Insurance privacy regulation: privacy notices, opt out of disclosure of nonpublic personal information to nonaffiliated third parties and limits on sharing account numbers

Rule 0780-1-72-.02(1) of the Rules of the Tennessee Department of Commerce and Insurance governs the treatment of nonpublic personal information about individuals by all licensees of the Insurance Division, requires a licensee to provide notice to individuals about its privacy policies and practices, describes the conditions under which a licensee may disclose nonpublic personal information to affiliates and nonaffiliated third parties, and provides methods for individuals to prevent a licensee from disclosing that information.

Rule 0780-1-72-.02(2) applies to nonpublic personal information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees, and does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes.

Rule 0780-1-72-.04 defines a licensee as all licensed insurers, agents and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered pursuant to the Tennessee Insurance Law, codified at title 56 of the Tennessee Code.

Rule 0780-1-72-.04 defines nonpublic personal information as personally identifiable financial information and any list, description or other grouping of consumers, and publicly available information pertaining to them, that is derived using personally identifiable financial information that is not publicly available.

Rule 0780-1-72-.05(1) requires a licensee to provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a customer not later than when the licensee establishes a customer relationship, and to a consumer before the licensee discloses any nonpublic personal information about the consumer to a nonaffiliated third party other than as rules .15 and .16 authorize.

Rule 0780-1-72-.06(1) requires a licensee to provide customers a clear and conspicuous notice that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship.

Rule 0780-1-72-.07(1) requires each initial, annual and revised privacy notice to include the categories of nonpublic personal information the licensee collects and discloses, the categories of affiliates and nonaffiliated third parties to whom it discloses, an explanation of the consumer's right to opt out and how to exercise it, and the licensee's policies and practices for protecting the confidentiality and security of nonpublic personal information.

Rule 0780-1-72-.08(1) requires a licensee that must provide an opt out notice to give each consumer a clear and conspicuous notice that states that the licensee discloses or reserves the right to disclose nonpublic personal information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means by which the consumer may exercise the opt out right.

Rule 0780-1-72-.11(1) bars a licensee from disclosing, directly or through any affiliate, any nonpublic personal information about a consumer to a nonaffiliated third party unless it has provided the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out.

Rule 0780-1-72-.13(1) bars a licensee from disclosing, other than to a consumer reporting agency, a policy number or similar access number or access code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer.

Rule 0780-1-72-.23 bars a licensee from unfairly discriminating against a consumer or customer because the consumer or customer has opted out of the disclosure of nonpublic personal information, and does not prohibit licensees from engaging in their appropriate or acceptable methods for insurance underwriting. Rule 0780-1-72-.24 subjects any violation of the rule to the penalties delineated or referenced in Public Chapter 107 of the 2001 Public Acts.

Rule 0780-1-72-.26(1) states that the regulations impose substantially and materially the same requirements as the Public Necessity Rules that became effective July 1, 2001. Rule 0780-1-72-.26(2) requires a licensee to provide an initial notice to consumers who are its customers on July 1, 2001 by that date. Rule 0780-1-72 was filed on August 30, 2001 and became effective on November 13, 2001.

Section 1 of the 2001 act on the disclosure of nonpublic personal information by insurance licensees provides that a person who discloses nonpublic personal information contrary to Title V of the Gramm-Leach-Bliley Act of 1999, or who violates a rule lawfully promulgated under the section, engages in an unfair or deceptive act or practice, subjecting the person to the penalties delineated in section 56-8-109.

Section 2 of the 2001 act on the disclosure of nonpublic personal information by insurance licensees provides that nothing in the act creates a private cause of action and that the Commissioner of the Department of Commerce and Insurance is responsible for enforcement of the act. Section 3 of the 2001 act on the disclosure of nonpublic personal information by insurance licensees provides that, for all purposes other than rulemaking, the act takes effect July 1, 2001.