Compliance with Alaska's Regulations Regarding Privacy of Consumer Financial and Health Information

DIVISION OF INSURANCE Frank H. Murkowski, Governor 550 W. 7th Avenue, Suite 1560, Anchorage, Alaska 99501-3567 Telephone: (907) 269-7900 Fax: (907) 269-7910 Text Telephone: (907) 465-5437 Email: insurance@commerce.state.ak.us Website: http://www.commerce.state.ak.us/insurance/ BULLETIN B 04-15 TO: ALL ENTITIES LICENSED, AUTHORIZED, REQUIRED TO BE AUTHORIZED, REGISTERED, OR REQUIRED TO BE REGISTERED UNDER THE ALASKA INSURANCE CODE (AS 21) AND OTHER INTERESTED PARTIES RE: COMPLIANCE WITH ALASKA’S REGULATIONS REGARDING PRIVACY OF CONSUMER FINANCIAL AND HEALTH INFORMATION Alaska’s regulations regarding privacy of consumer financial and health information were adopted by the director on August 5, 2004, filed by the Lieutenant Governor on September 3, and become effective January 1, 2005. All affected parties must comply with them (3 AAC 26.205 – 3 AAC 26.749) as of January 1, 2005. The regulations may be viewed on the division’s web site at: http://www.commerce.state.ak.us/insurance/newregulations.htm. Provided in this bulletin are examples of how affected parties can comply with various provisions of these regulations. Clear and conspicuous notice 3 AAC 26.610 requires a licensee to provide “clear and conspicuous notice that accurately reflects the licensee’s policies and practices.” “Clear and conspicuous” is defined in 3 AAC 26.749(3) as “reasonably understandable and designed to call attention to the nature and significance of the information.” An example of a reasonably understandable notice is a notice in which (1) information is presented using clear and concise sentences, paragraphs, and sections; (2) short explanatory sentences or bullet lists are used whenever possible; (3) definite, concrete, everyday words, and active voice are used when possible; (4) multiple negatives are avoided; (5) legal and highly technical business terminology is avoided when possible; and (6) imprecise and ambiguous explanations are avoided. An example of a notice that is designed to call attention to the nature and significance of the information is a notice that (1) contains a heading written in plain language and is conspicuous; (2) is written using a typeface and a type size that are easy to read; 2 (3) contains wide margins and line spacing; (4) is written using boldface or italics for key words; (5) if distributed with other information, is written using a type size, style, and graphics, such as shading or sidebars, that are distinct from the type size, style, and graphics of the other information; and (6) if provided on a web page, is written using text or visual cues to encourage scrolling down the page when necessary to view the entire notice and is designed to ensure that other elements on the web page such as text, graphics, hyperlinks, or sound do not distract attention from the notice; and the licensee (A)places the notice on a screen that consumers frequently access, such as a page on which transactions are conducted; or (B) places a link on a screen that consumers frequently access, such as a page on which transactions are conducted, that connects directly to the notice and is labeled appropriately to convey the importance, nature, and relevance of the notice. Continuing relationship 3 AAC 26.749(10) defines “customer relationship” as a “continuing relationship between a consumer and a licensee under which the licensee provides one or more insurance products or services to the consumer.” Examples of a continuing relationship between a consumer and a licensee include (1) a consumer who is a current policyholder of an insurance product issued by or through a licensee; and (2) a consumer who obtains financial, investment, or economic advisory services relating to an insurance product or service from the licensee for a fee. Examples of situations in which “a continuing relationship between a consumer and a licensee” does not exist include occurrences when (1) a consumer applies for insurance but does not purchase the insurance; (2) a licensee sells the consumer airline travel insurance in an isolated transaction; (3) an individual is no longer a current policyholder of an insurance product or no longer obtains insurance services with or through the licensee; (4) a consumer is a beneficiary or claimant under a policy and has submitted a claim under a policy choosing a settlement option involving an ongoing relationship with the licensee; (5) a consumer is a beneficiary or claimant under a policy, submits a claim under that policy, and chooses a lump sum settlement option; (6) a consumer’s policy lapses, expires, or otherwise becomes inactive under a licensee’s business practices and the licensee has not communicated with the customer about the relationship for a period of 12 consecutive months, other than to provide an annual privacy notice, material required by law, communication at the directive of a state or federal authority, or promotional materials; (7) an individual is an insured or an annuitant under an insurance policy or annuity but is not the policyholder or owner of the insurance policy or annuity; (8) a consumer whose last known address in a licensee’s records is invalid so that mail sent to the address by the licensee is returned by the postal authorities as undeliverable, and the licensee’s subsequent attempts to obtain a current valid address for that consumer are unsuccessful; or 3 (9) the latest of the following occurs when a licensee provides real estate settlement services: (A)an individual completes the execution of all documents related to a real estate closing; (B) the licensee receives payment for the real estate settlement services; (C) the licensee completes all the licensee’s responsibilities with respect to the real estate settlement including filing documents in the public records; (D)the licensee delivers the title insurance policy to the person providing real estate settlement services or directly to the policyholder. 3 AAC 26.615(b) states that a licensee is not required to provide an annual notice to an individual who is no longer a customer. Examples of when an individual is no longer a customer include occurrences when (1) an individual is no longer a current policyholder or no longer obtains insurance services with or through a licensee; (2) an individual’s policy is lapsed, expired, or otherwise inactive or dormant under the licensee’s business practices, and the licensee has not communicated with the customer about the relationship for a period of 12 consecutive months, other than to provide an annual privacy notice, material required by law or regulation, or promotional materials; (3) a licensee has sent mail to an individual that was returned by postal authorities as undeliverable, if the licensee sent the mail to the individual’s last known address according to the licensee’s records and subsequent attempts by the licensee to obtain a current valid address were unsuccessful; or (4) in regard to a real estate settlement, the latest of the following occurs: (A)an individual completes execution of all documents related to the real estate closing; (B) payment for the real estate services been received; (C) the licensee has completed all of its responsibilities with respect to the settlement, including filing documents on the public record; (D)the licensee has delivered the title insurance policy to the person providing real estate settlement services or directly to the policyholder. Definition of nonpublic personal financial information 3 AAC 26.749(19) states in part that “nonpublic personal financial information . . . does not include . . . a list, description, or other grouping of consumers and publicly available information pertaining to the consumers that is derived without using personally identifiable financial information that is not publicly available . . . .” ƒ Nonpublic personal financial information does not include, for example, a list of individual names and addresses that contains only publicly available information that is not derived using personally identifiable information, that is not publicly available, and that does not indicate that an individual on the list, description, or other grouping is a consumer of a financial institution. ƒ Nonpublic personal financial information does include, for example, a list of individual names and addresses that is derived in whole or in part using personally identifiable financial information that is not publicly available, such as account numbers. 4 Definition of personally identifiable financial information 3 AAC 26.749(22) defines “personally identifiable financial information.” Examples of personally identifiable financial information include (1) information a consumer provides to a licensee on an application to obtain an insurance product or service; (2) account balance information and payment history; (3) the fact that an individual is or has been a customer of a licensee or has obtained an insurance product or service from the licensee; (4) information about a licensee’s consumer if the information is disclosed in a manner that indicates that the individual is or has been the licensee’s consumer; (5) information that a consumer provides to a licensee or that the licensee or the licensee’s agent obtains in connection with collecting a loan or servicing a loan; (6) information a licensee collects from an information collecting device through an Internet web server; and (7) information from a consumer report. Examples of information that is not considered personally identifiable financial information include (1) health information; (2) a list of names and addresses of customers of an entity that is not a financial institution; and (3) information that does not in any way identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses. Definition of publicly available information 3 AAC 26.749(23) defines “publicly available information” as “information that a licensee has a reasonable basis to believe is lawfully made available to the general public . . . .” Examples of information for which a licensee has a reasonable basis to believe is lawfully made available to the general public include (1) information that a licensee has determined is of a type that is available to the general public, but that, if the subject individual is allowed to direct that such information is not to be made available to the general public, the individual has not given that direction; (2) the type of mortgage information included in the public record in the jurisdiction where the mortgage is recorded; and (3) an individual’s telephone number, if the number is listed in a telephone directory or if the individual has informed the licensee that the telephone number is not unlisted. Definition of customer relationship 3 AAC 26.749(10) defines “customer relationship” as “a continuing relationship between a consumer and a licensee . . . .” Examples of when a licensee establishes a customer relationship include occurrences when (1) an insurer delivers an insurance policy or contract to the consumer; or (2) a consumer obtains insurance through an insurance producer. 5 Substantial delay Under 3 AAC 26.610, a licensee may provide the required initial notice within a reasonable time after the licensee establishes a customer relationship, if providing the notice not later than when the licensee establishes the customer relationship would substantially delay the customer’s transaction. ƒ An example of substantial delay is when the licensee and consumer agree over the telephone to enter into a customer relationship involving prompt delivery of the insurance product or service. ƒ An example of when substantial delay has not occurred is when a customer relationship is initiated in person at the licensee’s office or through other means by which the customer may view the notice, such as on a web site. Information included in privacy notices 3 AAC 26.620(a)(1) requires a privacy notice to include “the categories of nonpublic personal financial information that the licensee collects.” An example of how a licensee may satisfy this requirement is for the licensee to categorize the information the licensee collects according to the following sources of the information: (1) information from the consumer; (2) information about the consumer’s transactions with the licensee or its affiliates; (3) information about the consumer’s transactions with nonaffiliated third parties; (4) information from a consumer reporting agency. 3 AAC 26.620(a)(2) requires privacy notices to include “the categories of nonpublic personal financial information that the licensee discloses.” Examples of how a licensee may satisfy this requirement are (1) if the licensee reserves the right to disclose all the nonpublic personal financial information about consumers that the licensee collects, by the licensee stating that fact without describing the categories or examples of nonpublic personal information that the licensee discloses; or (2) if the licensee reserves the right to disclose only certain nonpublic personal financial information about consumers, by the licensee categorizing the information the licensee discloses according to the source of the information as described above and providing examples to illustrate the types of information in each category, for example (A)information from the consumer, including application information such as assets and income, and identifying information such as name, address, and social security number; (B) information about the consumer’s transactions, such as information about balances, payment history and parties to the transaction; and (C) information from consumer reports, such as a consumer’s creditworthiness and credit history. An example of how a licensee does not satisfy this requirement is when the licensee uses only general terms, such as transaction information. 6 3 AAC 26.620(a)(3) requires privacy notices to include the categories of affiliates and nonaffiliated third parties to which the licensee discloses a consumer’s nonpublic personal financial information. Examples of how a licensee may satisfy this requirement are by the licensee (1) identifying the types of businesses in which the licensee engages, with types of businesses being described in general terms if the licensee uses illustrative examples of significant lines of business; for example, if a licensee uses the phrase “financial products and services” to identify the type of business in which it operates, the licensee complies with this requirement if the licensee includes examples of significant lines of business such as life insurance, automobile insurance, consumer banking, or securities brokering; or (2) categorizing affiliates and nonaffiliated third parties using more detailed categories. 3 AAC 26.620(a)(6) requires privacy notices to include a separate description of the categories of information the licensee discloses and the categories of third parties with whom the licensee has contracted, if the licensee discloses nonpublic personal financial information to a nonaffiliated third party under 3 AAC 26.660 relating to service providers and joint marketing. A licensee may satisfy this requirement by (1) listing the categories of nonpublic personal financial information the licensee discloses, using the same categories and examples the licensee used to meet the requirements under 3 AAC 26.620(a)(2); and (2) stating whether the third party is a service provider that performs marketing service on the licensee’s behalf or on behalf of the licensee and another financial institution, or whether the third party is a financial institution with which the licensee has a joint marketing agreement. 3 AAC 26.620(a)(9) requires privacy notices to include a description of the licensee’s policies and practices regarding the protection of the confidentiality and security of nonpublic personal financial information. A licensee may satisfy this requirement by (1) describing in general terms who is authorized to have access to the information; and (2) stating whether the licensee has security practices and procedures in place to ensure the confidentiality of the information in accordance with the licensee’s policy, but the licensee is not required to describe technical information about the safeguards the licensee uses. Form of opt out notice and opt out method 3 AAC 26.625(a) requires licensees to provide consumers with a clear and conspicuous opt out notice that accurately explains the consumer’s right to opt out. An example of how a licensee provides adequate notice that the consumer can opt out of disclosure of nonpublic personal financial information to a nonaffiliated third party is by the licensee (1) identifying all the categories of nonpublic personal financial information that the licensee discloses or reserves the right to disclose, identifying all of the categories of nonaffiliated third parties to which the licensee discloses the information as described above under the section regarding information included in privacy notices, and stating that the consumer may opt out of the disclosure of that information; and (2) indicating the insurance products or services that the consumer obtains from the licensee to which the opt out direction would apply. 7 3 AAC 26.625(b)(3) requires an opt out notice to provide a means for a consumer to opt out. Examples of how a licensee can comply with this requirement are by (1) providing check-off boxes in a prominent position on the opt out notice or on a separate form provided with the opt out notice; (2) providing a separate reply form with the opt out notice that does not contain check-off boxes; (3) if a consumer agrees to electronic delivery of information, providing an electronic opt out form that the consumer can send by electronic mail or can process through the licensee’s web site; or (4) providing a toll-free telephone number that a consumer may call to opt out. A licensee does not comply with this requirement if, for example, the only means for the consumer to opt out of disclosure is to (1) write his or her own letter; or (2) to use a check-off box that the licensee provided with the initial notice but did not include with a subsequent notice. Revised notices 3 AAC 26.630 requires a licensee to provide a revised notice, a new opt out notice, and a reasonable opportunity to opt out in order for a licensee to disclose nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice. A licensee must comply with the revised notice requirements if, for example, the licensee wishes to disclose (1) a new category of nonpublic personal financial information to a nonaffiliated third party; (2) nonpublic personal financial information to a new category of nonaffiliated third party; or (3) nonpublic personal financial information about a consumer who is no longer a customer to a nonaffiliated third party, if that consumer has not had an opportunity to opt out. Delivery of notices 3 AAC 26.640(a) requires a licensee to provide a notice to a consumer in a manner that is reasonably expected to result in receipt of the notice by the consumer. Examples of ways in which a licensee may provide the required notice with the reasonable expectation of the consumer receiving it are (1) by delivering a printed copy of the notice by hand to the consumer; (2) by mailing a printed copy of the notice to the last known address of the consumer; (3) if a consumer agrees to electronic delivery of information, by providing the notice by electronic mail or by posting the notice on the licensee’s web site and requiring the consumer to acknowledge viewing the notice before obtaining a particular insurance product or service; and (4) for an isolated transaction with a consumer, by posting the notice on the licensee’s web site and requiring the consumer to acknowledge viewing the notice before obtaining the insurance product or service. 8 Examples of ways a licensee does not meet the requirement that a notice be provided in a manner that is reasonably expected to result in its receipt by a consumer include (1) by only posting a sign in the licensee’s office of the licensee’s privacy policies and practices; (2) by generally publishing advertisements of the licensee’s privacy policies and practices; and (3) by sending a notice by electronic mail to a consumer who does not obtain an insurance product or service from the licensee electronically. Limitation on redisclosure and reuse 3 AAC 26.650(b) restricts to whom a licensee may disclose information received from a nonaffiliated financial institution. For example, if a licensee obtains a customer list from a nonaffiliated financial institution other than under an exception in 3 AAC 26.665 or 3 AAC 26.670, the licensee may (1) use the list for its own purposes; or (2) disclose the list to another nonaffiliated third party only if the financial institution from which the licensee purchased the list could have lawfully disclosed the list to that third party in accordance with the privacy policy of the financial institution, as limited by the opt out direction of the consumer who is the subject of the information, and disclose the list in accordance with 3 AAC 26.665 or 3 AAC 26.670. Exception to notice and opt out requirements for service providers and joint marketing 3 AAC 26.660 sets out the exception to notice and opt out requirements in 3 AAC 26.625 and 3 AAC 26.645 with regard to disclosure of information to a nonaffiliated third party to perform services for the licensee or functions on behalf of the licensee. For example, if a licensee discloses nonpublic personal financial information to a financial institution with which the licensee performs joint marketing services, the licensee’s contractual agreement with that financial institution meets the requirements of 3 AAC 26.660 if the agreement prohibits the financial institution from disclosing or using the information except as necessary to carry out the joint marketing services or under an exception in 3 AAC 26.665 or 3 AAC 26.670. Dated this 13th day of October, 2004 at Anchorage, Alaska. Linda S. Hall Director