13-37-201. Required notice.
(1) In accordance with this section, a commercial entity shall provide the notice described in this section to a person if: the commercial entity enters into a consumer transaction with that person; as a result of the consumer transaction described in this Subsection, the commercial entity obtains nonpublic personal information concerning that person; and (1)(a) the commercial entity intends to or wants the ability to disclose the nonpublic personal information: to a third party; and for compensation; and the compensation described in Subsection: (1)(a)(iii)(B) is the primary consideration for the commercial entity disclosing the nonpublic personal information; is directly related to the commercial entity disclosing the nonpublic personal information; and is not compensation received by the commercial entity in consideration of a transaction described in Subsection. (5) For purposes of this chapter, a commercial entity is considered to have obtained information as a result of a consumer transaction if: the person provides the information to the commercial entity: at any time during the consumer transaction; and at the request of the commercial entity; or the commercial entity otherwise obtains the information; and but for the consumer transaction, the commercial entity would not obtain the information.
(2) The notice required by Subsectionshall be given before the earlier of: (1) the point at which the person is requested to provide the nonpublic personal information; or the commercial entity otherwise obtains the nonpublic personal information as a result of the consumer transaction described in Subsection. (1)(a)
(3) The notice required by Subsection: (1) shall read substantially as follows: "We may choose to disclose nonpublic personal information about you, the consumer, to a third party for compensation."; may be made: orally, if the consumer transaction itself is entirely conducted orally; or in writing, if the notice is written in dark bold; and shall be sufficiently conspicuous so that a reasonable person would perceive the notice before providing the nonpublic personal information.
(4) This chapter does not apply to: a commercial entity that is subject to a federal law or regulation that governs the disclosure of nonpublic information to a third party; or a covered entity as defined in 45 C.F.R. Parts 160 and 164.
(5) Notwithstanding the other provisions of this section, a commercial entity is not required to provide notice under this section if: the disclosure of the nonpublic personal information is related to the third party providing to the commercial entity: services, including business outsource services; personal or real property; or other thing of value; and compensation received by the commercial entity as part of the transaction is received by the commercial entity for or in consideration of the transaction described in Subsection. (5)(a)