so that the customer can retain them or obtain them
later in writing or, if the customer agrees, electronically.
(2) A covered entity provides a privacy
notice to the customer so that the customer can retain it or obtain it later if
the covered entity:
(A) hand-delivers a
printed copy of the notice to the customer;
(B) mails a printed copy of the notice to the
last known address of the customer; or
(C) makes its current privacy notice
available on a Web site (or a link to another Web site) for the customer who
obtains an insurance product or service electronically and agrees to receive
the notice at the Web site.
(g) Joint notice with other financial
institutions. A covered entity may provide a joint notice from the covered
entity and one or more of its affiliates or other financial institutions, as
identified in the notice, so long as the notice is accurate with respect to the
covered entity and the other institutions. A covered entity also may provide a
notice on behalf of another financial institution.
(h) Joint relationships. If two or more
consumers jointly obtain an insurance product or service from a covered entity,
the covered entity may satisfy the initial, annual and revised notice
requirements of §§22.8(a), 22.9(a), and 22.12(a) of this title,
respectively, by providing one notice to those consumers jointly.
