Act 1526 of 2005

Arkansas Insurance Department Mike Huckabee Julie Benafield Bowman Governor Commissioner January 17, 2006 BULLETIN NO. 1-2006 TO: All Licensed Foreign, Alien and Domestic Insurers, Accredited/Trusteed Reinsurers, Farmers' Mutual Aid Associations, Hospital and Medical Service Corporation, Health Maintenance Organizations, Fraternal Benefit Societies, Insurer Trade Associations, Rate Service or Advisory Organizations; All Agent and Broker Trade Associations, All Third Party Administrators, Adjuster Trade Association; Approved But Not Admitted Surplus Line Insurers and Licensed Funeral Directors Holding Permits to sell Prepaid Funeral Benefit Contract; Licensed Employee Leasing Firms/Groups; Licensed Managing General Agents/Agencies; Registered Life Care and Continuing Care Facilities; Licensed Surplus Line Brokers; Registered Notary Bond Surety Corporations; and Other Interested Parties. FROM: ARKANSAS INSURANCE DEPARTMENT SUBJECT: ACT 1526 of 2005 The Arkansas Insurance Department issues this Bulletin to inform all above-referenced parties of Act 1526 of 2005 (“Act”), codified as Ark. Code Ann. §§ 4-110-101, et seq. The stated purpose of the Act is to ensure that Arkansans’ sensitive personal information is protected. The Act requires all persons or businesses to take all reasonable steps to destroy such information that is not to be retained. “Business” includes “a financial institution organized, chartered, or holding a license or authorization certificate under the law of this state, or any other state, the United States, or of any other country or the parent or subsidiary of a financial institution.” Ark. Code Ann. § 4-110-103(2)(A). The destruction of customers’ personal information must be accomplished so that the information is unreadable and undecipherable. Businesses must also, with some exceptions, inform customers when there has been a breach of security. This means that “any resident of Arkansas whose unencrypted [computerized] personal information was, or is reasonably believed to have been, acquired by an unauthorized person” must be notified if one of the exceptions in Act 1526 does not apply. The Act contains an exemption for persons or businesses that are regulated by state or federal law that provides greater protection for personal information and at least as thorough disclosure requirements for security breaches as are provided by the Act. Arkansas Insurance Department Rule and Regulation 77, “Standards for Safeguarding Customer Privacy” was promulgated pursuant to the federal Gramm-Leach-Bliley Act and Ark. Code Ann. § 23-63-113. Rule 77 does not save Department licensees from having to comply with the Act, because Rule 77 does not apply to all persons/business, while the Act does. Also, Rule 77 does not provide greater 1200 West Third Street, Little Rock, AR 72201-1904 · (501) 371-2600 · (501) 371-2618 fax · www.insurance.arkansas.gov Information (800) 282-9134 · Consumer Services (800) 852-5494 · Seniors (800) 224-6330 · Criminal Inv. (866) 660-0888 protection and at least as thorough disclosure requirements as the Act; for instance, Rule 77 has no disclosure requirements for breaches of security. Therefore, the Arkansas Insurance Department urges all persons and businesses, as defined in the Act, to take steps to ensure that they are meeting all of the Act’s requirements, lest they be subject to penalties. The Arkansas Attorney General is charged with enforcement of the Act. The text of the Act can be found at http://www.arkleg.state.ar.us/. The statutes can be found at the State of Arkansas website: http://www.state.ar.us/. All carriers are instructed to provide copies of this Bulletin to their appointed producers. Questions regarding this Bulletin should be directed to the Office of the Arkansas Attorney General at 1-800-482-8982, 682-2341 or email www.arkansasag.gov. (signed by Julie Benafield Bowman)+ ________________________________ JULIE BENAFIELD BOWMAN INSURANCE COMMISSIONER (January 17, 2006) ________________________________ DATE