Can I skip obtaining consent to disclose personal information for a business purpose in Oklahoma? What are the requirements?

To disclose nonpublic personal financial information for a business purpose in Oklahoma, you generally need to obtain consent from the consumer. However, there are exceptions to this requirement as outlined in OKAC 365:35-1-32. These exceptions include:

• Disclosure with the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction.
• Disclosure to protect the confidentiality or security of a licensee’s records pertaining to the consumer, service, product, or transaction; to protect against or prevent actual or potential fraud or unauthorized transactions; for required institutional risk control or for resolving consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer; or to persons acting in a fiduciary or representative capacity on behalf of the consumer.
• Disclosure to provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating a licensee, persons that are assessing the licensee’s compliance with industry standards, and the licensee’s attorneys, accountants, and auditors.
• Disclosure to comply with federal, state, or local laws, rules, and other applicable legal requirements; to comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by federal, state, or local authorities; or to respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance, or other purposes as authorized by law.

Additionally, OKAC 365:35-1-30 provides an exception to the opt-out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing. This exception applies when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee provides the initial notice in accordance with Section 365:35-1-10 and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, including use under an exception in Sections 365:35-1-31 or 32 in the ordinary course of business to carry out those purposes.

However, if you are unsure whether an exception applies to your situation, you should consult with a legal professional.

Jurisdiction

Oklahoma

• Privacy