Law / United States / 
New Hampshire
Privacy of consumer financial and health information: insurance licensees' notice, opt-out and authorization duties
N.H. Code Admin. R. Ins 3001 to Ins 3007
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Consent, Data subject rights
- Audit expectation
- none
As of .
What it requires
- If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and not less than annually during the relationship (Ins 3002.01 and Ins 3002.02).
- Give a consumer who is not a customer the same notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as Ins 3004.02 and Ins 3004.03 authorize (Ins 3002.01(a)(2)).
- Before you disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, give an opt-out notice and a reasonable opportunity to opt out; a mailed notice allows 30 days (Ins 3002.04 and Ins 3003.01).
- Do not disclose nonpublic personal health information about a consumer or customer without an authorization from that person, except for the insurance functions Ins 3005.01(b) lists (Ins 3005.01).
- Do not unfairly discriminate against a consumer or customer because that person has opted out of the disclosure of nonpublic personal financial information (Ins 3006.02).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Ins 3006.03 subjects a violation to the penalty provisions of RSA 400-A:15, III and RSA 417:13. RSA 400-A:15, III allows, for a person who knowingly violates a rule of the commissioner, suspension or revocation of a license or an administrative fine not to exceed $2,500 per violation. RSA 417:13 allows an administrative penalty of not more than $2,500 for each act found to violate RSA chapter 417 after a cease and desist order is violated. The figure is a ceiling.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
Who enforces it
Enforcement body
New Hampshire Insurance Commissioner (Insurance Department), through the penalty provisions of RSA 400-A:15, III and RSA 417:13 (Ins 3006.03).
What this law does
The rule governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees of the state insurance department.
A licensee must give a customer a clear and conspicuous notice of its privacy policies and practices not later than when it establishes the customer relationship, and must give a consumer such a notice before it discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the rule authorizes.
A licensee must give a customer such a notice not less than annually during the customer relationship, subject to an exception for a licensee whose disclosures and policies have not changed. A licensee may not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the initial notice and an opt-out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out.
A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from that person, except for the insurance functions the rule lists. A licensee shall not unfairly discriminate against a consumer or customer because that person has opted out of the disclosure of nonpublic personal financial information. A violation of the rule shall be subject to the penalty provisions of RSA 400-A:15, III and RSA 417:13.
The rule does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes. The history notes show an original rule effective that expired , a new rule effective , and a rule readopted effective .
When LexLint raises it
When your app profile says your app is an insurer.