(a) Except as otherwise authorized in this subchapter, a covered entity shall not, directly or through an affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party other than as described in the initial notice that the covered entity provided to that consumer under §22.8 of this title (relating to Initial Privacy Notice), unless:
  (1) the covered entity has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;
  (2) the covered entity has provided to the consumer a new opt out notice;
  (3) the covered entity has given the consumer a reasonable opportunity, before the covered entity discloses the information to the nonaffiliated third party, to opt out of the disclosure; and
  (4) the consumer does not opt out.
(b) Except as otherwise permitted by §22.17 of this title (relating to Exception to Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information for Service Providers and Joint Marketing), §22.18 of this title (relating to Exceptions to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information for Processing and Servicing Transactions) and §22.19 of this title (relating to Other Exceptions to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information), a covered entity shall provide a revised notice before it:
  (1) discloses a new category of nonpublic personal financial information to any nonaffiliated third party;
  (2) discloses nonpublic personal financial information to a new category of nonaffiliated third party; or
  (3) discloses nonpublic personal financial information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt out right regarding that disclosure.
(c) A revised notice is not required if the covered entity discloses nonpublic personal financial information to a new nonaffiliated third party that the covered entity adequately described in its prior notice.
(d) When a covered entity is required to deliver a revised privacy notice by this section, the covered entity shall deliver it according to §22.13 of this title (relating to Delivery).

Source Note: The provisions of this §22.12 adopted to be effective December 17, 2001, 26 TexReg 10316