Law / United States / 
Colorado
Privacy of Consumer Financial and Health Information: insurance licensees' notice, opt-out and authorization duties
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Consent, Data subject rights
- Audit expectation
- none
As of .
What it requires
- If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and not less than annually during the relationship (Regulation 6-4-1 Sections 5 and 6).
- Give a consumer who is not a customer the same notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as Sections 16 and 17 authorize (Section 5.A.2).
- Before you disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, give an opt out notice that states you disclose or reserve the right to disclose it, that the consumer has the right to opt out and a reasonable means to do so, and allow a reasonable opportunity to opt out; do not disclose it if the consumer opts out (Sections 8 and 12).
- Do not disclose nonpublic personal health information about a consumer or customer without an authorization from that person, except for the insurance functions Section 18.B lists; an authorization is written or electronic, states how long it is valid (not more than 24 months) and may be revoked at any time (Sections 18 and 19).
- Retain each authorization, or a copy, in the record of the individual who is the subject of the nonpublic personal health information (Section 19.D).
- Do not unfairly discriminate against a consumer or customer because the person opted out from the disclosure of nonpublic personal financial information or did not grant authorization for the disclosure of nonpublic personal health information (Section 24).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Colorado Commissioner of Insurance (Division of Insurance), who adopted the regulation under Section 1 and may impose the sanctions the Colorado insurance statutes make available, which include civil penalties, cease and desist orders, and suspension or revocation of license (Section 27).
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
A licensee that discloses nonpublic personal health information under an authorization must retain the authorization or a copy in the record of the individual who is its subject, which makes the authorization a kept record of the individual's consent. The regulation sets no retention period for that record, and the 24-month limit in Section 19.B is the period for which an authorization is valid. The notice, opt out and delivery sections require notices and mechanisms and state no record, and the regulation names no audit or person who may demand the record. The regulation applies to all licensees of the Division of Insurance and has no territorial clause, so no hook is taken.
- Kind
- Explicit
- As of
- Provision
- 3 CCR 702-6, Regulation 6-4-1 Section 19.D (a licensee retains the authorization, or a copy, in the record of the individual who is the subject of the nonpublic personal health information)
- Trigger
- consent_or_optout
What this law does
The regulation governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees of the Colorado Division of Insurance.
A licensee must provide a clear and conspicuous initial notice that accurately reflects its privacy policies and practices to a customer not later than when the licensee establishes a customer relationship, and to a consumer before the licensee discloses any nonpublic personal financial information about the consumer to any nonaffiliated third party, other than as Sections 16 and 17 authorize.
A licensee must provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship.
A licensee may not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has provided the consumer an initial notice and an opt out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out.
A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer, and an authorization may not remain valid for more than twenty-four months.
A licensee shall not unfairly discriminate against a consumer or customer because that person has opted out from the disclosure of nonpublic personal financial information or has not granted authorization for the disclosure of nonpublic personal health information. The regulation does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes. The regulation is effective .
When LexLint raises it
When your app profile says your app is an insurer.