Can I share personal information about my customers with third parties in Alabama? What are the requirements?

Based on the documents provided, you can share personal information about your customers with third parties in Alabama under certain conditions and exceptions.

Requirements for sharing personal information with third parties

According to ALAC Section 482-1-122-.11, a licensee may not disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless all of the following occur:

1. The licensee has provided to the consumer an initial notice as required under Section 5.
2. The licensee has provided to the consumer an opt-out notice as required in Section 8.
3. The licensee has given the consumer a reasonable opportunity, before it discloses the information to the nonaffiliated third party, to opt-out of the disclosure.
4. The consumer does not opt-out.

Opt-out means a direction by the consumer that the licensee not disclose nonpublic personal financial information about that consumer to a nonaffiliated third party, other than as permitted by Sections 14, 15, and 16.

A licensee shall comply with this section, regardless of whether the licensee and the consumer have established a customer relationship.

Exceptions to sharing personal information with third parties

There are exceptions to the opt-out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing, as stated in ALAC Section 482-1-122-14. The opt-out requirements in Sections 8 and 11 do not apply when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee provides the initial notice in accordance with Section 5 and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, including use under an exception in Sections 15 or 16 in the ordinary course of business to carry out those purposes.

There are also exceptions to the notice and opt-out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions, as stated in ALAC Section 482-1-122-15. The requirements for initial notice in Section 5A(2), the opt-out in Sections 8 and 11, and service providers and joint marketing in Section 14 do not apply if the licensee discloses nonpublic personal financial information as necessary to effect, administer or enforce a transaction that a consumer requests or authorizes.

Limits on redisclosure and reuse of nonpublic personal financial information

ALAC Section 482-1-122-.12 provides limits on redisclosure and reuse of nonpublic personal financial information. If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution under an exception in Sections 15 or 16 of this regulation, the licensee’s disclosure and use of that information is limited. If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution other than under an exception in Sections 15 or 16 of this regulation, the licensee may disclose the information only to certain parties.

Annual Privacy Notice To Customers Required

ALAC Section 482-1-122-.06 requires a licensee to provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. The licensee may define the twelve-consecutive-month period, but the licensee shall apply it to the customer on a consistent basis. A licensee is not required to provide an annual notice to a current customer so long as both of the following are true: (1) The licensee provides personal information to nonaffiliated third parties only in accordance with Rules 482-1-122-.15, 482-1-122-.16 and 482-1-122-.17. (2) The licensee has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers in accordance with Rule 482-1-122-.05 or Rule 281-1-122-.06.

Limits On Sharing Account Number Information For Marketing Purposes

ALAC Section 482-1-122-.13 prohibits a licensee from disclosing, other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer’s policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer.

In summary, you can share personal information about your customers with third parties in Alabama under certain conditions and exceptions. You must provide initial notice, opt-out notice, and a reasonable opportunity to opt-out before disclosing the information to a nonaffiliated third party. There are exceptions for service providers and joint marketing, as well as for processing and servicing transactions. Additionally, there are limits on redisclosure and reuse of nonpublic personal financial information. A licensee is required to provide an annual privacy notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. The licensee may define the twelve-consecutive-month period, but the licensee shall apply it to the customer on a consistent basis. A licensee is prohibited from disclosing, other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer’s policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer.

Jurisdiction

Alabama

• Privacy