A CCA or its Aggregation Supplier may not disclose customer information provided to the CCA or its Aggregation Suppliers by the electric company or collected from the customer as part of the CCA, including a customer’s billing, payment, enrollment, and credit information, to an entity other than the electric company without the customer’s written or electronic consent, except that a CCA may disclose a customer’s billing, payment, enrollment, and credit information but only if necessary to facilitate billing, bill collection, enrollment, or credit reporting. A CCA shall provide, upon request of the customer, a copy of the CCA’s customer information privacy policy via the CCA website or by mail. The Aggregation Supplier shall protect all customer information when it ceases to be the CCA’s Aggregation Supplier or the CCA is terminated, and the Aggregation Supplier may not use for marketing purposes any information obtained as the Aggregation Supplier once it ceases to be the Aggregation Supplier.