58-39-27. Privacy notice and disclosure requirement exceptions.

(a) Under G.S. 58-39-25 and G.S. 58-39-26, an insurance institution or agent may provide a joint notice from the insurance institution or agent and one or more of its affiliates or other financial institutions, as defined in the notice, as long as the notice is accurate with respect to the insurance institution or agent and the other institutions.

(b) An insurance institution or agent may satisfy the notice requirements of G.S. 58-39-25 and G.S. 58-39-26 by providing a single notice if two or more applicants or policyholders jointly obtain or apply for an insurance product.

(c) An insurance institution or agent may satisfy the notice requirements of G.S. 58-39-25 and G.S. 58-39-26 through the use of separate or combined notices.

(d) An insurance institution or agent is not required to provide the notices required by G.S. 58-39-25 and G.S. 58-39-26 to:

(1) Any applicant or policyholder whose last known address, according to the insurance institution's or agent's records is deemed invalid. The applicant's or policyholder's last known address shall be deemed invalid if mail sent to that address has been returned by the postal authorities as undeliverable and if subsequent reasonable attempts to obtain a current valid address for the applicant or policyholder have been unsuccessful; or

(2) Any policyholder whose policy is lapsed, expired, or otherwise inactive or dormant under the insurance institution's business practices, and the insurance institution has not communicated with the policyholder about the relationship for a period of 12 consecutive months, other than annual privacy notices, material required by law or regulation, or promotional materials.

(e) If an agent does not share information with any person other than the agent's principal or an affiliate of the principal, and if the principal provides all notices required by G.S. 58-39-25 and G.S. 58-39-26, the agent is not required to provide the notices required by G.S. 58-39-25 and G.S. 58-39-26. G.S. 58-39-75 applies to the sharing of information with an affiliate under this subsection.

(f) When an agent discloses a policyholder's personal information, other than medical information, to an insurance institution solely for the purposes of renewal, transfer, replacement, reinstatement, or modification of an existing policy, the agent is not required to provide the notices required by G.S. 58-39-25 and G.S. 58-39-26.

(g) For the purposes of G.S. 58-39-26 only, the terms "applicant" or "policyholder" include respectively a person who applies for, or a certificate holder who obtains, insurance coverage under a group or blanket insurance contract, employee benefit plan, or group annuity contract, regardless of whether the coverage is individually underwritten. An insurance institution or agent that does not disclose personal information about an applicant or policyholder under a group or blanket insurance contract, employee benefit plan, or group annuity contract, except as permitted under G.S. 58-39-75(1) through (10) and G.S. 58-39-75(12) through (21), may satisfy any notice requirement that otherwise exists under G.S. 58-39-26 with respect to that applicant or policyholder by providing a notice of information practices to the holder of the group or blanket insurance or annuity contract or the employee benefit plan sponsor. If an insurance institution or agent discloses personal information about an applicant or policyholder as permitted by G.S. 58-39-75(11), it shall provide the notice required by G.S. 58-39-26 to the applicant or policyholder not less than 30 days before the information is disclosed, and it may satisfy any other notice requirement that otherwise exists under this section with respect to that applicant or policyholder by providing a notice of information practices to the holder of the group or blanket insurance or annuity contract or employee benefit plan sponsor.