AZ Circular Letter 2000-12: Enforcement of Gramm-Leach-Bliley Privacy Requirements

STATE OF ARIZONA DEPARTMENT OF INSURANCE JANE DEE HULL 2910 NORTH 44th STREET, SUITE 210 CHARLES R. COHEN Governor PHOENIX, ARIZONA 85018-7256 Director of Insurance 602/912-8456 (phone) 602/912-8452 (fax) Circular Letter 2000-12 TO: Insurance Industry Representatives; Insurance Trade Associations; and Other Interested Parties FROM: Charles R. Cohen Director of Insurance DATE: October 3, 2000 RE: Enforcement of Gramm-Leach-Bliley Privacy Requirements The Gramm Leach Bliley Act, Public Law 106-102, November 12, 1999 (“GLB”) requires financial institutions, including insurers, to protect the privacy of consumers’ non-public personal information. Title V of GLB requires federal and state regulators to implement GLB’s privacy protections within 6 months of the bill’s effective date, except to the extent that a later date is specified in rule. (See GLB §§ 504 and 510(1).) The Act and its implementing regulations take effect on November 13, 2000. Under the authority of GLB § 510(1) federal regulators have elected to delay enforcement until July 1, 2001. (See 65 Fed. Reg. 35162, 35184-35185 (June 1, 2000).) The delayed enforcement date will give federally regulated financial institutions sufficient time to establish policies, procedures, and systems required to comply with the new federal requirements. In deciding to delay enforcement, federal regulators noted that “financial institutions are expected…to begin compliance efforts promptly, to use the period prior to June 30, 2001 to implement and test their systems, and to be in full compliance by July 1, 2001.” (Id. p. 35185.) GLB gives state insurance regulators authority to enforce federal privacy laws, as they apply to insurers. GLB § 505(a)(6). Subject to GLB’s nondiscrimination standards and other preemption provisions, states may enact and enforce privacy standards that exceed those in GLB. GLB § 507 ne 30, 2001 to implement and test their systems, and to be in full compliance by July 1, 2001.” (Id. p. 35185.) GLB gives state insurance regulators authority to enforce federal privacy laws, as they apply to insurers. GLB § 505(a)(6). Subject to GLB’s nondiscrimination standards and other preemption provisions, states may enact and enforce privacy standards that exceed those in GLB. GLB § 507. If a state fails to adopt regulations that meet at least the federal minimum standards, the state will lose its enforcement authority. GLB § 505(c). Arizona already regulates privacy of consumers’ personal information. The Arizona Insurance Information and Privacy Protection Act, A.R.S. § 20-2101et seq., protects Circular Letter 2000-12 October 3, 2000 Page 2 “individually identifiable information gathered in connection with an insurance transaction and from which judgments can be made about an individual’s character, habits, avocations, finances, occupation, general reputation, credit, health or any other personal characteristics, including medical record information. See A.R.S. § 20- 2102(18). Arizona’s privacy law (which is based on a 1980 NAIC model law) is, in most respects, more comprehensive and more stringent than GLB standards. Insurers doing business in Arizona have complied with this law since the early 1980’s. The Department intends to propose legislation in the 2001 session amending this law to ensure that all Arizona standards are at least as stringent as federal minimum standards. The Department is issuing this circular to advise insurers and other interested parties of its policy for enforcement of GLB’s privacy standards. • ADOI has no discretion to waive or defer compliance with current state law A.R.S. § 20-2101 et seq.) and will enforce this statute as it has been enforced since enactment hat all Arizona standards are at least as stringent as federal minimum standards. The Department is issuing this circular to advise insurers and other interested parties of its policy for enforcement of GLB’s privacy standards. • ADOI has no discretion to waive or defer compliance with current state law A.R.S. § 20-2101 et seq.) and will enforce this statute as it has been enforced since enactment. • To the extent that any new standards are adopted in the 2001 session, they will not be effective until the regular effective date for 2001 legislation (90 days sine die), which will almost certainly be later than the federal compliance date of July 1, 2001. If an earlier effective date is required and the legislation passes as an emergency measure, the Department will support a delayed enforcement date of July 1, 2001. • To the extent that the Department has authority to enforce federal privacy standards that are not part of A.R.S. Title 20, the Department will act in accordance with the delayed enforcement date (July 1, 2001) adopted by federal regulators. Like the federal regulators, it is the Department’s expectation that insurers will use the time between now and July 1, 2001 to ready their systems for full compliance with privacy requirements. Please direct any questions regarding this circular letter to Vista Thompson Brown, Executive Assistant for Policy Affairs, 602-912-8456.