Fin. Code, § 4054.6

(a) When a financial institution and an organization or business entity that is not a financial institution (“affinity partner”) have an agreement to issue a credit card in the name of the affinity partner (“affinity card”), the financial institution shall be permitted to disclose to the affinity partner in whose name the card is issued only the following information pertaining to the financial institution’s customers who are in receipt of the affinity card: (1) name, address, telephone number, and electronic mail address and (2) record of purchases made using the affinity card in a business establishment, including a Web site, bearing the brand name of the affinity partner.

(b) When a financial institution and an affinity partner have an agreement to issue a financial product or service, other than a credit card, on behalf of the affinity partner (“affinity financial product or service”), the financial institution shall be permitted to disclose to the affinity partner only the following information pertaining to the financial institution’s customers who obtained the affinity financial product or service: name, address, telephone number, and electronic mail address.

(c) The disclosures specified in subdivisions (a) and (b) shall be permitted only if the following requirements are met:

(1) The financial institution has provided the consumer a notice meeting the requirements of subdivision (d) of Section 4053, and the consumer has not directed that nonpublic personal information not be disclosed. A response to a notice meeting the requirements of subdivision (d) directing the financial institution to not disclose nonpublic personal information to a nonaffiliated financial institution shall be deemed a direction to the financial institution to not disclose nonpublic personal information to an affinity partner, unless the form containing the notice provides the consumer with a separate choice for disclosure to affinity partners.

(2) The financial institution has a contractual agreement with the affinity partner that requires the affinity partner to maintain the confidentiality of the nonpublic personal information and prohibits affinity partners from using the information for any purposes other than verifying membership, verifying the consumer’s contact information, or offering the affinity partner’s own products or services to the consumer.

(3) The customer list is not disclosed in any way that reveals or permits extrapolation of any additional nonpublic personal information about any customer on the list.

(4) If the affinity partner sends any message to any electronic mail addresses obtained pursuant to this section, the message shall include at least both of the following:

(A) The identity of the sender of the message.

(B) A cost-free means for the recipient to notify the sender not to electronically mail any further message to the recipient.

(d) Nothing in this section shall prohibit the disclosure of nonpublic personal information pursuant to Section 4056.

(e) This section does not apply to credit cards issued in the name of an entity primarily engaged in retail sales or a name proprietary to a company primarily engaged in retail sales.