Revised Gramm-Leach-Bliley Act Privacy Notices; Withdrawal of Administrative Letter 2011-06

P.O. BOX 1157 RICHMOND, VIRGINIA 23218 TELEPHONE: (804) 371-9741 TDD/VOICE: (804) 371-9206 www.scc.virginia.gov/boi JACQUELINE K. CUNNINGHAM COMMISSIONER OF INSURANCE STATE CORPORATION COMMISSION BUREAU OF INSURANCE April 2, 2012                        Administrative Letter 2012‐04         TO:   All Insurance Institutions Licensed in Virginia and All Interested Parties    RE:   Revised Gramm‐Leach‐Bliley Act Privacy Notices; Withdrawal of Administrative Letter 2011‐06      NOTE:  EACH INSURANCE INSTITUTION RECEIVING THIS ADMINISTRATIVE LETTER IS INSTRUCTED TO  MAKE ALL OF ITS CURRENTLY APPOINTED AGENTS AND ALL NEWLY APPOINTED AGENTS AWARE OF  THIS ADMINISTRATIVE LETTER.      The purpose of this administrative letter is to advise Virginia agents and insurance institutions,  as defined in § 38.2‐602 of the Code of Virginia, that changes have been made in the Federal Model  Privacy  Forms  (Model  Privacy  Forms)  that  were  attached  to  Administrative  Letter  2011‐06.    The  attached revised Model Privacy Forms remove the requirement to insert Virginia specific information  in the Other Important Information box.  Removing this requirement allows insurance institutions and  agents  who  do  business  in  multiple  states  to  use  a  uniform  notice  and  still  meet  the  requirements  described in §§ 38.2‐604.1, 38.2‐612.1, 38.2‐613, and 38.2‐613.2 of the Code of Virginia (Virginia Privacy  Notice).    Although  the  Model  Privacy  Forms  are  not  required  to  be  used,  insurance  institutions  and  agents who elect to use the attached forms in accordance with this administrative letter will meet the  requirements for compliance with the Gramm‐Leach‐Bliley Act (GLBA) set forth in the Virginia Privacy  Notice.    Due  to  the  changes  in  the  attached  Model  Privacy  Forms,  Administrative  Letter  2011‐06  is  hereby withdrawn.    As  required  by  the  Financial  Services  Regulatory  Relief  Act  of  2006,  eight  federal  agencies1  adopted the simplified Model Privacy Forms.  Insurance institutions and agents that do business in the  Commonwealth may use the new Model Privacy Forms or continue to use other types of privacy notices  that  differ  from  the  Model  Privacy  Forms  to  meet  the  notice  content  requirements  of  the  Virginia  1 Office of the Comptroller of the Currency; Treasury (OCC); Board of Governors of the Federal Reserve System  (Board); Federal Deposit Insurance Corporation (FDIC); Office of Thrift Supervision, Treasury (OTS); National Credit  Union Administration (NCUA); Federal Trade Commission (FTC); Commodity Futures Trading Commission (CFTC);  and Securities and Exchange Commission (SEC).  Administrative Letter 2012‐04  April 2, 2012  Page 2 of 3  Privacy Notice.  The full and accurate completion of the Model Privacy Forms in accordance with the  Virginia  Instructions  and  this  administrative  letter  constitutes  compliance  with  the  notice  content  requirements of the Virginia Privacy Notice.  This safe harbor is limited to the content and format of the  Model Privacy Forms.  The requirements of § 38.2‐604.1 as to when the Virginia Privacy Notice must be  given to an applicant or insured are not changed by this administrative letter.   Use of Model Privacy Form  Insurance institutions and agents may use the attached Model Privacy Forms, consistent with  the Virginia instructions and the instructions set forth in this administrative letter, as a safe harbor of  compliance with the requirements of the Virginia Privacy Notice.  The Model Privacy Forms may be used  at the option of an insurance institution, including a group of insurance institutions, agents, or financial  companies that use a common privacy notice to meet the content requirements of the Virginia Privacy  Notice.    GLBA  and  the  Virginia  Privacy  Notice  requirements  apply  to  life  insurance,  accident  and  sickness insurance, and property and casualty insurance primarily for personal, family, or household  purposes.     The Model Privacy Forms are standardized forms, including page layout, content, format, style,  pagination, and shading.  Insurance institutions and agents seeking to obtain the safe harbor through  use of the Model Privacy Forms may modify them only as described in the Virginia Instructions, as well  as those in this administrative letter.  Furthermore, the safe harbor only applies to the use of the Model  Privacy Forms if the insurance institution or agent accurately completes the form and otherwise meets  the requirements of the Virginia instructions and those set forth in this administrative letter.    Under § 38.2‐604.1 of the Code of Virginia, if an insurance institution or agent only discloses  nonpublic personal information to affiliated and non‐affiliated third parties as authorized under § 38.2‐ 613 of the Code of Virginia, the insurance institution or agent is not required to list those exceptions in  the initial or annual Virginia Privacy Notice.  When describing the categories of parties to whom these  disclosures are made in the Model Privacy Forms, it is sufficient for the insurance institution or agent to  state  that  it  makes  disclosures  to  other  affiliated  and  non‐affiliated  third  parties  for  their  everyday  business purposes.       Use of Other Types of Privacy Notices   Use of the attached Model Privacy Forms is not required.  Insurance institutions and agents may  continue to use their existing privacy notices that meet the requirements of the Virginia Privacy Notice.      Safe Harbor Not Applicable to the Notice Required by § 38.2‐604    Insurance  institutions  and  agents  should  be  aware  that  while  the  accurate  use  of  the  Model  Privacy Forms will provide the insurance institution or agent with a safe harbor of compliance with the  Virginia Privacy Notice, the Model Privacy Forms will not provide a safe harbor for the notice required by  §  38.2‐604  of  the  Code  of  Virginia,  the  Notice  of  Information  Collection  and  Disclosure  Practices.   Consequently, insurance institutions and agents are reminded that they are still required to provide the  notice set forth in § 38.2‐604 of the Code of Virginia.  Administrative Letter 2012‐04  April 2, 2012  Page 3 of 3    Questions regarding this letter may be directed to:      Property & Casualty Division  Katie Johnson, CIC, AIE  Principal Insurance Market Examiner  (804) 371‐9688  Katie.Johnson@scc.virginia.gov      Life & Health Division  Ann Colley  Principal Insurance Analyst  (804) 371‐9813  Ann.Colley@scc.virginia.gov        Sincerely,     Jacqueline K. Cunningham  Commissioner of Insurance      Attachment      Attachment ‐ Model Privacy Form   There are four versions of the Model Privacy Form on the following pages:   • Version 1:  Model Form with No Opt‐out.   • Version 2:  Model Form with Opt‐out by Telephone and/or Online.   • Version 3:  Model with Mail‐in Opt‐out Form.   • Version 4:  Optional Mail‐in Form.    Version 1: Model Form with No Opt-out Rev. [Insert Date] FACTS WHAT DOES [NAME OF INSURANCE INSTITUTION/AGENT/FINANCIAL INSTITUTION] DO WITH YOUR PERSONAL INFORMATION? WHY? Financial companies choose how they share your personal information. Federal and state law give consumers the right to limit some but not all sharing. Federal and state law also require us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. WHAT? The types of personal information we collect and share depend on the product or service you have with us. This information can include:  Social security number and [example 2]  [example 3] and [example 4]  [example 5] and [example 6] When you are no longer our customer, we continue to share your information as described in this notice. HOW? All financial companies need to share their customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons [name of insurance institution /agent/financial institution] chooses to share; and whether you can limit this sharing. Reasons we can share your personal information. Does [name of insurance institution/agent/financial institution] share? Can you limit this sharing? For our everyday business purposes – Such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus For our marketing purposes – To offer our products and services to you For joint marketing with other financial companies For our affiliates’ everyday business purposes – Information about your transactions and experiences For our affiliates’ everyday business purposes – Information about your creditworthiness For our affiliates to market to you For nonaffiliates to market to you Questions? Call [phone number] or go to [website]. Version 1: Model Form with No Opt-out Page 2 Who we are. Who is providing this notice? [insert name of the insurance institution/agent/financial institution] What we do. How does [name of insurance institution/agent/financial institution] protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with state and federal law. These measures include computer safeguards and secured files and buildings. [insert] How does [name of insurance institution/agent/financial institution] collect my personal information? We collect your personal information, for example, when you  [example 1] and [example 2]  [example 3] and [example 4]  [example 5] and [example 6] [We also collect your personal information from other companies.] OR [We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.] Why can’t I limit all sharing? Federal law gives you the right to limit only  Sharing for affiliates’ everyday business purposes – information about your creditworthiness  Affiliates from using your information to market to you  Sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. [See below for more on your rights under state law.] Definitions Affiliates  Companies related by common ownership or control. They can be financial and nonfinancial companies.  [affiliate information] Nonaffiliates  Companies not related by common ownership or control. They can be financial and nonfinancial companies.  [nonaffiliate information] Joint marketing  A formal agreement between nonaffiliated financial companies that together market financial products or services to you.  [joint marketing information] Other important information [Insert other important information] Version 2: Model Form with Opt-out by Telephone and/or Online Rev. [Insert Date] FACTS WHAT DOES [NAME OF INSURANCE INSTITUTION/AGENT/FINANCIAL INSTITUTION] DO WITH YOUR PERSONAL INFORMATION? WHY? Financial companies choose how they share your personal information. Federal and state law give consumers the right to limit some but not all sharing. Federal and state law also require us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. WHAT? The types of personal information we collect and share depend on the product or service you have with us. This information can include:  Social security number and [example 2]  [example 3] and [example 4]  [example 5] and [example 6] HOW? All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons [name of insurance institution/agent/financial institution] chooses to share; and whether you can limit this sharing. Reasons we can share your personal information. Does [name of insurance institution/agent/financial institution] share? Can you limit this sharing? For our everyday business purposes – Such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus For our marketing purposes – To offer our products and services to you For joint marketing with other financial companies For our affiliates’ everyday business purposes – Information about your transactions and experiences For our affiliates’ everyday business purposes – Information about your creditworthiness For our affiliates to market to you For nonaffiliates to market to you To limit our sharing.  Call [phone number] – our menu will prompt you through your choice(s)  Visit us online: [website] Please note: If you are a new customer, we can begin sharing your information 30 days from the date we sent this notice. When you are no longer our customer, we continue to share your information as described in this notice. However, you can contact us at any time to limit our sharing. Questions? Call [phone number] or go to [website]. Version 2: Model Form with Opt-out by Telephone and/or Online Page 2 Who we are. Who is providing this notice? [insert name of the insurance institution/agent/financial institution] What we do. How does [name of insurance institution/agent/financial institution] protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with state and federal law. These measures include computer safeguards and secured files and buildings. [insert] How does [name of insurance institution/agent/financial institution] collect my personal information? We collect your personal information, for example, when you  [example 1] and [example 2]  [example 3] and [example 4]  [example 5] and [example 6] [We also collect your personal information from other companies.] OR [We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.] Why can’t I limit all sharing? Federal law gives you the right to limit only  Sharing for affiliates’ everyday business purposes – information about your creditworthiness  Affiliates from using your information to market to you  Sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. [See below for more on your rights under state law.] What happens when I limit sharing for an account I hold jointly with someone else? [Your choices will apply to everyone on your account.] OR [Your choices will apply to everyone on your account -- unless you tell us otherwise.] Definitions Affiliates  Companies related by common ownership or control. They can be financial and nonfinancial companies.  [affiliate information] Nonaffiliates  Companies not related by common ownership or control. They can be financial and nonfinancial companies.  [nonaffiliate information] Joint marketing  A formal agreement between nonaffiliated financial companies that together market financial products or services to you.  [joint marketing information] Other important information [Insert other important information] Version 3: Model Form with Mail-in Opt-out Form Rev. [Insert Date] FACTS WHAT DOES [NAME OF INSURANCE INSTITUTION/AGENT/FINANCIAL INSTITUTION] DO WITH YOUR PERSONAL INFORMATION? WHY? Financial companies choose how they share your personal information. Federal and state law give consumers the right to limit some but not all sharing. Federal and state law also require us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. WHAT? The types of personal information we collect and share depend on the product or service you have with us. This information can include:  Social security number and [example 2]  [example 3] and [example 4]  [example 5] and [example 6] HOW? All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons [name of insurance institution/ agent/financial institution] chooses to share; and whether you can limit this sharing. Reasons we can share your personal information. Does [name of insurance institution/agent/financial institution] share? Can you limit this sharing? For our everyday business purposes – Such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus For our marketing purposes – To offer our products and services to you For joint marketing with other financial companies For our affiliates’ everyday business purposes – Information about your transactions and experiences For our affiliates’ everyday business purposes – Information about your creditworthiness For our affiliates to market to you For nonaffiliates to market to you To limit our sharing.  Call [phone number] – our menu will prompt you through your choice(s)  Visit us online: [website]  Mail the form below Please note: If you are a new customer, we can begin sharing your information 30 days from the date we sent this notice. When you are no longer our customer, we continue to share your information as described in this notice. However, you can contact us at any time to limit our sharing. Questions? Call [phone number] or go to [website]. Cut here Mail-in Form Leave Blank OR [If you have a joint account, your choice(s) will apply to everyone on your account unless you mark the space below.  Apply my choices only to me] Mark any/all you want to limit:  Do not share information about my creditworthiness with your affiliates for their everyday business purposes.  Do not allow your affiliates to use my personal information to market to me.  Do not share my personal information with nonaffiliates to market their products and services to me. Name Mail to: [Name of insurance institution/agent/financial institution] Address [Address1] City, State, Zip [Address2] [Account #] [City], [State] [Zip] Version 3: Model Form with Mail-in Opt-out Form Page 2 Who we are. Who is providing this notice? [insert name of the insurance institution/agent/financial institution] What we do. How does [name of insurance institution/agent/financial institution] protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with state and federal law. These measures include computer safeguards and secured files and buildings. [insert] How does [name of insurance institution/agent/financial institution] collect my personal information? We collect your personal information, for example, when you  [example 1] and [example 2]  [example 3] and [example 4]  [example 5] and [example 6] [We also collect your personal information from other companies.] OR [We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.] Why can’t I limit all sharing? Federal law gives you the right to limit only  Sharing for affiliates’ everyday business purposes – information about your creditworthiness  Affiliates from using your information to market to you  Sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. [See below for more on your rights under state law.] What happens when I limit sharing for an account I hold jointly with someone else? [Your choices will apply to everyone on your account.] OR [Your choices will apply to everyone on your account -- unless you tell us otherwise.] Definitions Affiliates  Companies related by common ownership or control. They can be financial and nonfinancial companies.  [affiliate information] Nonaffiliates  Companies not related by common ownership or control. They can be financial and nonfinancial companies.  [nonaffiliate information] Joint marketing  A formal agreement between nonaffiliated financial companies that together market financial products or services to you.  [joint marketing information] Other important information [Insert other important information] Version 4: Optional Mail-in Form Cut here Mail-in Form Leave Blank OR [If you have a joint account, your choice(s) will apply to everyone on your account unless you mark the space below.  Apply my choices only to me] Mark any/all you want to limit:  Do not share information about my creditworthiness with your affiliates for their everyday business purposes.  Do not allow your affiliates to use my personal information to market to me.  Do not share my personal information with nonaffiliates to market their products and services to me. Name Address City, State, Zip [Account #] Mail to: [Name of insurance institution/agent/financial institution] [Address1] [Address2] [City], [State] [Zip] Virginia Instructions – Model Privacy Forms  1 1.  How the model privacy form is used.    (a) The model form may be used, at the option of an insurance institution or agent, including a  group of insurance institutions or financial institutions that use a common privacy notice, to meet  the content requirements of the privacy notice and opt‐out notice set forth in §§ 38.2‐604.1 and  38.2‐612.1 of the Code of Virginia.    (b)  The  model  form  is  a  standardized  form,  including  page  layout,  content,  format,  style,  pagination,  and  shading.    Insurance  institutions  or  agents  seeking  to  obtain  the  safe  harbor  through use of the model form may modify it only as described in these instructions.     (c) Note that disclosure of certain information, such as assets, income, and information from a  consumer reporting agency, may give rise to obligations under the Fair Credit Reporting Act [15  U.S.C. 1681 – 1681x] (FCRA), such as a requirement to permit a consumer to opt out of disclosures  to affiliates or designation as a consumer reporting agency if disclosures are made to nonaffiliated  third parties.    (d) In the body of the Model Privacy Forms, certain terms are used in place of the terms used in  the Code of Virginia.  In the interest of uniformity, insurance institutions and agents that wish to  use the Model Privacy Forms shall use such terms, as set forth in this instruction, in place of the  terms used in Chapter 6 of Title 38.2 of the Code of Virginia.  For example, in the Model Privacy  Forms,  reference  is  made  to  “financial  companies.”    This  term  includes  insurance  institutions,  agents, and other financial institutions who issue privacy notices in Virginia.  Additionally, the use  of the word “customer” is used instead of “policyholder” and “applicant,” where appropriate.  The  term “nonaffiliates” is used instead of “non‐affiliated third parties.”      2.  The contents of the model privacy form.  The model form consists of two pages, which may be  printed on both sides of a single sheet of paper, or may appear on two separate pages.  Where an  insurance  institution  or  agent  provides  a  long  list  of  insurance  institutions,  agents,  or  financial  institutions  at  the  end  of  the  model  form  in  accordance  with  Instruction  6(a)(1),  or  provides  additional information in accordance with Instruction 6(c), and such list or additional information  exceeds the space available on Page Two of the model form, such list or additional information  may extend to a third page.    (a)  Page One.  The first page consists of the following components:    (1)  Date last revised (upper right‐hand corner).  (2)  Title.  (3)  Key frame (Why?, What?, How?).  (4)  Disclosure table (“Reasons we can share your personal information”).  (5)    “To  limit  our  sharing”  box,  as  needed,  for  the  insurance  institutions’  or  agents’  opt‐out  information.  (6)  “Questions” box, for customer service contact information.  (7)  Mail‐in opt‐out form, as needed.    Virginia Instructions – Model Privacy Forms  2 (b)  Page Two.  The second page consists of the following components:    (1)  Heading (Page Two).  (2)  Frequently Asked Questions (“Who we are” and “What we do”).  (3)  Definitions.  (4)  “Other important information” box, as needed.    3.  The format of the model privacy form.  The format of the model form may be modified only as  described below:    (a)  Easily readable type font.  Insurance institutions and agents that utilize the model form must  use  it  in  an  easily  readable  type  font.    While  a  number  of  factors  together  produce  an  easily  readable type font, insurance institutions and agents are required to use a minimum 10‐point font  (unless otherwise expressly permitted in these instructions) and sufficient spacing between the  lines of type.    (b)  Logo.  An insurance institution or an agent may include a corporate logo on any page of the  notice,  so  long  as  it  does  not  interfere  with  the  readability  of  the  model  form  or  the  space  constraints of each page.    (c)  Page size and orientation.  Each page of the model form must be printed on paper in portrait  orientation,  the  size  of  which  must  be  sufficient  to  meet  the  layout  and  minimum  font  size  requirements, with sufficient white space on the top, bottom, and sides of the content.    (d)  Color.  The model form must be printed on white or light color paper (such as cream) with  black or other contrasting ink color.  Spot color may be used to achieve visual interest, so long as  the color contrast is distinctive and the color does not detract from the readability of the model  form.  Logos may also be printed in color.    (e)  Languages.  The model form may be translated into languages other than English.    The information in the model form may be modified only as described below:  4.    Name  of  the  insurance  institution,  a  group  of  affiliated  insurance  institutions  or  financial  institutions, or agent providing the notice.  Insert the name of the insurance institution or agent  providing  the  notice  or  a  common  identity  of  affiliated  insurance/financial  institutions  jointly  providing  the  notice  on  the  form  wherever  [name  of  insurance  institution/agent  or  financial  institution] appears.       Virginia Instructions – Model Privacy Forms  3 5.  Page One.     (a)    Last  revised  date.    The  insurance  institution  or  agent  must  insert  in  the  upper  right‐hand  corner the date on which the notice was last revised. The information shall appear in minimum 8‐ point font as “rev. [month/year]” using either the name or number of the month, such as “rev. July  2009” or “rev. 7/09.”      (b)  General instructions for the “What?” box.     (1)  The bulleted list identifies the types of personal information that the insurance institution or  agent collects and shares.  All insurance institutions and agents must use the term “Social Security  number” in the first bullet.      (2)  An insurance institution or agent must use no more than five (5) of the following terms to  complete  the  bulleted  list:  income;  account  balances;  payment  history;  transaction  history;  transaction  or  loss  history;  credit  history;  credit  scores;  assets;  investment  experience;  credit‐ based insurance scores; insurance claim history; medical information; overdraft history; purchase  history;  account  transactions;  risk  tolerance;  medical‐related  debts;  credit  card  or  other  debt;  mortgage  rates  and  payments;  retirement  assets;  checking  account  information;  employment  information; wire transfer instructions.  In addition to the terms above, insurance institutions and  agents may use other terms to more accurately reflect the information they collect and share.      (c)  General instructions for the disclosure table.  The left column lists reasons for sharing or using  personal information.  Each reason correlates to a specific legal provision described in paragraph  5(d) of these instructions.  In the middle column, each insurance institution or agent must provide  a “Yes” or “No” response that accurately reflects its information sharing policies and practices with  respect to the reason listed on the left.  In the right column, each insurance institution or agent  must  provide  in  each  box  one  of  the  following  three  (3)  responses,  as  applicable,  that  reflects  whether a consumer can limit such sharing: “Yes” if it is required to or voluntarily provides an opt‐ out; “No” if it does not provide an opt‐out; or “We don’t share” if it answers “No” in the middle  column.  Only the sixth row (“For our affiliates to market to you”) may be omitted at the option  of the insurance institution or agent.  See paragraph 5(d)(6) of this instruction.      (d)  Specific disclosures and corresponding legal provisions.      (1)  For our everyday business purposes.  This reason incorporates sharing information, including  sharing with service providers, under § 38.2‐613 of the Code of Virginia, other than the purposes  specified in paragraphs 5(d)(2) and 5(d)(3) below.     (2)    For  our  marketing  purposes.    This  reason  incorporates  sharing  information  with  service  providers by an insurance institution or agent for its own marketing pursuant to §§ 38.2‐604.1 and  38.2‐613 of the Code of Virginia.  An insurance institution or agent that shares for this reason may  choose to provide an opt‐out.     Virginia Instructions – Model Privacy Forms  4 (3)    For  joint  marketing  with  other  financial  companies.    This  reason  incorporates  sharing  information  under  joint  marketing  agreements  between  two  or  more  insurance  institutions,  financial  institutions,  or  agents  and  with  any  service  provider  used  in  connection  with  such  agreements  pursuant  to  §§  38.2‐604.1  and  38.2‐613  of  the  Code  of  Virginia.    An  insurance  institution or agent that shares for this reason may choose to provide an opt‐out.      (4)    For  our  affiliates’  everyday  business  purposes  –  information  about  transactions  and  experiences.  This reason incorporates sharing information specified in Sections 603(d)(2)(A)(i) and  (ii) of the FCRA and § 38.2‐604.1 of the Code of Virginia.  An insurance institution or agent that  shares for this reason may choose to provide an opt‐out.     (5)    For  our  affiliates’  everyday  business  purposes  –  information  about  creditworthiness.    This  reason  incorporates  sharing  information  pursuant  to  Section  603(d)(2)(A)(iii)  of  the  FCRA.    An  insurance institution or agent that shares for this reason must provide an opt‐out.      (6)  For our affiliates to market to you.  This reason incorporates sharing information specified in  Section  624  of  the  FCRA.    This  reason  may  be  omitted  from  the  disclosure  table  when:  the  insurance institution or agent does not have affiliates (or does not disclose personal information to  its affiliates); the insurance institution’s or agent’s affiliates do not use personal information in a  manner  that  requires  an  opt‐out;  or  the  insurance  institution  or  agent  provides  the  affiliate  marketing  notice  separately.    Insurance  institutions  and  agents  that  include  this  reason  must  provide an opt‐out of indefinite duration.  An insurance institution or agent that is required to  provide an affiliate marketing opt‐out, but does not include that opt‐out in the model form under  this part, must comply with Section 624 of the FCRA with respect to the initial notice and opt‐out  and any subsequent renewal notice and opt‐out.  An insurance institution or agent not required to  provide an opt‐out under this subparagraph may elect to include this reason in the model form.      (7)  For nonaffiliates to market to you.  This reason incorporates sharing described in §§ 38.2‐612.1  and  38.2‐613  of  the  Code  of  Virginia.    An  insurance  institution  or  agent  that  shares  personal  information for this reason must provide an opt‐out.     (e)  To limit our sharing:  An insurance institution or agent must include this section of the model  form only if it provides an opt‐out as set forth in §§ 38.2‐604.1 and 38.2‐612.1 of the Code of  Virginia.    The  word  “choice”  may  be  written  in  either  the  singular  or  plural,  as  appropriate.   Insurance  institutions  and  agents  must  select  one  or  more  of  the  applicable  opt‐out  methods  described: telephone, such as by a toll‐free number; a Website; or use of a mail‐in opt‐out form.   Insurance  institutions  and  agents  may  include  the  words  “toll‐free”  before  telephone,  as  appropriate.    An  insurance  institution  or  agent  that  allows  consumers  to  opt  out  online  must  provide  either  a  specific  Web  address  that  takes  consumers  directly  to  the  opt‐out  page  or  a  general Web address that provides a clear and conspicuous direct link to the opt‐out page.  The  opt‐out choices made available to the consumer who contacts the insurance institution or agent  through these methods must correspond accurately to the “Yes” responses in the third column of  the disclosure table.  In the part titled “Please note,” insurance institutions and agents may insert       Virginia Instructions – Model Privacy Forms  5 a  number  that  is  30  or  greater  in the  space marked “[30].”    Instructions  on  voluntary  or  state  privacy law opt‐out information are in paragraph 5(g)(5) of these instructions.      (f)  Questions box.  Customer service contact information must be inserted as appropriate, where  [phone  number]  or  [website]  appear.    Insurance  institutions  and  agents  may  elect  to  provide  either  a  phone  number,  such  as  a  toll‐free  number,  or  a  Web  address,  or  both.    Insurance  institutions  and  agents  may  include  the  words  “toll‐free”  before  the  telephone  number,  as  appropriate.     (g)  Mail‐in opt‐out form.  Insurance institutions and agents must include this mail‐in form only if  they state in the “To limit our sharing” box that consumers can opt out by mail.  The mail‐in form  must  provide  opt‐out  options  that  correspond  accurately  to  the  “Yes”  responses  in  the  third  column  in  the  disclosure  table.    Insurance  institutions  and  agents  that  require  applicants  and  policyholders to provide only name and address may omit the section identified as “[account #].”   Insurance  institutions  and  agents  that  require  additional  or  different  information,  such  as  a  random opt‐out number or a truncated account number to implement an opt‐out election, should  modify the “[account #]” reference accordingly.  This includes insurance institutions and agents  that require applicants and policyholders with multiple accounts to identify each account to which  the opt‐out should apply.  An insurance institution or agent must enter its opt‐out mailing address  in the far right of this form (see version 3 of the Model Privacy Forms) or below the form (see  version 4).  The reverse side of the mail‐in opt‐out form must not include any content of the model  form.      (1)    Joint  accountholder.    Virginia  law  provides  that  any  joint  applicant  or  policyholder  may  separately direct that his financial information not be disclosed to nonaffiliates.  In accordance  with paragraph 6(a)(5) of these instructions, Virginia insurance institutions and agents that permit  applicants and policyholders to opt out using a mail‐in form (in versions 3 and 4 of the Model  Privacy Forms) must provide (in the far left column of the mail‐in form) the following statements:  “If you have a joint account, your choice(s) will apply to everyone on your account unless you mark  below.”  “Apply my choice(s) only to me.”  Virginia insurance institutions and agents may not leave  this area of the mail‐in form blank.  The word “choice” may be written in either the singular or the  plural, as appropriate, and the word “policy” may be substituted for “account” in this statement.      (2)  FCRA Section 603(d)(2)(A)(iii) opt‐out.  If the insurance institution or agent shares personal  information pursuant to Section 603(d)(2)(A)(iii) of the FCRA, it must include in the mail‐in opt‐out  form the following statement:  “Do not share information about my creditworthiness with your  affiliates for their everyday business purposes.”     (3)  FCRA Section 624 opt‐out.  If the insurance institution or agent incorporates Section 624 of the  FCRA in accord with paragraph 5(d)(6) of these Instructions, it must include in the mail‐in opt‐out  form  the  following  statement:  “Do  not  allow  your  affiliates  to  use  my  personal  information  to  market to me.”        Virginia Instructions – Model Privacy Forms  6 (4)    Nonaffiliates  opt‐out.    If  the  insurance  institution  or  agent  shares  personal  information  pursuant to §§ 38.2‐604.1, 38.2‐612.1, and 38.2‐613 of the Code of Virginia, it must include in the  mail‐in  opt‐out  form  the  following  statement:    “Do  not  share  my  personal  information  with  nonaffiliates to market their products and services to me.”     (5)  Additional opt‐outs.  Insurance institutions and agents that use the disclosure table to provide  opt‐out options beyond those required by Federal law must provide those opt‐outs in this section  of the model form.  An insurance institution or agent that chooses to offer an opt‐out for its own  marketing in the mail‐in opt‐out form must include one of the two following statements: “Do not  share  my  personal  information  to  market  to  me.”  or  “Do  not  use  my  personal  information  to  market  to  me.”    An  insurance  institution  or  agent  that  chooses  to  offer  an  opt‐out  for  joint  marketing must include the following statement:  “Do not share my personal information with  other financial institutions to jointly market to me.”      (h)  Barcodes.  An insurance institution or agent may elect to include a barcode and/or “tagline”  (an  internal  identifier)  in  6‐point  font  at  the  bottom  of  Page  One,  as  needed  for  information  internal to the institution, so long as these do not interfere with the clarity or text of the form.      6. Page Two.   (a)  General instructions for the questions.  Certain questions may be customized as follows:    (1)    “Who  is  providing  this  notice?”    This  question  may  be  omitted  when  only  one  insurance  institution  or  agent  provides  the  model  form  and  that  insurance  institution  or  agent  is  clearly  identified in the title on Page One.  Two or more insurance institutions, financial institutions, or  agents  that  jointly  provide  the  model  form  must  use  this  question  to  identify  themselves  as  required by § 38.2‐604.1 of the Code of Virginia.  When the list of insurance institutions,  financial  institutions,  or  agents  exceeds  four  (4)  lines,  the  insurance  institution,  financial  institution,  or  agent must describe in the response to this question the general types of insurance institutions,  financial  institutions,  or  agents  jointly  providing  the  notice  and  must  separately  identify  those  insurance institutions, financial institutions, or agents in minimum 8‐point font, directly following  the “Other important information” box, or, if that box is not included in the institution’s form,  directly following the “Definitions.” The list may appear in a multi‐column format.      (2)  “How does [name of insurance institution/agent/financial institution] protect my personal  information?”    The  insurance  institution  or  agent  may  only  provide  additional  information  pertaining  to  its  safeguard  practices  following  the  designated  response  to  this  question.    Such  information may include information about the insurance institution’s or agent’s use of cookies or  other  measures  it  uses  to  safeguard  personal  information.    See  §  38.2‐613.2  of  the  Code  of  Virginia.  Insurance institutions and agents are limited to a maximum of 30 additional words.      (3)    “How  does  [name  of  insurance  institution/agent/financial  institution]  collect  my  personal  information?”  Insurance institutions and agents must use no more than five (5) of the following  terms to complete the bulleted list for this question: open an account; deposit money; pay your  bills;  apply  for  a  loan;  use  your  credit  or  debit  card;  seek  financial  or  tax  advice;  apply  for  Virginia Instructions – Model Privacy Forms  7 insurance; pay insurance premiums; file an insurance claim; seek advice about your investments;  buy  securities  from  us;  sell  securities  to  us;  direct  us  to  buy  securities;  direct  us  to  sell  your  securities; make deposits or withdrawals from your account; enter into an investment advisory  contract;  give  us  your  income  information;  provide  employment  information;  give  us  your  employment  history;  tell  us  about  your  investment  or  retirement  portfolio;  tell  us  about  your  investment  or  retirement  earnings;  apply  for  financing;  apply  for  a  lease;  provide  account  information; give us your contact information; pay us by check; give us your wage statements;  provide your mortgage information; make a wire transfer; tell us who receives the money; tell us  where to send the money; show your government‐issued ID; show your driver’s license; or  order a  commodity futures or option trade.  In addition to the terms above, insurance institutions and  agents  may  use  other  terms  that  more  accurately  reflect  the  sources  of  the  information  they  collect.      Insurance  institutions  and  agents  that  collect  personal  information  from  their  affiliates  and/or  credit bureaus must include after the bulleted list the following statement: “We also collect your  personal  information  from  others,  such  as  credit  bureaus,  affiliates,  or  other  companies.”   Insurance institutions and agents that do not collect personal information from their affiliates or  credit  bureaus  but  do  collect  information  from  other  companies  must  include  the  following  statement  instead:  “We  also  collect  your  personal  information  from  other  companies.”    Only  insurance  institutions  and  agents  that  do  not  collect  any  personal  information  from  affiliates,  credit bureaus, or other companies may omit both statements.      (4)  “Why can’t I limit all sharing?”  Insurance institutions and agents that describe state privacy  law provisions in the “Other important information” box must use the bracketed sentence: “See  below for more on your rights under state law.”  Other insurance institutions and agents must  omit this sentence.      (5)  “What happens when I limit sharing for an account I hold jointly with someone else?”      (a)    Insurance  institutions  and  agents  must  use  the  following  statement  to  respond  to  this  question: “Your choices will apply to everyone on your account – unless you tell us otherwise.”   Virginia  law  provides  that  any  joint  applicant  or  policyholder  may  separately  direct  that  his  financial information not be disclosed to nonaffiliates.  (See § 38.2‐612.1 D of the Code of Virginia.)   Insurance institutions and agents that provide insurance products or services and elect to use the  model form may substitute the word “policy” for “account” in these statements.      (b)  General instructions for the definitions.  The insurance institution or agent must customize the  space below the responses to the three definitions in this section.  This specific information must  be in italicized lettering to set off the information from the standardized definitions.     (1)  Affiliates.  As required by § 38.2‐604.1 of the Code of Virginia, where [affiliate information]  appears, the insurance institution or agent must:      (i)  If it has no affiliates, state: “[name of insurance institution or agent] has no affiliates”;   Virginia Instructions – Model Privacy Forms  8 (ii)  If  it  has  affiliates  but  does  not  share  personal  information,  state:  “[name  of  insurance  institution or agent] does not share with our affiliates”; or   (iii)  If it shares with its affiliates, state, as applicable: “Our affiliates include companies with a  [common corporate identity of insurance institution or agent] name; financial companies such as  [insert illustrative list of companies]; nonfinancial companies, such as [insert illustrative list of  companies;] and others, such as [insert illustrative list].”     (2)    Nonaffiliates.    As  required  by  §  38.2‐604.1  of  the  Code  of  Virginia,  where  [nonaffiliate  information] appears, the insurance institution or agent must:      (i)  If it does not share with nonaffiliates, state: “[name of insurance institution or agent] does  not share with nonaffiliates so they can market to you”; or   (ii)  If it shares with nonaffiliates, state, as applicable:  “Nonaffiliates we share with can include  [list  categories  of  companies  such  as  mortgage  companies,  insurance  companies,  direct  marketing companies, and nonprofit organizations].”     (3)  Joint marketing.  As required by § 38.2‐604.1 of the Code of Virginia, where [joint marketing]  appears, the [insurance institution or agent] must:      (i)  If  it  does  not  engage  in  joint  marketing,  state:  “[name  of  insurance  institution  or  agent]  doesn’t jointly market”; or   (ii)  If  it  shares  personal  information  for  joint  marketing,  state,  as  applicable:  “Our  joint  marketing partners include [list categories of companies such as credit card companies].”      (c)    General  instructions  for  the  “Other  important  information”  box.    This  box  is  optional.    The  space provided for information in this box is not limited.  Only the following types of information  can appear in this box:     (1)  State and/or international privacy law information; and/or     (2)  Acknowledgment of receipt form.