Law / United States / 
Alabama
Insurance privacy regulation: privacy notices, opt out of disclosure to nonaffiliated third parties and limits on sharing account numbers
Ala. Admin. Code r. 482-1-122-.05 to 482-1-122-.16 and 482-1-122-.18
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Consent, Data subject rights
- Audit expectation
- none
As of .
What it requires
- As an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship.
- Give each consumer such a notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than a disclosure authorized by sections 15 and 16 of the regulation.
- Give each customer such a notice at least once in any period of twelve consecutive months during which the customer relationship continues.
- Include in each initial, annual and revised notice the categories of nonpublic personal financial information you collect and disclose, the categories of affiliates and nonaffiliated third parties to whom you disclose it, the consumer's right to opt out and how to exercise it, and your policies and practices for protecting the confidentiality and security of nonpublic personal information.
- Before you disclose nonpublic personal financial information to a nonaffiliated third party other than as your initial notice described, give the consumer a clear and conspicuous revised notice and a new opt out notice, and a reasonable opportunity to opt out.
- Deliver each required notice so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically.
- Do not, directly or through an affiliate, disclose a consumer's nonpublic personal financial information to a nonaffiliated third party unless you gave the initial notice and an opt out notice, gave the consumer a reasonable opportunity to opt out before the disclosure (for example, 30 days from mailing), and the consumer did not opt out.
- Give each consumer a clear and conspicuous opt out notice that states you disclose or reserve the right to disclose nonpublic personal financial information to a nonaffiliated third party, that the consumer has the right to opt out, and a reasonable means to exercise it.
- Do not, directly or through an affiliate, disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency.
- When you give nonpublic personal financial information to a nonaffiliated third party to perform services for you, give the initial notice and enter into a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed it.
- Limit your disclosure and use of nonpublic personal financial information you receive from a nonaffiliated financial institution under an exception to the disclosure and use the exception allows.
- Do not unfairly discriminate against a consumer or customer because the person has opted out of the disclosure of his or her nonpublic personal financial information.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Alabama Commissioner of Insurance, who may suspend or revoke the license or certificate of authority of a licensee that violates the regulation (rule 482-1-122-.19).
What this law does
Chapter 482-1-122 governs the treatment of nonpublic personal financial information about individuals by all licensees of the Alabama Department of Insurance. Chapter 482-1-122 applies to information about individuals who obtain or seek to obtain products or services primarily for personal, family or household purposes from licensees, and not to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes.
Chapter 482-1-122 applies to all insurers, producers, agents, brokers, service representatives, and other persons licensed or required to be licensed under the Alabama Insurance Code, other than under Chapter 32 of Title 8 (Service Contracts). A licensee must give a customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not later than when it establishes the customer relationship.
A licensee must give a consumer such a notice before it discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as authorized by sections 15 and 16 of Chapter 482-1-122. A licensee must give customers a clear and conspicuous notice of its privacy policies and practices at least once in any period of twelve consecutive months during which the customer relationship exists.
Each initial, annual and revised notice under Chapter 482-1-122 must state the categories of nonpublic personal financial information the licensee collects and the categories it discloses. A licensee may not, directly or through any affiliate, disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out.
A licensee may not disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail, other than to a consumer reporting agency.
The opt out requirements of Chapter 482-1-122 do not apply when a licensee gives nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee, if the licensee gives the initial notice and has a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes of the disclosure.
A licensee may not unfairly discriminate against a consumer or customer because that person has opted out of the disclosure of his or her nonpublic personal financial information. A licensee that violates Chapter 482-1-122 may be subject to suspension or revocation of its license or certificate of authority. Chapter 482-1-122 is effective , and the time for compliance was extended until .
Until , a contract that a licensee entered into on or before with a nonaffiliated third party to perform services for the licensee satisfied section 14A(1)(b) of Chapter 482-1-122 even if the contract did not require the third party to maintain the confidentiality of nonpublic personal information.
When LexLint raises it
When your app profile says your app is an insurer.