Law / United States / 
New Jersey
Insurance information practices: notice, access and correction, adverse underwriting decisions and disclosure limits
Insurance information practices, N.J. Stat. §§ 17:23A-1 to 17:23A-22
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent, Prohibition
As of .
What it requires
- Apply the act if you are an insurance institution, an agent or an insurance-support organization that collects, receives or maintains information in connection with insurance transactions pertaining to New Jersey residents (life, health or disability) or involving policies delivered, issued for delivery or renewed in New Jersey (property or casualty) (N.J.S.A. 17:23A-1).
- Do not use or authorize pretext interviews (pretending to be someone else or to represent someone you do not, misrepresenting the purpose of the interview, or refusing to identify yourself on request) to obtain information in connection with an insurance transaction, except to investigate a claim where there is a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure (N.J.S.A. 17:23A-3).
- Give each applicant or policyholder a written notice of information practices, or the abbreviated notice the section allows, at the times section 4 sets (N.J.S.A. 17:23A-4).
- Clearly specify the questions designed to obtain information solely for marketing or research purposes (N.J.S.A. 17:23A-5).
- Use a disclosure authorization form that is written in plain language, is dated, names the types of persons authorized to disclose, the nature of the information, the recipients and the purposes, and states how long the authorization remains valid (N.J.S.A. 17:23A-6).
- Before preparing or requesting an investigative consumer report for an application, renewal, reinstatement or change in benefits, inform the individual that the individual may request an interview and may receive a copy of the report, and conduct a requested personal interview (N.J.S.A. 17:23A-7).
- On a written request after proper identification, give the individual access to recorded personal information about the individual within 30 business days, including its nature and substance in writing, a copy, the identity of those to whom it was disclosed, and a summary of the correction procedure (N.J.S.A. 17:23A-8).
- On a written request, correct, amend or delete disputed recorded personal information, or notify the individual of your refusal, the reasons and the right to file a statement of disagreement, and attach the statement to later disclosures (N.J.S.A. 17:23A-9).
- On an adverse underwriting decision, give the applicant, policyholder or individual proposed for coverage the specific reasons in writing, or tell the person the reasons may be requested in writing, with a summary of rights, and on written request furnish the specific items of information that support the reasons and the names and addresses of the institutional sources (N.J.S.A. 17:23A-10).
- Do not seek information about a previous adverse underwriting decision or a previous residual-market placement unless the inquiry also requests the reasons, and do not base an adverse underwriting decision on the fact of a previous adverse decision or on personal information received from an insurance-support organization whose primary source is insurance institutions, except as section 12 allows (N.J.S.A. 17:23A-11 and 17:23A-12).
- Do not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure falls within a permitted purpose listed in section 13, such as the individual's written authorization (N.J.S.A. 17:23A-13).
- As an insurer or insurance producer, do not disclose personal or privileged information collected or received in connection with an insurance transaction regarding an individual's status as a victim of domestic violence, a domestic violence-related condition, or the individual's status as an employer of a victim, unless a listed exception applies (N.J.S.A. 17:23A-13.3).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 22 makes it a crime of the fourth degree to knowingly and willfully obtain information about an individual from an insurance institution, agent or insurance-support organization under false pretenses.
Penalty structure
Section 18(a): after a hearing that finds a knowing violation, the commissioner may order a monetary penalty of not more than $500 for each violation, not to exceed $10,000 in the aggregate for multiple violations. Section 18(b): a person who violates a cease and desist order may be fined not more than $10,000 for each violation, or not more than $50,000 if the violations occurred with such frequency as to constitute a general business practice, or have an insurance institution's or agent's license suspended or revoked.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 10,000
- Per violation unit
- Violation
- Per violation amount
- 500
Who enforces it
Enforcement body
The Commissioner of Banking and Insurance, who examines and investigates insurance institutions, agents and insurance-support organizations, serves a statement of charges and notice of hearing, issues cease and desist orders, and may order the penalties in section 18; an individual whose rights under sections 8, 9 or 10 are violated may seek equitable relief in court.
What this law does
P.L.1985, c.179 establishes standards for the collection, use and disclosure of information gathered in connection with insurance transactions. In the case of life, health or disability insurance, the act applies to an insurance institution, agent or insurance-support organization that collects, receives or maintains information in connection with insurance transactions pertaining to natural persons who are residents of New Jersey.
No insurance institution, agent or insurance-support organization may use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction, except to investigate a claim where there is a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure.
An insurance institution or agent must provide a notice of information practices to all applicants or policyholders in connection with insurance transactions. An insurance institution, agent or insurance-support organization must not use a disclosure authorization form unless it is written in plain language, is dated, and meets the other requirements of section 6.
On a written request from an individual after proper identification, an insurance institution, agent or insurance-support organization must within 30 business days inform the individual in writing of the nature and substance of the recorded personal information, permit the individual to see and copy it, disclose to whom it has been disclosed, and provide a summary of the procedure for requesting correction, amendment or deletion of recorded personal information.
On written request, an insurance institution, agent or insurance-support organization must correct, amend or delete the disputed recorded personal information, or notify the individual of its refusal, the reasons, and the individual's right to file a statement of disagreement.
In the event of an adverse underwriting decision, the insurance institution or agent responsible must either provide the specific reason or reasons in writing or advise that they may be requested in writing, and provide a summary of the individual's rights.
An insurance institution, agent or insurance-support organization may not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is one the section lists. Where a hearing results in a finding of a knowing violation of the act, the commissioner may order payment of a monetary penalty of not more than $500 for each violation, not to exceed $10,000 in the aggregate for multiple violations.
A person who violates a cease and desist order of the commissioner may, after notice and hearing, be subject to a monetary fine of not more than $10,000 for each violation, a fine of not more than $50,000 if the violations occurred with such frequency as to constitute a general business practice, or suspension or revocation of an insurance institution's or agent's license.
A person whose rights under sections 8, 9 or 10 are violated may apply to the Superior Court or any other court of competent jurisdiction for appropriate equitable relief. An insurance institution, agent or insurance-support organization that discloses information in violation of section 13 is liable for damages sustained by the individual about whom the information relates, and no individual is entitled to a monetary award exceeding actual damages.
Any person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is guilty of a crime of the fourth degree. P.L.1985, c.179 took effect 180 days after enactment. P.L.1985, c.179 was approved on . The Department of Banking and Insurance states that the act took effect on .
Section 3 of P.L.2003, c.41 (C.17:23A-13.3) bars an insurer or insurance producer from disclosing personal or privileged information collected or received in connection with an insurance transaction regarding an individual's status as a victim of domestic violence or a domestic violence-related condition, or as an employer of a victim of domestic violence, unless the disclosure falls within a listed exception. The 2003 act that added section 17:23A-13.3 was approved on and took effect immediately.
When LexLint raises it
When your app profile says your app is an insurer.