Cal. Fin. Code § 4053.5

Except as otherwise provided in this division, an entity that receives nonpublic personal information from a financial institution under this division shall not disclose this information to any other entity, unless the disclosure would be lawful if made directly to the other entity by the financial institution. An entity that receives nonpublic personal information pursuant to any exception set forth in Section 4056 shall not use or disclose the information except in the ordinary course of business to carry out the activity covered by the exception under which the information was received.