Section 4054.6 Of Division 1.4. California Financial Information Privacy Act From California Financial Code >> Division 1.4.
4054.6
. (a) When a financial institution and an organization or
business entity that is not a financial institution ("affinity
partner") have an agreement to issue a credit card in the name of the
affinity partner ("affinity card"), the financial institution shall
be permitted to disclose to the affinity partner in whose name the
card is issued only the following information pertaining to the
financial institution's customers who are in receipt of the affinity
card: (1) name, address, telephone number, and electronic mail
address and (2) record of purchases made using the affinity card in a
business establishment, including a Web site, bearing the brand name
of the affinity partner.
(b) When a financial institution and an affinity partner have an
agreement to issue a financial product or service, other than a
credit card, on behalf of the affinity partner ("affinity financial
product or service"), the financial institution shall be permitted to
disclose to the affinity partner only the following information
pertaining to the financial institution's customers who obtained the
affinity financial product or service: name, address, telephone
number, and electronic mail address.
(c) The disclosures specified in subdivisions (a) and (b) shall be
permitted only if the following requirements are met:
(1) The financial institution has provided the consumer a notice
meeting the requirements of subdivision (d) of Section 4053, and the
consumer has not directed that nonpublic personal information not be
disclosed. A response to a notice meeting the requirements of
subdivision (d) directing the financial institution to not disclose
nonpublic personal information to a nonaffiliated financial
institution shall be deemed a direction to the financial institution
to not disclose nonpublic personal information to an affinity
partner, unless the form containing the notice provides the consumer
with a separate choice for disclosure to affinity partners.
(2) The financial institution has a contractual agreement with the
affinity partner that requires the affinity partner to maintain the
confidentiality of the nonpublic personal information and prohibits
affinity partners from using the information for any purposes other
than verifying membership, verifying the consumer's contact
information, or offering the affinity partner's own products or
services to the consumer.
(3) The customer list is not disclosed in any way that reveals or
permits extrapolation of any additional nonpublic personal
information about any customer on the list.
(4) If the affinity partner sends any message to any electronic
mail addresses obtained pursuant to this section, the message shall
include at least both of the following:
(A) The identity of the sender of the message.
(B) A cost-free means for the recipient to notify the sender not
to electronically mail any further message to the recipient.
(d) Nothing in this section shall prohibit the disclosure of
nonpublic personal information pursuant to Section 4056.
(e) This section does not apply to credit cards issued in the name
of an entity primarily engaged in retail sales or a name proprietary
to a company primarily engaged in retail sales.