Law / United States / 
Virginia
Insurance: notice of financial information practices and opt-out of disclosure to nonaffiliated third parties
Va. Code Ann. §§ 38.2-604.1 and 38.2-612.1
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent
As of .
What it requires
- If you are an insurance institution or agent, give an applicant a clear and conspicuous written (or, if the applicant agrees, electronic) notice of your financial information collection and disclosure practices before disclosing financial information about the applicant to a nonaffiliated third party other than as section 38.2-613 permits, and give a policyholder the notice no later than delivery or issuance of the policy and not less than once in each calendar year (title insurance policyholders excepted from the annual notice) (section 38.2-604.1(A)).
- State in the notice the types of financial information that may be collected and disclosed, the categories of persons to whom it may be disclosed, the right to direct that financial information not be disclosed to nonaffiliated third parties, your policies for protecting its confidentiality and security, any affiliate-sharing disclosure the federal Fair Credit Reporting Act requires, and the practices that apply to former policyholders, and send a revised notice before disclosing financial information in a way the earlier notice did not describe (section 38.2-604.1(B) and (F)).
- Do not disclose financial information about an individual to a nonaffiliated third party, directly or through an affiliate, other than as section 38.2-613 permits, unless the individual received a clear and conspicuous notice, had an opportunity of not less than 30 days from the notice to direct that it not be disclosed, was given a reasonable means to exercise that right, and the third party agrees not to disclose the information further except as the article would permit (section 38.2-612.1(A)).
- Do not disclose to a nonaffiliated third party, other than a consumer reporting agency, a policy number or similar access number or transaction account of a policyholder or applicant for use in telemarketing, direct mail marketing or other marketing through electronic mail, except to an agent or other person marketing your own products who cannot initiate charges to the account, or to a participant in a private label credit card, affinity or similar program identified to the policyholder or applicant (section 38.2-612.1(B)).
- Do not unfairly discriminate against an individual because the individual has directed that personal information not be disclosed under section 38.2-612.1(A), or has refused to authorize disclosure of privileged information or medical record information under section 38.2-613(A) (section 38.2-612.1(C)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 38.2-218: a person who knowingly or willfully violates any provision of Title 38.2 is punished for each violation by a penalty of not more than $5,000, and a person who violates a provision without knowledge or intent may be punished for each violation by a penalty of not more than $1,000, with a series of similar violations from the same act limited to $10,000 in the aggregate. The knowing or willful ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
State Corporation Commission, which may examine and investigate any insurance institution or agent doing business in the Commonwealth to determine whether it has engaged in conduct that violates the article (section 38.2-614).
Settledness
- As of
What this law does
An insurance institution or agent must give clear and conspicuous notice of financial information collection and disclosure practices in connection with insurance transactions. A policyholder other than a policyholder of a title insurance policy must receive the notice not less than once in each calendar year.
No insurance institution, agent or insurance-support organization may disclose financial information about an individual to a nonaffiliated third party unless the individual has received notice, an opportunity of at least 30 days to direct that it not be disclosed, a reasonable means to do so, and the third party agrees not to disclose it further.
An insurance institution, agent or insurance-support organization may not disclose a policy number or similar access number or transaction account of a policyholder or applicant to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, subject to listed exceptions. No insurance institution or agent may unfairly discriminate against an individual because the individual has directed that personal information not be disclosed.
Section 38.2-218 of the Code of Virginia punishes a knowing or willful violation of any provision of Title 38.2 by a penalty of not more than $5,000 for each violation. Chapter 371 of the 2001 Acts of Assembly added sections 38.2-513.1, 38.2-604.1, 38.2-612.1 and 38.2-612.2 to the Code of Virginia. Chapter 371 of the 2001 Acts of Assembly took effect on . Section 38.2-612.1 was amended by Chapter 264 of the 2020 Acts of Assembly.
When LexLint raises it
When your app profile says your app is an insurer.