AZ Regulatory Bulletin 2002-02: Information Privacy Issues; Correction of Bulletin 2001-11

STATE OF ARIZONA DEPARTMENT OF INSURANCE JANE DEE HULL 2910 NORTH 44th STREET, SUITE 210 CHARLES R. COHEN Governor PHOENIX, ARIZONA 85018-7256 Director of Insurance 602/912-8456 (phone) 602/912-8452 (fax) Regulatory Bulletin 2002-02 TO: Insurance Institutions, Producers, Insurance Support Organizations, Insurance Trade Associations and Other Interested Parties FROM: Charles R. Cohen Director of Insurance DATE: February 25, 2002 RE: Information Privacy Issues; Correction of Bulletin 2001-11 This bulletin revises information contained in Regulatory Bulletin 2001-11, issued on August 31, 2001, regarding the Department’s interpretation of the contents of the privacy notice required by A.R.S. § 20-2104. A.R.S. § 20-2104(C) provides that the notice shall include certain information listed in the subsection or “shall either contain the information required for compliance with the notice requirements established under section 503 of the Gramm Leach Bliley act (15 U.S.C. § 6803)…” In regulatory bulletin 2001-11, the Department interpreted this provision as follows: If an insurance entity elects to use the GLB notice it has developed for use in other states as its notice under A.R.S. § 20-2104, the insurance entity must include an addendum that apprises applicants and policyholders of their rights under A.R.S. §§ 20-2108 and 20-2109.…In Arizona, information practices include the rights and procedures set forth in A.R.S. §§ 20-2108 and 20-2109. Consequently, those practices must be disclosed in, or as an addendum to, the privacy notice used in Arizona. Several insurers have questioned the Department’s interpretation of A.R.S. § 20-2104, contending that use of the term “or” in the statute must be read to permit either the information listed in A.R.S. § 20-2104(C) or the information listed in 15 U.S.C. § 6803. The Department agrees, and withdraws that portion of the circular letter that requires an insurer using its GLB notice to also include, either in the notice or in an addendum, the rights specified in A.R.S. § 20-2108 and 20-2109. Regulatory Bulletin 2002-02 02/25/02 Page 2 GLB does require that the notice describe an insurance entity’s “policies and practices…with respect to disclosing nonpublic personal information to nonaffiliated third parties…” GLB § 503(b). The Department does wish to remind insurers using a GLB notice that the notice must accurately reflect the insurer’s practices in Arizona. Arizona law imposes greater restrictions on disclosure of information to nonaffiliated third parties. A.R.S. § 20-2113 prohibits disclosure of an individual’s personal information unless the individual has either consented to disclosure or there is an applicable exception. A.R.S. § 20-2113(11) allows disclosure of very limited information1 to a person who wishes to use the information for marketing a product or service if the insurer or producer gives the individual an opportunity to opt out and the individual does not opt out. The person receiving the information must agree to no further disclosure. Unlike with GLB, Arizona law does not permit an insurer to share nonpublic information when an insured fails to opt out. It is the Department’s interpretation that in allowing an insurer to use its GLB notice, the Legislature did not intend to remove or change any substantive protections against disclosure that are found in A.R.S. § 20-2113. Thus, when using a GLB notice, insurers must be careful to make sure that the notice accurately reflects the insurer's policies and practices in Arizona for disclosure of information to third parties. Please direct any questions about this regulatory bulletin to Vista Thompson Brown, Executive Assistant for Policy Affairs, 602-912-8456, vbrown@id.state.az.us. 1 Under this exception, the insurance entity may not share: (1) medical record information, (2) privileged information, (3) personal information relating to an individual’s character, personal habits, mode of living or general reputation, or (4) any classification derived from the individual’s information.