Law / United States / 
Iowa
Insurance privacy rules: privacy notices, opt out of disclosure to nonaffiliated third parties, limits on sharing policy numbers for marketing, and no discrimination for opting out
Iowa Admin. Code r. 191-90.3 to 191-90.7, 191-90.9, 191-90.11 and 191-90.23
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Consent, Data subject rights, Prohibition
- Audit expectation
- none
As of .
What it requires
- As an insurance licensee, do not disclose, directly or through an affiliate, nonpublic personal financial information about a consumer to a nonaffiliated third party, except as the rules authorize, unless you have given the consumer the initial notice, an opt-out notice and a reasonable opportunity to opt out, and the consumer does not opt out (Iowa Admin. Code 191-90.9(1)).
- Give the consumer a reasonable opportunity to opt out, for example by mailing the notices and allowing the consumer to opt out by mailing a form, calling a toll-free number or another reasonable means within 30 days from the date you mailed them (191-90.9(2)).
- Make the opt-out notice state that you disclose or reserve the right to disclose nonpublic personal financial information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means by which the consumer may exercise the right (191-90.6(1)).
- Do not disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party, other than a consumer reporting agency, for use in telemarketing, direct-mail marketing or marketing through electronic mail to the consumer (191-90.11(1)).
- Do not unfairly discriminate against a consumer or customer because the consumer or customer has opted out of the disclosure of nonpublic personal financial information (191-90.23).
- As an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship (Iowa Admin. Code 191-90.3(1)(a)).
- Give each consumer such a notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than a disclosure that rules 191-90.13 and 191-90.14 authorize (191-90.3(1)(b)).
- Give each customer such a notice not less than annually, meaning at least once in any period of 12 consecutive months during which the customer relationship exists (191-90.4(1)).
- Include in each initial, annual and revised notice the categories of nonpublic personal financial information you collect and disclose, the categories of affiliates and nonaffiliated third parties to which you disclose it, the consumer's right to opt out and how to exercise it, and your policies and practices for protecting the confidentiality and security of the information (191-90.5(1)).
- Before you disclose nonpublic personal financial information to a nonaffiliated third party other than as your initial notice described, give the consumer a clear and conspicuous revised notice, a new opt-out notice and a reasonable opportunity to opt out (191-90.7(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 507B.7(1)(a) lets the Commissioner of Insurance, after hearing, order a civil penalty of not more than $1,000 for each act or violation, up to an aggregate of $10,000, or, if the person knew or reasonably should have known of the violation, not more than $5,000 for each act or violation, up to an aggregate of $50,000 in any one six-month period. The Commissioner may also suspend or revoke the license of a person who knew or reasonably should have known of the violation (section 507B.7(1)(b)).
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Iowa Commissioner of Insurance, who orders penalties after hearing for a violation of Iowa Code section 507B.4, which rule 191-90.25 applies to a violation of chapter 90.
What this law does
Chapter 90 of the Insurance Division's rules governs the treatment of nonpublic personal financial information and nonpublic personal health information about individuals by all licensees of the insurance division.
Chapter 90 also applies to information about individuals who obtain, or are claimants or beneficiaries of, products or services primarily for personal, family or household purposes from licensees, and does not apply to information about individuals or companies that obtain products or services for business, commercial or agricultural purposes.
Rule 90.9 bars a licensee from disclosing nonpublic personal financial information about a consumer to a nonaffiliated third party, except as the rules authorize, unless the licensee has provided the initial notice and an opt-out notice and a reasonable opportunity to opt out and the consumer does not opt out.
Rule 90.9 treats a licensee that mails the notices and allows the consumer to opt out by mailing a form, calling a toll-free telephone number or any other reasonable means within 30 days from the date of mailing as having given a reasonable opportunity to opt out.
Rule 90.6 requires the opt-out notice to state that the licensee discloses or reserves the right to disclose nonpublic personal financial information about its consumer to a nonaffiliated third party, that the consumer has the right to opt out, and a reasonable means to exercise the right.
Rule 90.11 bars a licensee from disclosing a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party, other than a consumer reporting agency, for use in telemarketing, direct-mail marketing or marketing through electronic mail to the consumer.
Rule 90.23 bars a licensee from unfairly discriminating against a consumer or customer because that consumer or customer has opted out of the disclosure of nonpublic personal financial information. Rule 90.3 requires a licensee to give an individual who becomes the licensee's customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not later than when the licensee establishes a customer relationship.
Rule 90.3 also requires a licensee to give a consumer such a notice before the licensee discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as two exception rules authorize. Rule 90.4 requires a licensee to give customers a clear and conspicuous notice of its privacy policies and practices not less than annually during the continuation of the customer relationship.
Rule 90.5 requires each initial, annual and revised privacy notice to state the categories of nonpublic personal financial information the licensee collects and discloses, and the categories of affiliates and nonaffiliated third parties to which it discloses.
Rule 90.5 also requires each such notice to explain the consumer's right to opt out of disclosure to nonaffiliated third parties and the methods for exercising it, and to describe the licensee's policies and practices for protecting the confidentiality and security of nonpublic personal financial information.
Rule 90.7 bars a licensee from disclosing nonpublic personal financial information to a nonaffiliated third party other than as the initial notice described unless it has provided a clear and conspicuous revised privacy notice and a new opt-out notice, among other conditions. Rule 90.26 provides that the rules became effective , and extends the time for compliance until . Rule 90.1 as currently printed was adopted by ARC 7741C, effective .
Rule 90.25 provides that an insurer, producer or licensee that violates a requirement of the rules has committed a violation of Iowa Code section 507B.4, in addition to any other penalties provided by the laws of Iowa.
Section 507B.7 lets the Commissioner of Insurance order a civil penalty of up to $1,000 for each act or violation, up to $10,000 in the aggregate, or up to $5,000 for each act or violation, up to $50,000 in any one six-month period, if the person knew or reasonably should have known of the violation.
When LexLint raises it
When your app profile says your app is an insurer.