3.127- What is the Requirement for written privacy policy disclosures ?