Law / United States / 
Pennsylvania
Privacy of consumer financial information: privacy and opt out notices and limits on disclosure by insurance licensees
31 Pa. Code §§ 146a.1 to 146a.44
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent
- Audit expectation
- none
As of .
What it requires
- If you are an insurer, producer or other licensee of the Insurance Department (health maintenance organizations included), give each customer a clear and conspicuous notice of your privacy policies and practices not later than when the customer relationship begins, and give each consumer one before you disclose nonpublic personal financial information about the consumer to a nonaffiliated third party other than as sections 146a.32 and 146a.33 authorize.
- Give customers a clear and conspicuous notice of your privacy policies and practices not less than annually, meaning at least once in any 12 consecutive months, while the customer relationship continues.
- Include in each privacy notice the categories of nonpublic personal financial information you collect and disclose and the categories of affiliates and nonaffiliated third parties to whom you disclose it.
- Do not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, directly or through an affiliate, unless you gave the consumer the initial notice and the opt out notice, a reasonable opportunity to opt out before the disclosure (for example 30 days from mailing the notices), and the consumer did not opt out. Subchapter D lists exceptions.
- Do not unfairly discriminate against a consumer or customer because that person opted out of the disclosure.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 146a.43 makes a violation an unfair method of competition or unfair or deceptive act or practice subject to the Unfair Insurance Practices Act. Section 11 of that act lets a court, in an action the commissioner files, impose a civil penalty of not more than $5,000 for each violation the person knew or reasonably should have known was a violation, not to exceed $50,000 in any six month period, or not more than $1,000 for each other violation, not to exceed $10,000 in any six month period; a violation of a commissioner order carries up to $10,000.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Pennsylvania Insurance Commissioner (Insurance Department), who may issue a cease and desist order or suspend or revoke a license after a hearing under section 9 of the Unfair Insurance Practices Act and may bring an action for the section 11 civil penalties.
What this law does
Chapter 146a applies to nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees.
Section 146a.2 defines a licensee to include a licensed insurer, a producer and other persons or entities licensed or required to be licensed, authorized or registered under The Insurance Department Act of 1921 or The Insurance Company Law of 1921, including health maintenance organizations holding a certificate of authority.
Section 146a.11(a) requires a licensee to provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a customer not later than when the licensee establishes a customer relationship. Section 146a.11(a) also requires that notice to a consumer before the licensee discloses nonpublic personal financial information about the consumer to any nonaffiliated third party, other than as authorized by the exceptions in sections 146a.32 and 146a.33.
Section 146a.12 requires a licensee to provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. Section 146a.13 requires each privacy notice to include the categories of nonpublic personal financial information that the licensee collects and discloses, and the categories of affiliates and nonaffiliated third parties to whom the licensee discloses it.
Section 146a.21(a) bars a licensee from disclosing nonpublic personal financial information about a consumer to a nonaffiliated third party, directly or through an affiliate, unless it has given the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out. Section 146a.42 bars a licensee from unfairly discriminating against any consumer or customer because that person has opted out of the disclosure.
Section 146a.43 provides that violations of the chapter are deemed and defined by the Commissioner to be an unfair method of competition and an unfair or deceptive act or practice, subject to the applicable penalties or remedies of the Unfair Insurance Practices Act. Section 9 of the Unfair Insurance Practices Act lets the commissioner, after a hearing, order a person to cease and desist from a violation or, for a practice defined in section 5, suspend or revoke the person's license.
Section 11 of the Unfair Insurance Practices Act lets a court, in an action the commissioner files, impose a civil penalty of not more than $5,000 for each violation that the person knew or reasonably should have known was a violation, not to exceed $50,000 in any six month period.
Section 11 of the Unfair Insurance Practices Act also lets a court impose a civil penalty of not more than $1,000 for each violation that the person did not know nor reasonably should have known was a violation, not to exceed $10,000 in any six month period. Section 146a.44(a) provides that the chapter is effective . Section 146a.1 was amended , effective .
When LexLint raises it
When your app profile says your app is an insurer.