Law / United States / 
Kentucky
Privacy of consumer financial and health information: insurance licensees' notice, opt-out and authorization duties
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Consent, Data subject rights
As of .
What it requires
- If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and not less than annually during the relationship (806 KAR 3:210 Sections 5 and 6).
- Give a consumer who is not a customer the same notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as Sections 15 and 16 authorize (Section 5(1)(b)).
- Before you disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, give an opt-out notice that states you disclose or reserve the right to disclose it, that the consumer may opt out, and a reasonable means to do so, and allow a reasonable opportunity to opt out; mailed notices allow 30 days (Sections 8 and 11).
- Do not disclose nonpublic personal health information about a consumer or customer without an authorization from that person, except for the insurance functions Section 18(2) lists (Section 18).
- Do not unfairly discriminate against a consumer or customer because that person has opted out or has not granted authorization for the disclosure of nonpublic personal financial information (Section 22(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
KRS 304.99-020(1): the Commissioner of Insurance may impose, in lieu of or in addition to revoking or suspending a license or certificate of authority, a civil penalty of not more than $10,000 per violation for an insurer, fraternal benefit society, nonprofit hospital, medical-surgical, dental and health service corporation or health maintenance organization, $1,000 for an agent, surplus lines broker, rental vehicle agent or reinsurance intermediary, and $2,000 for an adjuster, administrator, life settlement broker or provider, or consultant. The insurer ceiling is recorded as per_violation_amount. Section 23 of the regulation applies KRS 304.99-020 to a violation of the regulation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Kentucky Commissioner of Insurance (Department of Insurance): a violation is an unfair trade practice in the business of insurance and subjects the licensee to a civil penalty authorized by KRS 304.99-020 (806 KAR 3:210 Section 23).
What this law does
The administrative regulation governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees.
A licensee must give a customer a clear and conspicuous notice of its privacy policies and practices not later than when it establishes the customer relationship, and must give a consumer such a notice before it discloses nonpublic personal financial information about the consumer to a nonaffiliated third party other than as the regulation authorizes.
A licensee must give a customer such a notice not less than annually during the continuation of the customer relationship, except where the regulation excepts it. A licensee may not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the initial notice and an opt-out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out.
A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from that person, except for the insurance functions the regulation lists. A licensee may not unfairly discriminate against a consumer or customer because that person has opted out of the disclosure or has not granted authorization for the disclosure of nonpublic personal financial information.
A violation of the regulation is an unfair trade practice in the business of insurance and subjects the licensee to a civil penalty authorized by KRS 304.99-020. The regulation does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes. The history line gives an effective date of , an amended version effective , and certification effective .
When LexLint raises it
When your app profile says your app is an insurer.