Oregon Revised Statutes Chapter 746 § 746.620 — Notice

Notice of insurance information practices; exceptions; rules. (1) A licensee must provide a clear and conspicuous notice of personal information practices to individuals in connection with insurance transactions under the following circumstances and at the following times: (a) Except as provided in this paragraph, to a consumer who becomes a customer of the licensee, not later than the date that the licensee establishes a continuing relationship under which the licensee provides one or more insurance products or services to the consumer that are to be used primarily for personal, family or household purposes. A licensee may provide the notice within a reasonable time after the date the licensee establishes a customer relationship if: (A) Establishing the customer relationship is not at the customer’s election; or (B) Providing notice not later than the date that the licensee establishes a customer relationship would substantially delay the customer’s transaction and the customer agrees to receive the notice at a later time. (b) To a consumer other than as described in paragraph (a) of this subsection, before the licensee discloses any personal information about the consumer pursuant to the requirements of ORS 746.665, unless the disclosure meets one or more of the conditions specified in ORS 746.665. (2)(a) Except as provided in paragraph (b) of this subsection, a licensee shall provide a clear and conspicuous notice to a customer that accurately reflects the licensee’s privacy policies and practices not less than annually during the continuation of the relationship described in subsection (1)(a) of this section. For the purpose of this subsection, a notice is given annually if the notice is given at least once in any period of 12 consecutive months during which the relationship exists. A licensee may define the period of 12 consecutive months, but the licensee must apply the period to the customer on a consistent basis. (b) A licensee need not provide the notice described in paragraph (a) of this subsection each year if the licensee provides personal information to an unaffiliated third party only in accordance with ORS 746.665 and does not change the policies and practices related to disclosing personal information about which the licensee last notified customers in accordance with this section. If the licensee changes the licensee’s privacy policies and practices, the licensee shall notify customers in accordance with this section. (3) The privacy notice required by subsections (1) and (2) of this section must be in writing and must be clear and conspicuous. The notice may be provided in electronic form if the recipient agrees. In addition to any other personal information the licensee wishes to provide, the notice must include the following items of personal information that apply to the licensee and to the individuals to whom the licensee sends the notice: (a) The categories of personal information that the licensee collects. (b) The categories of personal information that the licensee discloses. (c) The categories of affiliates and nonaffiliated third parties to whom the licensee discloses personal information other than persons to whom the licensee discloses information under ORS 746.665. (d) The categories of personal information about former customers of the licensee that the licensee discloses and the categories of affiliates and nonaffiliated third parties to whom the licensee discloses personal information about the licensee’s former customers, other than persons to whom the licensee discloses personal information under ORS 746.665. (e) If a licensee discloses personal information to a nonaffiliated third party under ORS 746.665, a separate description of the categories of personal information the licensee discloses and the categories of nonaffiliated third parties with whom the licensee has contracted. (f) An explanation of the individual’s right under ORS 746.630 to authorize disclosure of personal information, including the methods by which the individual may exercise that right. (g) Any disclosure that the licensee makes under section 603(d)(2)(A)(iii) of the federal Fair Credit Reporting Act (15 U.S.C. 1681a(d)(2)(A)(iii)) regarding the ability to opt out of disclosures of personal information among affiliates. (h) The policies and practices of the licensee with respect to protecting the confidentiality and security of personal information. (i) Any disclosure that the licensee makes under subsection (4) of this section. (j) A description of the rights established under ORS 746.640 and 746.645 and the manner in which such rights may be exercised. (4) If a licensee discloses personal information as authorized under ORS 746.665, the licensee is not required to list those exceptions in the privacy notices required by this section. When describing the categories of parties to whom disclosure is made, the licensee shall state onl