Section 4. (a) An insurance institution or insurance representative shall provide a notice of information practices to all applicants or policyholders in connection with insurance transactions as follows:

(1) in the case of an application for insurance, a notice shall be provided no later than at the time the application for insurance is made;

(2) in the case of a policy renewal, a notice shall be provided no later than the policy renewal date, except that no notice shall be required in connection with a policy renewal if:

(i) personal information is collected only from the policyholder or from public records; or

(ii) a notice meeting the requirements of this section has been given within the previous twenty-four months;

(3) in the case of a policy reinstatement or change in insurance benefits, a notice shall be provided no later than the time a request for a policy reinstatement or change in insurance benefits is received by the insurance institution, except that no notice shall be required if personal information is collected only from the policyholder or from public records.

(b) A notice required by subsection (a) shall be in writing and shall state:

(1) whether personal information may be collected from persons other than the individual proposed for coverage;

(2) the type of personal information that may be collected and the type of source and investigative technique that may be used to collect such information;

(3) the type of disclosure permitted by this chapter and the circumstances under which such disclosure may be made without prior authorization; provided, however, that only such circumstances need be described which occur with such frequency as to indicate a general business practice;

(4) a description of the rights established under sections eight, nine and ten and the manner in which such rights may be exercised; and

(5) that information obtained from a report prepared by an insurance-support organization may be retained by the insurance-support organization and disclosed to other persons.

(c) In lieu of the notice prescribed in subsection (b), the insurance institution or insurance representative may provide an abbreviated notice informing the applicant or policyholder that:

(1) personal information may be collected from a person other than the individual proposed for coverage;

(2) such information as well as other personal or privileged information subsequently collected by the insurance institution or insurance representative may in certain circumstances be disclosed to a third party without authorization;

(3) a right of access and correction exists with respect to all personal information collected; and

(4) the notice prescribed in subsection (b) shall be furnished to the applicant or policyholder upon request.

(d) The obligations imposed by this section upon an insurance institution or insurance representative may be satisfied by another insurance institution or insurance representative authorized to act on its behalf.

(e) Information collection and disclosure authorized pursuant to this chapter is limited to the practices described in the notice issued or available pursuant to this section.