Section 12.06. Confidentiality and security requirements.

  No savings bank may directly or indirectly acquire, place or operate a remote service unit, and no savings bank may participate in the acquisition, placement or operation of a remote service unit, unless precautions acceptable to the division are provided to:

(1)   Precautions against unauthorized access. Prevent unauthorized access to, or use of, the unit.

(2)   Precautions to assure confidentiality. Prevent information regarding a transaction conducted through the unit from being disclosed to any person other than:

(a) The customer making the transaction;

(b) Any other person who is a party to the transaction or is necessary to effect the transaction, but only to the extent that the information disclosed is necessary to effect the transaction; or

(c) Those persons lawfully authorized to have access to the records of the savings bank or of parties to the transaction.

(3)   Unsolicited access to remote service units prohibited. Ensure that the plastic card or other means providing its customers access to the unit is issued only:

(a) In response to a request or application; or

(b) As a renewal of, or in substitution for, an accepted card or other means of access, whether issued by the initial issuer or a successor.

Cr. Register, February, 1994, No. 458 , eff. 3-1-94.