33-19-307. Personal information used for marketing purposes -- restrictions. (1) Except as permitted in this section, a licensee may not use or disclose personal information for a marketing purpose. For the purposes of this section, an insurance producer who describes to the producer's clients products or services available through the producer is not engaged in marketing.

(2) A licensee may use or disclose to another licensee personal information that is reasonably necessary to enable the licensee to market insurance products or services. A licensee may use or disclose to another licensee personal information, excluding medical record information, that is reasonably necessary to enable the licensee to market financial products and services. A licensee that receives personal information under this section from a disclosing licensee may not further disclose the information or use the information for any purpose other than marketing insurance and financial products and services.

(3) A licensee may disclose personal information that is reasonably necessary to enable an affiliate that is not a licensee to market insurance products and services. A licensee may disclose to an affiliate that is not a licensee personal information, excluding medical record information, that is reasonably necessary to enable the affiliate to market financial products and services. Disclosures under this subsection may be made only with a written agreement with the affiliate that the affiliate will not further disclose the information and will use it only for marketing insurance or financial products and services.

(4) A licensee may disclose personal information that is reasonably necessary to enable a person contractually engaged to provide services for or on behalf of the licensee to market insurance or financial products or services if the person agrees in writing that the person will not use or further disclose information obtained or developed pursuant to the engagement except to carry out the limited purpose of the engagement. A licensee shall adopt and maintain policies and procedures reasonably designed to ensure that third parties with whom the licensee contracts under this subsection comply with the requirements of this section.

(5) A licensee may use or disclose personal information for purposes other than those specified in subsections (2) through (4) only with an individual's written authorization as described in 33-19-306(2). In addition to meeting the requirements of 33-19-206, the authorization must:

(a) clearly and conspicuously state that the disclosed information is intended to be used for marketing purposes;

(b) specify each entity or type of entity to which the licensee intends to disclose the information;

(c) specify what information the licensee intends to disclose; and

(d) specify the type of marketing that the individual might receive pursuant to the disclosure.