Existing law, the Insurance Information and Privacy Protection Act, establishes privacy standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents, and insurance-support organizations. The act requires an insurance institution or agent to provide a notice of information to applicants and policyholders in connection with specified insurance transactions. Existing regulations require an insurance licensee to annually provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices.

This bill would codify the requirement to annually provide a clear and conspicuous privacy notice to customers. The bill would state that an insurance institution or agent is in compliance with this requirement if specified criteria are met, including informing the consumer of the right to submit a written request to access, correct, amend, or delete their personal information. The bill would authorize the notice to be combined with the notice provided in connection with specified insurance transactions.

Existing law, the Insurance Information and Privacy Protection Act, establishes privacy standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents, and insurance-support organizations. The act requires an insurance institution or agent to provide a notice of information to applicants and policyholders in connection with specified insurance transactions. Existing regulations require an insurance licensee to annually provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices.

This bill would codify the requirement to annually provide a clear and conspicuous privacy notice to customers. The bill would state that an insurance institution or agent is in compliance with this requirement if specified criteria are met, including informing the consumer of the right to submit a written request to access, correct, amend, or delete their personal information. The bill would authorize the notice to be combined with the notice provided in connection with specified insurance transactions.

Existing law, the Insurance Information and Privacy Protection Act, establishes privacy standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents, and insurance-support organizations. The act requires an insurance institution or agent to provide a notice of information to applicants and policyholders in connection with specified insurance transactions. Existing regulations require an insurance licensee to annually provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices.

This bill would codify that requirement to annually provide a clear and conspicuous privacy notice to customers. The bill would state that an insurance institution or agent is in compliance with this requirement if specified criteria are met, including informing the consumer of the right to submit a written request to access, correct, amend, or delete their personal information. The bill would authorize the notice to be combined with the notice provided in connection with specified insurance transactions.

Existing law, the Insurance Information and Privacy Protection Act, establishes privacy standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents, and insurance-support organizations. The act requires an insurance institution or agent to provide a notice of information to applicants and policyholders in connection with specified insurance transactions. Existing regulations require an insurance licensee to annually provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices.

This bill would codify that requirement to annually provide a clear and conspicuous privacy notice to customers. The bill would state that an insurance institution or agent is in compliance with this requirement if specified criteria are met. met, including informing the consumer of the right to submit a written request to access, correct, amend, or delete their personal information. The bill would authorize the notice to be combined with the notice provided in connection with specified insurance transactions.

Existing law, the Insurance Information and Privacy Protection Act, establishes privacy standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents, and insurance-support organizations. The act requires an insurance institution or agent to provide a notice of information to applicants and policyholders in connection with specified insurance transactions. Existing regulations require an insurance licensee to annually provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices.

This bill would codify that requirement to annually provide a clear and conspicuous privacy notice to customers. The bill would state that an insurance institution or agent is in compliance with this requirement if specified criteria are met. The bill would authorize the notice to be combined with the notice provided in connection with specified insurance transactions.

Date of Hearing: August 16, 2023

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Chris Holden, Chair

SBPCA Bill Id:SB 793

Author:(Glazer) – As Amended Ver:April 17, 2023

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill allows a qualifying insurer to send its customers an annual privacy notice only when the insurer’s privacy policy has changed, conforming state law to federal law.

Specifically, this bill:

1. Requires an insurer to provide a clear and conspicuous notice to policyholders that accurately reflects its privacy policies and practices not less than annually, as that term is defined, during the continuation of the policyholder relationship.
2. States that the required notice must comply with applicable California regulations specifying the information to be included in privacy notices.
3. Deems that an insurance agent or broker has met the notification requirements if it meets all of the following conditions:
   1. The insurer does not provide medical record, personal, or privileged information to a nonaffiliated third party, as specified.
   2. The insurer provides, as part of an abbreviated notice, the website address for the insurer’s privacy notice and specified information about the policyholder’s rights regarding personal information about them maintained by the insurer.
   3. The insurer’s policies and practices about disclosing personal or privileged information have not changed from the previous notice provided.
4. Clarifies that an insurer or agent is not required to provide a notice to a former policyholder with whom it no longer has a continuing relationship.

FISCAL EFFECT:

No significant state costs.

COMMENTS:

1. Purpose. According to the author:

Notices to consumers are only effective so long as they are meaningful. A phenomenon has been noted that the more frequent, numerous, lengthy notices are the less likely consumers are to read them. Given the importance of privacy notices, it is critical that notice for privacy rights be enacted and distributed in a manner most likely to inform consumers.

1. Background. The Gramm-Leach-Bliley Act (GLBA) is a federal law that, among other provisions, requires a financial institution to protect the privacy of certain sensitive data and to provide customers with information about the institution’s information-sharing practices. The GLBA governs these practices for commercial banks, mortgage lenders, insurance companies, and other institutions that provide financial products or services to consumers. Under both the GLBA and state law, an insurer must send a new customer an initial notice containing information about its privacy policies. Existing law in California requires an insurer to send subsequent privacy notices to its customers annually.

This bill would instead require an insurer to send annual privacy notices to its customers only when the insurer’s privacy policy has changed, provided the insurer meets certain requirements. This change would conform state law to the federal GBLA, making California one of the last remaining states to do so. Because a customer tends to tune out repeated communications that don’t present new information, the goal of this policy to cut down on unnecessary notices and instead capture a customer’s attention when it is truly critical – when the customer’s insurer, which possesses a significant amount of personal and sensitive data about each customer, has changed its privacy policy. The disclosure requirements in this bill, like other provisions of the Insurance Information and Privacy Protection Act, will be enforced by the Insurance Commissioner. The Department of Insurance anticipates no cost to the department resulting from this bill.

1. Prior Legislation. AB 2372 (Calderon), of the 2021-2022 Legislative Session, was substantially similar to this bill. AB 2372 was not heard on the Senate floor and died on the inactive file.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: June 28, 2023

ASSEMBLY COMMITTEE ON INSURANCE

Lisa Calderon, Chair

SBPCA Bill Id:SB 793

Author:(Glazer) – As Amended Ver:April 17, 2023

SENATE VOTE: 39-0

SUBJECT: Insurance: privacy notices and personal information

SUMMARY: Allows an insurer to send privacy policy notices once initially and thereafter only, when a change has been made in the privacy policy to satisfy the privacy notice requirements of the Insurance Information and Privacy Protection Act (IIPPA). Specifically, this bill:

1. Requires an insurer to provide a clear and conspicuous notice to policyholders that accurately reflects its privacy policies and practices not less than annually, as that term is defined, during the continuation of the policyholder relationship.
2. States that the required notice must comply with applicable California regulations specifying the information to be included in privacy notices.
3. Deems that an insurance agent or broker has met the notification requirements if it meets all of the following conditions:
   1. The insurer does not provide medical record, personal, or privileged information to a nonaffiliated third party, as specified;
   2. The insurer provides, as part of an abbreviated notice, the internet website address for the insurer’s privacy notice and informs the policyholder in a clear and conspicuous matter all of the following:
      1. The policyholder’s right to submit a written request to access, correct, amend, or delete their personal information and the manner in which the right may be exercised;
      2. The right to receive a response within 30 business days of the policyholder submitting a request to access, correct, amend, or delete their personal information;
      3. If the insurer refuses the policyholder’s request, the right to file a statement regarding what the policyholder believes to be accurate and fair information and why the policyholder disagrees with the insurer’s refusal; and,
   3. The insurer’s policies and practices about disclosing personal or privileged information have not changed from the previous notice provided.
4. Clarifies that an insurer or agent is not required to provide a notice to a former policyholder with whom it no longer has a continuing relationship.

EXISTING LAW:

1. Provides financial institutions, pursuant to the Gramm-Leach-Bliley Act (GLBA), a federal law to which insurers are subject that includes privacy provisions, with an exemption to the requirement to deliver an annual privacy notice. A financial institution can use the annual notice exception if it does the following:
   1. The financial institution does not disclose nonpublic personal information of consumers to third parties, other than disclosures that are exempt; and’
   2. The financial institution has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers. (15 U.S.C. Section 6801 et seq.)
2. Establishes the IIPPA and provides various rights to individuals, applicants, policyholders, and insureds pursuant to the IIPPA. (Insurance (Ins.) Code, Section 791 et seq.)
3. Requires an insurer to provide a notice of information practices to all applicants or policyholders in connection with insurance transactions when personal information is collected only from the applicant; an insured under the policy; from public records; or from a source other than the applicant, as specified. The required notice shall generally be in writing and state all of the following, among other things:
   1. Whether personal information may be collected from persons other than the individual or individuals proposed for coverage;
   2. The types of personal information that may be collected and the types of sources and investigative techniques that may be used to collect such information;
   3. The types of disclosures of a person’s personal information that may be made without prior authorization, as specified;
   4. A description of the right to access and correct one’s personal information, the right to know with whom one’s personal information was shared, the right to know the source of the personal information, and the manner in which the rights may be exercised; and,
   5. That information obtained from a report prepared by an insurance-support organization, as defined, may be retained by the insurance-support organization and disclosed to other persons. (Ins. Code, Section 791.04.)
4. Authorizes the Insurance Commissioner to examine and investigate the affairs of every insurer in this state, issue cease and desist orders after a noticed hearing, and impose penalties for violations of cease and desist orders as follows:
   1. A monetary fine of not more than $10,000 for each violation.
   2. A monetary fine of not more than $50,000 if the Commissioner finds that violations have occurred with such frequency as to constitute a general business practice.
   3. Suspension or revocation of an insurance institution or agent’s license if the insurance institution or agent knew or reasonably should have known it was in violation of the IIPPA. (Ins. Code, Sections 791.14, 791.17, and 791.19.)
5. Authorizes an individual whose right to access, or right to collect, amend, or delete their personal information was violated to bring an action for appropriate equitable relief in any court of competent jurisdiction. (Ins. Code, Section 791.20.)

FISCAL EFFECT: Unknown

COMMENTS:

Purpose: According to the Author,

Notices to consumers are only effective so long as they are meaningful. A phenomenon has been noted that the more frequent, numerous, lengthy notices are the less likely consumers are to read them. Given the importance of privacy notices, it is critical that notice for privacy rights be enacted and distributed in a manner most likely to inform consumers. In 2015 the federal government adopted an amendment to the Graham-Leech Bliley Act (GLBA), the federal privacy protection act that insurers are beholden to, which would allow insurers to send their annual GLBA notices only when there is a change to the privacy policy. The intent is to flag to consumers that there is a change and that the notice requires their attention. California is one of three states that has not adopted the amendment to the GLBA, frequently referred to as the FAST Act amendment. SB 793 would remedy this and integrate the amendment into California law, and require that an abbreviate privacy notice be sent to consumers to ensure there is continuous notice of how to access the full description of rights.

Existing state law requires that insurers send privacy notices to their customers annually but in 2015, the federal government adopted an amendment to the GLBA authorizing insurance companies to send their annual notices only when there is a change to their underlying privacy policy. The intent is to flag for consumers that there is a change and that the notice requires their attention. This bill proposes to make that conforming change by requiring that privacy notices be provided initially to new policyholders and then only sent when the privacy policy changes. California is one of the last states to not update statute to reflect federal law.

This bill would reduce the number of privacy notifications that insurers are required to send to their policyholders. Specifically, after providing new policyholders with a copy of their privacy policy once, an insurer would no longer have to send a copy of the privacy policy annually to its customers, if i) the privacy policy has not changed, ii) the insurer makes the information easily available on its website, and iii) the insurer does not provide medical, privileged or personal information to unaffiliated third parties. Given that this change conforms to federal law and that consumers often may not read lengthy annual privacy notices, this appears to be a sensible policy that will benefit both insurers and those they insure. Ideally, if this bill is enacted, customers will be aware that something has changed when they receive notices. Further, by requiring that detailed information be easily accessible on insurers’ websites, this bill ensures that policyholders can still access privacy policies should the need arise.

Background: The IIPPA provides protections for consumers’ personally identifiable information, which is generally provided to an agent, broker, or insurer when applying for insurance or submitting a claim. The IIPPA is enforced by the Insurance Commissioner (Commissioner) who has the authority to issue cease and desist orders for violations of the IIPPA. Any person who violates a cease and desist order may be subject to a fine of not more than $10,000 for each violation, or up to $50,000 if the Commissioner finds that violations have occurred with such frequency as to constitute a general business practice.

Under the IIPPA, individuals have the right to access the personal information recorded about them by insurers. However, the IIPPA requires that the requested information be “reasonably locatable and retrievable” by the insurer. The IIPPA also gives individuals the right to delete, correct, and amend this personal information. However, insurers can refuse to comply with the request. Under the IIPPA, the insurer must notify a policyholder of the reason it is refusing to delete, correct, or amend the information in question. If an insurer refuses to do so, it must inform the individual that they can file a statement setting forth what information the individual thinks is correct, as well as the reasons why the individual disagrees with the insurer’s refusal to delete, correct, or amend. In any subsequent disclosure of the personal information, the insurer is required to disclose the statement as well. The IIPPA also lets individuals opt-out of the sharing of their personal information for marketing purposes.

IIPPA requires insurers to provide individuals with a “Privacy Notice” that describes the entities’ practices and policies regarding privacy, the kind of information collected in connection with an application for insurance, submission of a claim, or other insurance transaction; how and with whom personally identifiable information will be shared, and rights to restrict that sharing.

Previous Legislation: AB 2372 (Calderon) (2021-2022 Legislative Session) This bill would have required an insurance institution or agent (insurer) to provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship, and exempts insurers who do not share personal information for marketing purposes from this requirement, as long as additional information about consumer rights is included in the insurer’s abbreviated annual notice. Died on Senate Inactive File.

Double-referral: This measure passed out of the Assembly Privacy and Consumer Protection Committee on June 13, 2023 on the consent calendar.

REGISTERED SUPPORT / OPPOSITION:

Support

Personal Insurance Federation of California

Opposition

None on file.

Analysis Prepared by: Kathleen O'Malley / INS. / (916) 319-2086

Date of Hearing: June 13, 2023

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Jesse Gabriel, Chair

SBPCA Bill Id:SB 793

Author:(Glazer) – As Amended Ver:April 17, 2023

PROPOSED CONSENT

SENATE VOTE: 39-0

SUBJECT: Insurance: privacy notices and personal information

SYNOPSIS

In 2015, the federal government amended the privacy notice requirements in the Financial Modernization Act of 1999, more commonly known as the “Gramm-Leach-Bliley Act” (GLBA), to reduce the requirements imposed on financial institutions, including insurers. Prior to the amendment, GLBA required privacy notices to be sent to consumers annually. Unfortunately, it has been determined that the more frequent, numerous, and lengthy that notices are, the less likely consumers are to read them. In response, the GLBA was amended to require that after the initial notice is sent to consumers, follow up notices only need to be sent when there is a change to the privacy policy. The intent is to flag for consumers that something has changed and that the notice requires their attention.

However, California’s Insurance Information and Privacy Protection Act (IIPPA) continues to require insurers to send notices annually. According to the author, California is one of three remaining states that has not updated their requirements to conform to the GLBA amendment.

This bill, supported by the Personal Insurance Federation of California and other groups, updates the requirements in the IIPPA to conform to those in the GLBA. There is no opposition on file to this measure.

If passed by this Committee, this bill will next be heard by the Assembly Insurance Committee.

SUMMARY: Allows for an insurer to send privacy policy notices once initially and thereafter only when a change has been made in the policy to satisfy the privacy notice requirements of the Insurance Information and Privacy Protection Act. Specifically, this bill:

1. Requires an insurer to provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually, as that term is defined, during the continuation of the customer relationship
2. States that the required notice must comply with applicable California regulations specifying the information to be included in insurance privacy notices.
3. Deems that an insurance agent or broker has met the notification requirements if it meets all of the following conditions:
   1. The insurer does not provide medical record, personal, or privileged information to a nonaffiliated third party, as specified.
   2. The insurer provides, as part of an abbreviated notice, the internet website address for the insurer’s privacy notice and informs the consumer in a clear and conspicuous matter all of the following:
      1. The consumer’s right to submit a written request to access, correct, amend, or delete their personal information and the manner in which the right may be exercised.
      2. The right to receive a response within 30 business days of the consumer submitting a request to access, correct, amend, or delete their personal information.
      3. If the insurer refuses the consumer’s request, the right to file a statement regarding what the consumer believes to be accurate and fair information and why the consumer disagrees with the insurance institution’s refusal.
   3. The insurer’s policies and practices about disclosing personal or privileged information have not changed from the previous notice provided.
4. Clarifies that an insurer or agent is not required to provide a notice to a former customer with whom it no longer has a continuing relationship.

EXISTING LAW:

1. Provides financial institutions, pursuant to the Gramm-Leach-Bliley Act (GLBA), a federal law to which insurers are subject that includes privacy provisions, with an exemption to the requirement to deliver an annual privacy notice. A financial institution can use the annual notice exception if it does the following:
   1. The financial institution does not disclose nonpublic personal information of consumers to third parties, other than disclosures that are exempt; and
   2. The financial institution has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers. (15 U.S.C. § 6801 et seq.)
2. Establishes the Insurance Information and Privacy Protection Act (IIPPA) and provides various rights to individuals, applicants, policyholders, and insureds pursuant to the IIPPA. (Ins. Code § 791 et seq.)
3. Requires an insurer to provide a notice of information practices to all applicants or policyholders in connection with insurance transactions when personal information is collected only from the applicant; an insured under the policy; from public records; or from a source other than the applicant, as specified. The required notice shall generally be in writing and state all of the following, among other things:
   1. Whether personal information may be collected from persons other than the individual or individuals proposed for coverage.
   2. The types of personal information that may be collected and the types of sources and investigative techniques that may be used to collect such information.
   3. The types of disclosures of a person’s personal information that may be made without prior authorization, as specified.
   4. A description of the right to access and correct one’s personal information, the right to know with whom one’s personal information was shared, the right to know the source of the personal information, and the manner in which the rights may be exercised.
   5. That information obtained from a report prepared by an insurance-support organization, as defined, may be retained by the insurance-support organization and disclosed to other persons. (Ins. Code § 791.04.)
4. Authorizes the Insurance Commissioner to examine and investigate the affairs of every insurer in this state, issue cease and desist orders after a noticed hearing, and impose penalties for violations of cease and desist orders as follows:
   1. A monetary fine of not more than $10,000 for each violation.
   2. A monetary fine of not more than $50,000 if the Commissioner finds that violations have occurred with such frequency as to constitute a general business practice.
   3. Suspension or revocation of an insurance institution’s or agent’s license if the insurance institution or agent knew or reasonably should have known it was in violation of the IIPPA. (Ins. Code §§ 791.14, 791.17, and 791.19.)
5. Authorizes an individual whose right to access, or right to collect, amend, or delete their personal information was violated to bring an action for appropriate equitable relief in any court of competent jurisdiction. (Ins. Code § 791.20.)
6. Specifies by regulation the information to be included in privacy notices. (Cal. Code Regs., tit. 10, § 2689.7.)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS:

1) Purpose of the bill. Current state law requires that insurance companies send privacy notices to their customers annually. Unfortunately, the more frequently that lengthy notices are sent, the less likely they are to be read by consumers. Recognizing this, in 2015, the federal government adopted an amendment to the Gramm-Leech-Bliley Act (GLBA) authorizing insurance companies to send their annual notices only when there is a change to their underlying privacy policy. The intent is to flag for consumers that there is a change and that the notice requires their attention. According to the author, California is one of three states that has not adopted that policy into its state laws. This bill proposes to make that conforming change by requiring that privacy notices be provided initially to new customers and then only sent when the privacy policy changes.

2) Author’s statement. According to the author:

Notices to consumers are only effective so long as they are meaningful. A phenomenon has been noted that the more frequent, numerous, lengthy notices are the less likely consumers are to read them. Given the importance of privacy notices, it is critical that notice for privacy rights be enacted and distributed in a manner most likely to inform consumers. In 2015 the federal government adopted an amendment to the Gramm-Leech Bliley Act (GLBA), the federal privacy protection act that insurers are beholden to, which would allow insurers to send their annual GLBA notices only when there is a change to the privacy policy. The intent is to flag to consumers that there is a change and that the notice requires their attention. California is one of three states that has not adopted the amendment to the GLBA, frequently referred to as the FAST Act amendment. SB 793 would remedy this and integrate the amendment into California law, and also require that an abbreviate privacy notice be sent to consumers to ensure there is continuous notice of how to access the full description of rights.

3) Background law. California’s Insurance Information and Privacy Protection Act (IIPPA), Insurance Code §§ 791-791.29, provides protections for consumers’ personally identifiable information, which is generally provided to an agent, broker, or insurance company (insurer) when applying for insurance or submitting a claim. The IIPPA is enforced by the Insurance Commissioner, who has the authority to issue cease and desist orders for violations of the IIPPA. (Ins. Code § 791.17.) Any person who violates a cease and desist order may be subject to a fine of not more than $10,000 for each violation, or up to $50,000 if the commissioner finds that violations have occurred with such frequency as to constitute a general business practice. (Ins. Code § 791.19.)

Under the IIPPA, individuals have the right to access the personal information recorded about them by insurers. However, the IIPPA requires that the requested information be “reasonably locatable and retrievable” by the insurer. (Ins. Code § 791.08.) The IIPPA also gives individuals the right to delete, correct, and amend this personal information. However, insurers can refuse to comply with the request. Under the IIPPA, the insurer must notify a consumer of the reason it is refusing to delete, correct, or amend the information in question. If an insurer refuses to do so, it must inform the individual that they can file a statement setting forth what information the individual thinks is correct, as well as the reasons why the individual disagrees with the insurer’s refusal to delete, correct, or amend. In any subsequent disclosure of the personal information, the insurer is required to disclose the statement as well. (Ins. Code § 791.09.)

The IIPPA also lets individuals opt-out of the sharing of their personal information for marketing purposes. (Ins. Code § 791.13.)

Under the IIPPA, insurers must provide individuals with a “Privacy Notice” that describes the entities’ practices and policies regarding privacy, the kind of information collected in connection with an application for insurance, submission of a claim, or other insurance transaction; how and with whom personally identifiable information will be shared, and rights to restrict that sharing. (Ins. Code § 791.04.)

At the federal level, the Financial Modernization Act of 1999, more commonly known as the “Gramm-Leach-Bliley Act,” was signed by President Clinton on November 12, 1999. The GLBA requires financial institutions (companies that offer consumers financial products or services like loans, financial or investment advice, or insurance) to explain their information-sharing practices to their customers and to safeguard sensitive data. When it was enacted, the GLBA, among other things, required that financial institutions provide their customers with initial and annual notices regarding their privacy practices, and allow their customers to opt out of sharing their information with certain nonaffiliated third parties.

On December 4, 2015, Congress amended the GLBA as part of the Fixing America’s Surface Transportation (FAST) Act (Pub. L. No. 114-94). As noted previously, the FAST Act amendment eliminated the annual privacy notice requirement for financial institutions, including insurers, that satisfy two criteria:

• The financial institution does not share nonpublic personal information with nonaffiliated third parties except pursuant to certain GLBA exceptions permitting such disclosures; and
• The financial institution has also not changed its privacy policy and procedures since the most recent GLBA privacy notice sent to consumers.

4) What this bill would do. As noted previously, this bill would reduce the number of privacy notifications that insurers are required to send to their customers. Specifically, after providing new customers with a copy of their privacy policy once, an insurer would no longer have to send a copy of the privacy policy annually to its customers, if i) the privacy policy has not changed, ii) the insurer makes the information easily available on its website, and iii) the insurer does not provide medical, privileged or personal information to unaffiliated third parties. Given that this change conforms to federal law and that consumers often may not read lengthy annual privacy notices, this appears to be a sensible policy that will benefit both insurers and those they insure. Ideally, if this bill is enacted, customers will be aware that something has changed when they receive notices. Further, by requiring that detailed information be easily accessible on insurers’ websites, this bill insures that customers can still access privacy policies should the need arise.

5) Related legislation. AB 2372 (Calderon, 2022) was nearly identical to this bill, except that it required a more holistic description of a consumer’s legal rights with regard to their information. The bill was not taken up for a vote on the Senate Floor and died on the Inactive File.

ARGUMENTS IN SUPPORT. In support, the Personal Insurance Federation of California writes:

Every year, California insurance companies send out millions of the required annual notices, including a summary of plan coverage and privacy notices. This results in unnecessary, confusing, and costly paper notices going out every year.

[. . .]

SB 793 will update California law to conform with the 2015 GLBA amendments and allow insurers to send notices on the privacy policy only when a change has been made to the privacy policy. The change touches only the paper notices and does not affect requirements ensuring that the notice is available online and at the request of the consumer, or the requirement to provide other annual notices.

REGISTERED SUPPORT / OPPOSITION:

Support

American Council of Life Insurers
American Property Casualty Insurance Association
Association of California Life and Health Insurance Companies (ACLHIC)
Pacific Association of Domestic Insurance Companies
Personal Insurance Federation of California

Opposition

None on file

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

Date of Hearing: June 13, 2023

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Jesse Gabriel, Chair

SBPCA Bill Id:SB 793

Author:(Glazer) – As Amended Ver:April 17, 2023

PROPOSED CONSENT

SENATE VOTE: 39-0

SUBJECT: Insurance: privacy notices and personal information

SYNOPSIS

In 2015, the federal government amended the privacy notice requirements in the Financial Modernization Act of 1999, more commonly known as the “Gramm-Leach-Bliley Act” (GLBA), to reduce the requirements imposed on financial institutions, including insurers. Prior to the amendment, GLBA required privacy notices to be sent to consumers annually. Unfortunately, it has been determined that the more frequent, numerous, and lengthy that notices are, the less likely consumers are to read them. In response, the GLBA was amended to require that after the initial notice is sent to consumers, follow up notices only need to be sent when there is a change to the privacy policy. The intent is to flag for consumers that something has changed and that the notice requires their attention.

However, California’s Insurance Information and Privacy Protection Act (IIPPA) continues to require insurers to send notices annually. According to the author, California is one of three remaining states that has not updated their requirements to conform to the GLBA amendment.

This bill, supported by the Personal Insurance Federation of California, updates the requirements in the IIPPA to conform to those in the GLBA. There is no opposition on file to this measure.

If passed by this Committee, this bill will next be heard by the Assembly Insurance Committee.

SUMMARY: Allows for an insurer to send privacy policy notices once initially and thereafter only when a change has been made in the policy to satisfy the privacy notice requirements of the Insurance Information and Privacy Protection Act. Specifically, this bill:

1. Requires an insurer to provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually, as that term is defined, during the continuation of the customer relationship
2. States that the required notice must comply with applicable California regulations specifying the information to be included in insurance privacy notices.
3. Deems that an insurance agent or broker has met the notification requirements if it meets all of the following conditions:
   1. The insurer does not provide medical record, personal, or privileged information to a nonaffiliated third party, as specified.
   2. The insurer provides, as part of an abbreviated notice, the internet website address for the insurer’s privacy notice and informs the consumer in a clear and conspicuous matter all of the following:
      1. The consumer’s right to submit a written request to access, correct, amend, or delete their personal information and the manner in which the right may be exercised.
      2. The right to receive a response within 30 business days of the consumer submitting a request to access, correct, amend, or delete their personal information.
      3. If the insurer refuses the consumer’s request, the right to file a statement regarding what the consumer believes to be accurate and fair information and why the consumer disagrees with the insurance institution’s refusal.
   3. The insurer’s policies and practices about disclosing personal or privileged information have not changed from the previous notice provided.
4. Clarifies that an insurer or agent is not required to provide a notice to a former customer with whom it no longer has a continuing relationship.

EXISTING LAW:

1. Provides financial institutions, pursuant to the Gramm-Leach-Bliley Act (GLBA), a federal law to which insurers are subject that includes privacy provisions, with an exemption to the requirement to deliver an annual privacy notice. A financial institution can use the annual notice exception if it does the following:
   1. The financial institution does not disclose nonpublic personal information of consumers to third parties, other than disclosures that are exempt; and
   2. The financial institution has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers. (15 U.S.C. § 6801 et seq.)
2. Establishes the Insurance Information and Privacy Protection Act (IIPPA) and provides various rights to individuals, applicants, policyholders, and insureds pursuant to the IIPPA. (Ins. Code § 791 et seq.)
3. Requires an insurer to provide a notice of information practices to all applicants or policyholders in connection with insurance transactions when personal information is collected only from the applicant; an insured under the policy; from public records; or from a source other than the applicant, as specified. The required notice shall generally be in writing and state all of the following, among other things:
   1. Whether personal information may be collected from persons other than the individual or individuals proposed for coverage.
   2. The types of personal information that may be collected and the types of sources and investigative techniques that may be used to collect such information.
   3. The types of disclosures of a person’s personal information that may be made without prior authorization, as specified.
   4. A description of the right to access and correct one’s personal information, the right to know with whom one’s personal information was shared, the right to know the source of the personal information, and the manner in which the rights may be exercised.
   5. That information obtained from a report prepared by an insurance-support organization, as defined, may be retained by the insurance-support organization and disclosed to other persons. (Ins. Code § 791.04.)
4. Authorizes the Insurance Commissioner to examine and investigate the affairs of every insurer in this state, issue cease and desist orders after a noticed hearing, and impose penalties for violations of cease and desist orders as follows:
   1. A monetary fine of not more than $10,000 for each violation.
   2. A monetary fine of not more than $50,000 if the Commissioner finds that violations have occurred with such frequency as to constitute a general business practice.
   3. Suspension or revocation of an insurance institution’s or agent’s license if the insurance institution or agent knew or reasonably should have known it was in violation of the IIPPA. (Ins. Code §§ 791.14, 791.17, and 791.19.)
5. Authorizes an individual whose right to access, or right to collect, amend, or delete their personal information was violated to bring an action for appropriate equitable relief in any court of competent jurisdiction. (Ins. Code § 791.20.)
6. Specifies by regulation the information to be included in privacy notices. (Cal. Code Regs., tit. 10, § 2689.7.)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS:

1) Purpose of the bill. Current state law requires that insurance companies send privacy notices to their customers annually. Unfortunately, the more frequently that lengthy notices are sent, the less likely they are to be read by consumers. Recognizing this, in 2015, the federal government adopted an amendment to the Gramm-Leech-Bliley Act (GLBA) authorizing insurance companies to send their annual notices only when there is a change to their underlying privacy policy. The intent is to flag for consumers that there is a change and that the notice requires their attention. According to the author, California is one of three states that has not adopted that policy into its state laws. This bill proposes to make that conforming change by requiring that privacy notices be provided initially to new customers and then only sent when the privacy policy changes.

2) Author’s statement. According to the author:

Notices to consumers are only effective so long as they are meaningful. A phenomenon has been noted that the more frequent, numerous, lengthy notices are the less likely consumers are to read them. Given the importance of privacy notices, it is critical that notice for privacy rights be enacted and distributed in a manner most likely to inform consumers. In 2015 the federal government adopted an amendment to the Gramm-Leech Bliley Act (GLBA), the federal privacy protection act that insurers are beholden to, which would allow insurers to send their annual GLBA notices only when there is a change to the privacy policy. The intent is to flag to consumers that there is a change and that the notice requires their attention. California is one of three states that has not adopted the amendment to the GLBA, frequently referred to as the FAST Act amendment. SB 793 would remedy this and integrate the amendment into California law, and also require that an abbreviate privacy notice be sent to consumers to ensure there is continuous notice of how to access the full description of rights.

3) Background law. California’s Insurance Information and Privacy Protection Act (IIPPA), Insurance Code §§ 791-791.29, provides protections for consumers’ personally identifiable information, which is generally provided to an agent, broker, or insurance company (insurer) when applying for insurance or submitting a claim. The IIPPA is enforced by the Insurance Commissioner, who has the authority to issue cease and desist orders for violations of the IIPPA. (Ins. Code § 791.17.) Any person who violates a cease and desist order may be subject to a fine of not more than $10,000 for each violation, or up to $50,000 if the commissioner finds that violations have occurred with such frequency as to constitute a general business practice. (Ins. Code § 791.19.)

Under the IIPPA, individuals have the right to access the personal information recorded about them by insurers. However, the IIPPA requires that the requested information be “reasonably locatable and retrievable” by the insurer. (Ins. Code § 791.08.) The IIPPA also gives individuals the right to delete, correct, and amend this personal information. However, insurers can refuse to comply with the request. Under the IIPPA, the insurer must notify a consumer of the reason it is refusing to delete, correct, or amend the information in question. If an insurer refuses to do so, it must inform the individual that they can file a statement setting forth what information the individual thinks is correct, as well as the reasons why the individual disagrees with the insurer’s refusal to delete, correct, or amend. In any subsequent disclosure of the personal information, the insurer is required to disclose the statement as well. (Ins. Code § 791.09.)

The IIPPA also lets individuals opt-out of the sharing of their personal information for marketing purposes. (Ins. Code § 791.13.)

Under the IIPPA, insurers must provide individuals with a “Privacy Notice” that describes the entities’ practices and policies regarding privacy, the kind of information collected in connection with an application for insurance, submission of a claim, or other insurance transaction; how and with whom personally identifiable information will be shared, and rights to restrict that sharing. (Ins. Code § 791.04.)

At the federal level, the Financial Modernization Act of 1999, more commonly known as the “Gramm-Leach-Bliley Act,” was signed by President Clinton on November 12, 1999. The GLBA requires financial institutions (companies that offer consumers financial products or services like loans, financial or investment advice, or insurance) to explain their information-sharing practices to their customers and to safeguard sensitive data. When it was enacted, the GLBA, among other things, required that financial institutions provide their customers with initial and annual notices regarding their privacy practices, and allow their customers to opt out of sharing their information with certain nonaffiliated third parties.

On December 4, 2015, Congress amended the GLBA as part of the Fixing America’s Surface Transportation (FAST) Act (Pub. L. No. 114-94). As noted previously, the FAST Act amendment eliminated the annual privacy notice requirement for financial institutions, including insurers, that satisfy two criteria:

• The financial institution does not share nonpublic personal information with nonaffiliated third parties except pursuant to certain GLBA exceptions permitting such disclosures; and
• The financial institution has also not changed its privacy policy and procedures since the most recent GLBA privacy notice sent to consumers.

4) What this bill would do. As noted previously, this bill would reduce the number of privacy notifications that insurers are required to send to their customers. Specifically, after providing new customers with a copy of their privacy policy once, an insurer would no longer have to send a copy of the privacy policy annually to its customers, if i) the privacy policy has not changed, ii) the insurer makes the information easily available on its website, and iii) the insurer does not provide medical, privileged or personal information to unaffiliated third parties. Given that this change conforms to federal law and that consumers often may not read lengthy annual privacy notices, this appears to be a sensible policy that will benefit both insurers and those they insure. Ideally, if this bill is enacted, customers will be aware that something has changed when they receive notices. Further, by requiring that detailed information be easily accessible on insurers’ websites, this bill insures that customers can still access privacy policies should the need arise.

5) Related legislation. AB 2372 (Calderon, 2022) was nearly identical to this bill, except that it required a more holistic description of a consumer’s legal rights with regard to their information. The bill was not taken up for a vote on the Senate Floor and died on the Inactive File.

ARGUMENTS IN SUPPORT. In support, the Personal Insurance Federation of California writes:

Every year, California insurance companies send out millions of the required annual notices, including a summary of plan coverage and privacy notices. This results in unnecessary, confusing, and costly paper notices going out every year.

[. . .]

SB 793 will update California law to conform with the 2015 GLBA amendments and allow insurers to send notices on the privacy policy only when a change has been made to the privacy policy. The change touches only the paper notices and does not affect requirements ensuring that the notice is available online and at the request of the consumer, or the requirement to provide other annual notices.

REGISTERED SUPPORT / OPPOSITION:

Support

Personal Insurance Federation of California

Opposition

None on file

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

 CONSENT  

Bill No: SB 793

Author: Glazer (D)

Amended: 4/17/23

Vote: 21

SENATE INSURANCE COMMITTEE: 7-0, 4/12/23

AYES: Rubio, Nguyen, Alvarado-Gil, Dodd, Jones, Niello, Portantino

SENATE JUDICIARY COMMITTEE: 11-0, 4/25/23

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Min, Niello, Stern, Wiener

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

SUBJECT: Insurance: privacy notices and personal information

SOURCE: Author

DIGEST:

This bill allows for an insurer to send privacy policy notices once initially and thereafter only when a change has been made in the policy to satisfy the privacy notice requirements of the Insurance Information and Privacy Protection Act (IIPPA).

ANALYSIS: Existing law requires insurers to provide timely notices regarding information practices and annual privacy notices to consumers. IIPPA regulations lay out the guidelines for when these notices are required and what is required to be included in them. At the federal level, the Graham-Leech Bliley Act (GLBA) also requires insurers to send specified privacy notices at certain points.

This bill allows for an insurer to send privacy policy notices once initially and thereafter only when a change has been made in the policy to satisfy the privacy notice requirements of the IIPPA.

Comments

In 2015 the federal government adopted an amendment to the GLBA, as part of the Fixing America’s Surface Transportation Act (FAST Act), which would allow insurers to send their annual GLBA notices only when there is a change to the privacy policy. The intent is to flag to consumers that there is a change and that the notice requires their attention. California is one of three states that has not adopted the amendment to the GLBA, frequently referred to as the FAST Act amendment. SB 793 would integrate the amendment into California law. This bill also requires certain rights to be specified for the consumer in the notice.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT: (Verified 5/9/23)

OPPOSITION: (Verified 5/9/23)

None received

ARGUMENTS IN SUPPORT: The American Property Casualty Insurance Association argues that SB 793 will bring California insurance law into line with GLBA and changes made in many other states’ insurance privacy laws by requiring insurers to send privacy police policy notices once initially and thereafter only when a change has been made in the policy. They emphasize that this does not change the requirement that an insurer’s privacy policy be available online and that it be provided at any time at a customer’s request. This change is a consumer-friendly one in that it will reduce the deluge of privacy notices consumers receive and will more effectively call their attention to notices they do receive when a privacy policy has changed.

According to Personal Insurance Federation of California, ensuring consumers receive the additional privacy notices only when there is a change in the existing privacy policy will not only reduce paper mail waste but will help reduce consumer

confusion by focusing their attention on notices that actually include important changes to their privacy policy.

Prepared by: Jill Rice / INS. / (916) 651-4110

5/10/23 15:34:58

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: SB 793 (Author:Glazer)

Version: April 17, 2023

Hearing Date: April 25, 2023

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Insurance: privacy notices and personal information

DIGEST

This bill codifies an existing regulation requiring insurers to provide annual privacy notices to customers. However, it eliminates this requirement for insurers meeting certain conditions.

EXECUTIVE SUMMARY

The Insurance Information and Privacy Protection Act (IIPPA) establishes standards for the collection, use and disclosure of information gathered in connection with insurance transactions and seeks to maintain a balance between the need for information by those conducting the business of insurance and the public’s need for fairness in insurance information practices. To this end, the IIPPA requires certain consumer protections be afforded in connection with information exchanged between insurance companies and their policyholders.

Insurers are required to provide timely notices regarding information practices and annual privacy notices to consumers. IIPPA regulations lay out the guidelines for when these notices are required and what is required to be included in them. At the federal level, the Graham-Leech Bliley Act (GLBA) also requires insurers to send specified privacy notices at certain points.

This bill seeks to codify a change to the GLBA that loosens the regulatory requirement that insurers provide annual notices to customers. The bill also narrows what is required to be provided under the joint privacy notices pursuant to the IIPPA.

This bill is author-sponsored. It is supported by various insurance company associations, including the Personal Insurance Federation of California. There is no known opposition. This bill passed out of the Senate Insurance Committee on a 7 to 0 vote.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Establishes the Insurance Information and Privacy Protection Act (IIPPA), to establish standards for the collection, use, and disclosure of information gathered in connection with insurance transactions and to maintain a balance between the need for information by those conducting the business of insurance and the public’s need for fairness in insurance information practices. (Ins. Code § 791.)
2. Requires an insurance institution or agent to provide a notice of information practices to all applicants or policyholders in connection with insurance transactions at the time of delivery or initial data collection and at the point of renewal, reinstatement, and change in benefits, as provided. (Ins. Code § 791.04.)
3. Authorizes an insurer to disclose personal or privileged information about an individual, which is collected or received in connection with an insurance transaction, as provided. This includes the authority to share personal or privileged information about an individual with an unaffiliated third party whose only use of the information will be in connection with the marketing of a product or service, as long as the individual is given an opportunity to opt out of this information-sharing. (Ins. Code § 791.13.)
4. Requires, pursuant to IIPPA regulations, that insurers provide a notice that accurately reflects its privacy policies and practices at the initiation of the customer relationship, annually thereafter, and when certain revisions are necessary. (10 C.C.R. §§ 2689.5, 2689.6, 2689.9.) The notices must include certain minimum information. (10 C.C.R. § 2689.7.)

This bill:

1. Codifies the annual notice requirement laid out in 10 C.C.R. § 2689.6.
2. Provides that an insurance institution or agent shall be deemed to comply with this requirement if all of the following conditions are met:
   1. the insurance institution or agent does not provide medical-record, personal, or privileged information to a nonaffiliated third party pursuant to Section 791.13(k);
   2. the insurance institution or agent additionally provides, as part of any abbreviated notice provided pursuant to Section 791.04, the internet website address to the insurance institution’s or agent’s complete privacy notice that complies with the underlying regulation and informs the consumer of each of the following rights in a clear and conspicuous manner:
      1. the right to submit a written request to access, correct, amend, or delete the consumer’s personal information and the manner in which the right may be exercised, including the contact information and the mailing address, internet website address, or both, where the consumer may submit a request;
      2. the right to receive a response within 30 business days of the consumer submitting a request to access, correct, amend, or delete their personal information;
      3. if the insurance institution refuses the consumer’s request, the right to file a statement regarding what the consumer believes to be accurate and fair information and why the consumer disagrees with the insurance institution’s refusal.
   3. the insurance institution’s or agent’s policies and practices about disclosing personal or privileged information have not changed from the previous notice provided.
3. Provides that an insurance institution is not required to provide the notice to a former customer with whom it no longer has a continuing relationship.

COMMENTS

1. Privacy notices under the IIPPA and its regulations

The IIPPA was established with several central purposes:

• to establish standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents or insurance–support organizations;
• to maintain a balance between the need for information by those conducting the business of insurance and the public’s need for fairness in insurance information practices, including the need to minimize intrusiveness;
• to establish a regulatory mechanism to enable natural persons to ascertain what information is being or has been collected about them in connection with insurance transactions and to have access to such information for the purpose of verifying or disputing its accuracy;
• to limit the disclosure of information collected in connection with insurance transactions; and
• to enable insurance applicants and policyholders to obtain the reasons for any adverse underwriting decision.

The IIPPA and its attendant regulations carefully outline requirements for insurance companies and agents to provide consumers privacy notices at various points during the customer relationship.

One regulation requires an initial privacy notice. A licensee must “provide a clear and conspicuous notice that accurately reflects its privacy policies and practices” to a customer at the point when a customer relationship is established, except as provided.^[1] This must happen before any nonpublic personal information is disclosed to a nonaffiliated third party.

Beyond that initial contact point, regulations require insurers to provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship.^[2] The regulations also provide for revised notices when certain disclosures of personal information about a consumer are planned.^[3]

The regulations dictate the minimum information that needs to go into these initial, annual, and revised notices. Some of the required components are:

• the categories of nonpublic personal information that the licensee collects;
• the categories of nonpublic personal information that the licensee discloses;
• the categories of affiliates and nonaffiliated third parties to whom the licensee discloses nonpublic personal information, and the general types of businesses in which the third parties engage, as provided;
• if a licensee wishes to disclose or reserve the right to disclose nonpublic personal financial information to an affiliate for marketing purposes without affirmative authorization or the right to opt out of that disclosure, a statement explaining that the licensee may disclose nonpublic personal financial information to affiliates for marketing purposes without obtaining prior authorization and the law does not allow customers to restrict that disclosure;
• an explanation of the consumer's right to opt out of the disclosure of nonpublic personal financial information to nonaffiliated third parties, including the methods by which the consumer may exercise that right at that time;
• the licensee's policies and practices with respect to protecting the confidentiality and security of nonpublic personal information, including a general description as to who is authorized to have access to the information; and
• if applicable, a statement that the consumer has the right to access and request correction of recorded nonpublic personal information and a brief description of the manner in which those rights may be exercised.^[4]

These notice regulations all make clear that they are in addition to any notices required by Section 791.04 of the Insurance Code. However, they provide for both notices to be provided in a single combined notice meeting both sets of requirements. Section 791.04 requires an insurance institution or agent to provide a notice of information practices to all applicants or policyholders in connection with insurance transactions. This must happen at the time of delivery of the policy or certificate when personal information is collected from the applicant, an insured, or from public records. Otherwise, it must be provided at the point of collection from other sources.

Section 791.04 also requires provision of the notice of information practices upon renewal, reinstatement, or a change in benefits unless personal information is only collected from the policyholder, insured, or public records, or notice has already been given in the preceding 24 months.

The Section 791.04 notice must be in writing and state specified information, including whether personal information may be collected from persons other than the individual, the types of personal information that may be collected and disclosed, and a description of the individual’s rights. However, in lieu of this detailed notice, insurers are authorized to provide an abbreviated notice informing the applicant or policyholder that personal information may be collected from other sources and disclosed without authorization, and that the applicant or policyholder has the right to access and correct all personal information collected and to request a detailed notice of information practices.

1. Codifying and carving out IIPPA regulations

This bill codifies the GLBA regulation regarding annual notices to customers. However, subdivision (c) in the bill exempts insurance institutions and agents from the requirement if the following conditions are met:

• the insurance institution or agent does not provide medical-record, personal, or privileged information to a nonaffiliated third party;
• the insurance institution or agent additionally provides, as part of the abbreviated notice (discussed above), the internet website address to the insurance institution’s or agent’s complete privacy notice that complies with the underlying regulation and informs the consumer of specified rights in a clear and conspicuous manner; and
• the insurance institution’s or agent’s policies and practices about disclosing personal or privileged information have not changed from the previous annual notice.

The description of rights is not a full and complete description of the rights that consumers have under the IIPPA. The abbreviated notice must notify consumers that they have the right to submit a written request to access, correct, amend, or delete the consumer’s personal information and the manner in which the right may be exercised. This must include the contact information and the mailing address, internet website address, or both, where the consumer may submit a request. Consumers must also be notified that they have the right to receive a response within 30 business days of the consumer submitting a request to access, correct, amend, or delete their personal information, and if the insurance institution refuses the consumer’s request, the right to file a statement regarding what the consumer believes to be accurate and fair information in support of their request and why the consumer disagrees with the insurance institution’s refusal.

According to the author:

Notices to consumers are only effective so long as they are meaningful. A phenomenon has been noted that the more frequent, numerous, lengthy notices are the less likely consumers are to read them. Given the importance of privacy notices, it is critical that notice for privacy rights be enacted and distributed in a manner most likely to inform consumers. In 2015 the federal government adopted an amendment to the Graham-Leech Bliley Act (GLBA), the federal privacy protection act that insurers are beholden to, which would allow insurers to send their annual GLBA notices only when there is a change to the privacy policy. The intent is to flag to consumers that there is a change and that the notice requires their attention. California is one of three states that has not adopted the amendment to the GLBA, frequently referred to as the FAST Act amendment. SB 793 would remedy this and integrate the amendment into California law, and also require that an abbreviate privacy notice be sent to consumers to ensure there is continuous notice of how to access the full description of rights.

This change in the law is based loosely on changes made to the GLBA at the federal level, which eliminated the requirement for insurers to send annual GLBA privacy notices in most instances. AB 2372 (Calderon, 2022) was nearly identical to the existing bill. However, it required a more holistic description of a consumer’s legal rights with regard to their information. The bill was not taken up for a vote on the Senate Floor and died on the Inactive File.

Writing in support, a coalition of insurance company associations, including the American Property Casualty Insurance Association, asserts:

California’s requirements for consumer privacy notices were prompted, in part, by the federal Gramm-Leach-Bliley Act (GLBA), which was enacted in 1999. That statute sets forth certain privacy requirements for financial institutions, but with respect to insurers, enforcement was left to state insurance regulators. As originally enacted, GLBA required financial institutions to provide consumers with copies of their privacy policies annually. However, over time, both financial institutions and many consumer representatives came to recognize that the provision of annual privacy notices was counterproductive as consumers received so many notices so frequently that they tended to disregard them. As a result, Congress amended GLBA in the Fixing America’s Surface Transportation (FAST) Act in 2015. As amended, GLBA now requires financial institutions to provide consumers with one notice initially and additional notices thereafter only when there is a change in the privacy policies (provided the insurer shares nonpublic personal information with nonaffiliated third parties only in accordance with existing state regulations and statutes). Otherwise, the federal requirement for annual notices was repealed.

After passage of the federal FAST Act, the National Association of Insurance Commissioners (NAIC) followed with corresponding amendments to its model bulletin recommending that states adopt the revised privacy notice requirements.

SB 793 will bring California insurance law into line with GLBA, and changes made in many other states’ insurance privacy laws by requiring insurers to send privacy police policy notices once initially and thereafter only when a change has been made in the policy.

It should be noted that while the bill takes away an existing consumer protection, an important condition of the exemption is that the insurer must include, in any abbreviated notice they provide, a description of the consumer’s core rights to access and correct information including the manner in which those rights can be exercised.

SUPPORT

ACLHIC

American Council of Life Insurers

American Property Casualty Insurance Association

Pacific Association of Domestic Insurance Companies

Personal Insurance Federation of California

OPPOSITION

None known

RELATED LEGISLATION

Pending Legislation: None known.

Prior Legislation:

AB 2372 (Calderon, 2022) See Comment 2.

AB 1184 (Chiu, Ch. 190, Stats. 2021) enhanced protections relating to health care service plans and health insurers accommodating requests from subscribers, enrollees, and insureds for the confidential communication of certain medical information. The bill required health plans/insurers to direct all communications regarding a protected individual’s receipt of sensitive health care services directly to the protected individual, and prohibited the disclosure of that information to the policyholder without the authorization of the protected individual.

PRIOR VOTES:

Senate Insurance Committee (Ayes 7, Noes 0)

**************

1. 10 C.C.R. § 2689.5. ↑

2. 10 C.C.R. § 2689.6. ↑

3. 10 C.C.R. § 2689.9. ↑

4. 10 C.C.R. § 2689.7. ↑

SENATE COMMITTEE ON INSURANCE

Senator Susan Rubio, Chair

2023 - 2024 Regular

Bill No: SB 793 Hearing Date: April 12, 2023

SUBJECT: Insurance: privacy notices and personal information

DIGEST:

This bill allows for an insurer to send privacy policy notices once initially and thereafter only when a change has been made in the policy to satisfy the privacy notice requirements of the Insurance Information and Privacy Protection Act (IIPPA).

ANALYSIS:

Existing law:

1) The IIPPA, establishes standards for the collection, use, and disclosure of information gathered by insurers in connection with insurance transactions.

a) Requires an insurer to provide a written notice of information practices to all applicants or policyholders in connection with insurance transactions, as specified.

b) Gives insurers the option of providing a detailed notice or an abbreviated notice. The abbreviated notice (provided in almost all cases by insurers) informs consumers that personal information may be collected from persons other than the individual or individuals proposed for coverage, such information may be disclosed to third parties without authorization in certain circumstances, a right of access and correction exists with respect to all personal information collected, and the detailed notice will be provided to the applicant or policyholder upon request (Insurance Code Section 791.04).

2) Allows an insurer to disclose personal or privileged information about an individual, which is collected or received in connection with an insurance transaction, if the disclosure complies with specified statutory requirements, including that an insurer may share personal or privileged information about an individual with an unaffiliated third party whose only use of the information will be in connection with the marketing of a product or service, as long as the individual is given an opportunity to opt out of this information-sharing.

3) Provides, pursuant to the Graham-Leech Bliley Act (GLBA) the federal privacy protection act to which insurers are beholden, financial institutions an exemption to the requirement under the GLBA to deliver an annual privacy notice. A financial institution can use the annual notice exception if it limits its sharing of customer information so that the customer does not have the right to opt out, and has not changed its privacy notice from the one previously delivered to its customer. This notice is in addition to the IIPPA notice described above but may be provided contemporaneously with the IIPPA notice. If provided, the abbreviated notice must describe a reasonable means by which the consumer may obtain the more detailed notice.

This bill:

Integrates the Graham-Leech Bliley Act (GLBA) amendment into California law by requiring insurers to send privacy policy notices once initially and thereafter only when a change has been made in the policy. This bill also requires certain rights to be specified for the consumer in the notice.

Background

Notices to consumers are only effective so long as they are meaningful. A phenomenon has been noted that the more frequent, numerous, lengthy notices are the less likely consumers are to read them. Given the importance of privacy notices, it is critical that notice for privacy rights be enacted and distributed in a manner most likely to inform consumers. In 2015 the federal government adopted an amendment to the GLBA, as part of the Fixing America’s Surface Transportation Act (FAST Act), which would allow insurers to send their annual GLBA notices only when there is a change to the privacy policy. The intent is to flag to consumers that there is a change and that the notice requires their attention. California is one of three states that has not adopted the amendment to the GLBA, frequently referred to as the FAST Act amendment. SB 793 would integrate the amendment into California law. This bill also requires certain rights to be specified for the consumer in the notice. Some of these right include the right to submit a written request to access, correct, amend, or delete the consumer’s personal information, the right to receive a response within 30 business days of the consumer submitting such a request, and if the insurance institution refuses the consumer’s request, the right of the consumer to file a statement regarding what the consumer believes to be accurate and fair information in support of their request and why the consumer disagrees with the insurance institution’s refusal.

Related/Prior Legislation

AB 2372 (Calderon)(2022) This bill would have codified the requirement to annually provide a clear and conspicuous privacy notice to customers. The bill would have exempted an insurance institution or agent from providing that required notice if specified criteria were met. The bill would have authorized the notice to be combined with the notice provided in connection with specified insurance transactions.

ARGUMENTS IN SUPPORT

The American Property Casualty Insurance Association argues that SB 793 will bring California insurance law into line with GLBA and changes made in many other states’ insurance privacy laws by requiring insurers to send privacy police policy notices once initially and thereafter only when a change has been made in the policy. They emphasize that this does not change the requirement that an insurer’s privacy policy be available online and that it be provided at any time at a customer’s request. This change is a consumer-friendly one in that it will reduce the deluge of privacy notices consumers receive and will more effectively call their attention to notices they do receive when a privacy policy has changed.

According to Personal Insurance Federation of California, ensuring consumers receive the additional privacy notices only when there is a change in the existing privacy policy will not only reduce paper mail waste but will help reduce consumer confusion by focusing their attention on notices that actually include important changes to their privacy policy.

SUPPORT:

American Council of Life Insurers

American Property Casualty Insurance Association

Association of California Life and Health Insurance Companies

Pacific Association of Domestic Insurance Companies

Personal Insurance Federation of California

OPPOSITION:

None Received

-- END --