13-37-201 - Required notice.
13-37-201. Required notice.
(1) (a) In accordance with this section, a commercial entity shall provide the noticedescribed in this section to a person if:
(i) the commercial entity enters into a consumer transaction with that person;
(ii) as a result of the consumer transaction described in this Subsection (1)(a), thecommercial entity obtains nonpublic personal information concerning that person; and
(iii) the commercial entity intends to or wants the ability to disclose the nonpublicpersonal information:
(A) to a third party; and
(B) for compensation; and
(iv) the compensation described in Subsection (1)(a)(iii)(B):
(A) is the primary consideration for the commercial entity disclosing the nonpublicpersonal information;
(B) is directly related to the commercial entity disclosing the nonpublic personalinformation; and
(C) is not compensation received by the commercial entity in consideration of atransaction described in Subsection (5).
(b) For purposes of this chapter, a commercial entity is considered to have obtainedinformation as a result of a consumer transaction if:
(i) the person provides the information to the commercial entity:
(A) at any time during the consumer transaction; and
(B) at the request of the commercial entity; or
(ii) (A) the commercial entity otherwise obtains the information; and
(B) but for the consumer transaction, the commercial entity would not obtain theinformation.
(2) The notice required by Subsection (1) shall be given before the earlier of:
(a) the point at which the person is requested to provide the nonpublic personalinformation; or
(b) the commercial entity otherwise obtains the nonpublic personal information as aresult of the consumer transaction described in Subsection (1)(a).
(3) The notice required by Subsection (1):
(a) shall read substantially as follows: "We may choose to disclose nonpublic personalinformation about you, the consumer, to a third party for compensation.";
(b) may be made:
(i) orally, if the consumer transaction itself is entirely conducted orally; or
(ii) in writing, if the notice is written in dark bold; and
(c) shall be sufficiently conspicuous so that a reasonable person would perceive thenotice before providing the nonpublic personal information.
(4) This chapter does not apply to:
(a) a commercial entity that is subject to a federal law or regulation that governs thedisclosure of nonpublic information to a third party; or
(b) a covered entity as defined in 45 C.F.R. Parts 160 and 164.
(5) Notwithstanding the other provisions of this section, a commercial entity is notrequired to provide notice under this section if:
(a) the disclosure of the nonpublic personal information is related to the third party
providing to the commercial entity:
(i) services, including business outsource services;
(ii) personal or real property; or
(iii) other thing of value; and
(b) compensation received by the commercial entity as part of the transaction is receivedby the commercial entity for or in consideration of the transaction described in Subsection (5)(a).
Enacted by Chapter 97, 2003 General Session