Law / United States / 
Nebraska
Privacy of Insurance Consumer Information Act: insurance licensees' notice, opt-out and authorization duties
Privacy of Insurance Consumer Information Act, Neb. Rev. Stat. §§ 44-901 to 44-925
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Consent, Data subject rights
- Audit expectation
- none
As of .
What it requires
- If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship (Neb. Rev. Stat. 44-904(1)(a)).
- Give a consumer who is not a customer the same notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as 44-914 and 44-915 authorize (44-904(1)(b)).
- Before you disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, give an opt-out notice that states you disclose or reserve the right to disclose it, that the consumer may opt out, and a reasonable means to do so, and allow a reasonable opportunity to opt out; a mailed notice allows thirty days (44-907(1) and 44-910(1)).
- Comply with a consumer's opt out direction as soon as reasonably practicable after you receive it (44-907(5)).
- Do not disclose nonpublic personal health information about a consumer or customer without an authorization from that person, except for the insurance functions 44-916(2) lists (44-916(1)).
- Do not unfairly discriminate against a consumer or customer because that person has opted out of the disclosure of nonpublic personal financial information or has not granted authorization for the disclosure of nonpublic personal health information (44-922).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Neb. Rev. Stat. 44-923 makes each violation of the Act an unfair trade practice in the business of insurance subject to the Unfair Insurance Trade Practices Act. Under 44-1529(1) the Director of Insurance may order a monetary penalty of not more than $1,000 for each violation, not to exceed an aggregate of $30,000, unless the violation was committed flagrantly in conscious disregard of that Act, in which case the penalty is not more than $15,000 for each violation, not to exceed an aggregate of $150,000. The figures recorded here are the first tier.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 30,000
- Per violation unit
- Violation
- Per violation amount
- 1,000
Who enforces it
Enforcement body
Nebraska Director of Insurance (Department of Insurance), through the Unfair Insurance Trade Practices Act (Neb. Rev. Stat. 44-923 and 44-1529).
What this law does
The Act governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees of the Department of Insurance.
A licensee must give a customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not later than when it establishes the customer relationship, and must give a consumer such a notice before it discloses nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the Act authorizes.
A licensee may not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the initial notice and an opt-out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out. A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from that person, except for the insurance functions the Act lists.
The health information authorization requirement became operative on . Each violation of the Act is an unfair trade practice in the business of insurance subject to the Unfair Insurance Trade Practices Act.
Under that Act the Director of Insurance may order a monetary penalty of not more than $1,000 for each violation, not to exceed an aggregate of $30,000, or up to $15,000 for each violation and $150,000 in aggregate where the violation was committed flagrantly in conscious disregard of that Act. The Act does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes. The Act took effect when approved on .
When LexLint raises it
When your app profile says your app is an insurer.