Law / United States / 
Rhode Island
Insurance privacy regulation: privacy notices, opt out of disclosure to nonaffiliated third parties and authorization for health information
In force.
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent
- Audit expectation
- none
As of .
What it requires
- As an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and give each consumer such a notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party other than as sections 7.16 and 7.17 authorize (section 7.5(A)).
- Give each customer such a notice at least once in any period of twelve consecutive months during which the customer relationship continues (section 7.6(A)).
- Include in each initial, annual and revised notice the categories of nonpublic personal financial information you collect and disclose, the categories of affiliates and nonaffiliated third parties to whom you disclose it, an explanation of the consumer's right to opt out and how to exercise it, and your policies and practices for protecting the confidentiality and security of nonpublic personal financial information (section 7.7(A)).
- Do not, directly or through an affiliate, disclose a consumer's nonpublic personal financial information to a nonaffiliated third party unless you gave the initial notice and an opt out notice, gave the consumer a reasonable opportunity to opt out before the disclosure (for example, 30 days from mailing), and the consumer did not opt out (section 7.12(A)).
- Do not, directly or through an affiliate, disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency (section 7.14(A)).
- Do not disclose nonpublic personal health information about a consumer or customer unless you obtain an authorization in written or electronic form that identifies the consumer, describes the information and the recipients, is signed and dated, states how long it remains valid (no more than 24 months) and states the right to revoke; keep the authorization in the individual's record (sections 7.18(A) and 7.19).
- Do not unfairly discriminate against a consumer or customer because the consumer or customer opted out of the disclosure of nonpublic personal financial information or did not grant authorization for the disclosure of nonpublic personal health information (section 7.24).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Rhode Island insurance regulatory authorities, which may investigate alleged violations and impose fines and other sanctions as lawfully determined to be appropriate under the applicable laws of the state (section 7.25).
Settledness
- As of
What this law does
Section 7.2(A) of 230-RICR-20-60-7 provides that the Part governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all insurance licensees of the Rhode Island Department of Business Regulation, requires a licensee to provide notice about its privacy policies and practices, and provides methods for individuals to prevent a licensee from disclosing that information.
Section 7.4(A)(17) of 230-RICR-20-60-7 defines a licensee as all licensed insurers, producers and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered, pursuant to Title 27 of the Rhode Island General Laws.
Section 7.2(B) of 230-RICR-20-60-7 applies the Part to nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees, and to all nonpublic personal health information.
Section 7.5(A) of 230-RICR-20-60-7 requires a licensee to provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a customer not later than when the licensee establishes a customer relationship, and to a consumer before the licensee discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party other than as sections 7.16 and 7.17 authorize.
Section 7.6(A) of 230-RICR-20-60-7 requires a licensee to provide customers a clear and conspicuous notice that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship.
Section 7.7(A) of 230-RICR-20-60-7 requires each initial, annual and revised privacy notice to include the categories of nonpublic personal financial information the licensee collects and discloses, the categories of affiliates and nonaffiliated third parties to whom it discloses, an explanation of the consumer's right to opt out and how to exercise it, and the licensee's policies and practices for protecting the confidentiality and security of nonpublic personal financial information.
Section 7.12(A)(1) of 230-RICR-20-60-7 bars a licensee from disclosing, directly or through an affiliate, any nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has provided the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out.
Section 7.14(A) of 230-RICR-20-60-7 bars a licensee from disclosing, other than to a consumer reporting agency, a policy number or similar access number or access code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer.
Section 7.18(A) of 230-RICR-20-60-7 bars a licensee from disclosing nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose information is sought to be disclosed. Section 7.19 of 230-RICR-20-60-7 requires a valid authorization to be in written or electronic form and to specify a length of time for which it remains valid, which in no event may be more than twenty-four months.
Section 7.24 of 230-RICR-20-60-7 bars a licensee from unfairly discriminating against a consumer or customer because the consumer or customer has opted out of the disclosure of nonpublic personal financial information, or has not granted authorization for the disclosure of nonpublic personal health information.
Section 7.25 of 230-RICR-20-60-7 authorizes the insurance regulatory authorities of the state to investigate any alleged violation of the Part and to impose fines and other sanctions as lawfully determined to be appropriate in accordance with the applicable laws of the state. The Rhode Island Department of State register lists 230-RICR-20-60-7 as an active rule, refiled effective with no change to the text of the rule.
The register entry for the predecessor, Regulation 99, Privacy of Consumer Financial Information, states that its purpose is to govern the treatment of nonpublic personal financial information about individuals by all insurance licensees of the Rhode Island Department of Business Regulation. The register lists an amendment to the rule effective .
The Rhode Island Department of State register lists the predecessor, Regulation 99, Privacy of Consumer Financial Information, as effective from to .
When LexLint raises it
When your app profile says your app is an insurer.