Regulates the insurance licensee use of nonpublic personal financial information of individuals.

A BILL FOR AN ACT

SECTION 1. Chapter 431, Hawaii Revised Statutes, is amended by adding a new article to be appropriately designated and to read as follows:

§431: -101 Purpose and scope. (a) This article governs the treatment of nonpublic personal financial information about individuals by all insurance licensees. This article:

(b) This article applies to nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family, or household purposes from licensees. This article does not apply to information about companies or about individuals who obtain products or services for business, commercial, or agricultural purposes.

(c) The notice provisions of this article shall not apply to licensees in liquidation or receivership.

§431:__-102 Definitions. As used in this article:

"Affiliate" means any company that controls, is controlled by, or is under common control with another company.

"Clear and conspicuous" means that a notice is reasonably understandable and designed to call attention to the nature and significance of the information in the notice.

"Collect" means to obtain information that the licensee organizes or can retrieve by the name of an individual or by identifying number, symbol, or other identifying particular assigned to the individual, irrespective of the source of the underlying information.

"Company" means a corporation, limited liability company, business trust, general or limited partnership, association, sole proprietorship, mutual benefit society, health maintenance organization, non-profit corporation, or similar organization.

"Consumer" means an individual who seeks to obtain, obtains, or has obtained an insurance product or service from a licensee that is to be used primarily for personal, family, or household purposes, and about whom the licensee has nonpublic personal information, or that individual’s legal representative.

"Consumer reporting agency" has the same meaning as in section 603(f) of the Fair Credit Reporting Act (15 U.S.C. 1681a(f)).

"Control" means:

"Customer" means a consumer who has a customer relationship with a licensee.

"Customer relationship" means a continuing relationship between a consumer and a licensee under which the licensee provides one or more insurance products or services to the consumer that are to be used primarily for personal, family, or household purposes.

"Financial institution" means any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in Section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)). "Financial institution" does not include:

"Financial product or service" means any product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under Section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)). "Financial service" includes a financial institution’s evaluation or brokerage of information that the financial institution collects in connection with a request or an application from a consumer for a financial product or service.

"Health information" means any information or data except age or gender, whether oral or recorded in any form or medium, created by or derived from a health care provider or the consumer that relates to:

(2) The provision of health care to an individual; or

"Insurance product or service" means any product or service that is offered by a licensee subject to the insurance laws of this state. "Insurance service" includes a licensee's evaluation, brokerage, or distribution of information collected in connection with a request or an application from a consumer for an insurance product or service.

"Licensee" means all licensed insurers, producers, and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered, pursuant to chapter 431 or 432, and health maintenance organizations holding a certificate of authority pursuant to chapter 432D. The term includes an unauthorized insurer that accepts business placed through a licensed surplus lines broker in this state, but only in regard to the surplus lines placements placed pursuant to article 8 of chapter 431.

"Licensee" does not include an employee, agent, or other representative of another licensee ("the principal") where:

"Nonaffiliated third party" means any person except:

"Nonaffiliated third party" includes any company that is an affiliate solely by virtue of the direct or indirect ownership or control of the company by the licensee or its affiliate in conducting merchant banking or investment banking activities of the type described in section 4(k)(4)(H) of the federal Bank Holding Company Act, or insurance company investment activities of the type described in section 4(k)(4)(I) of the Bank Holding Company Act (12 U.S.C. 1843(k)(4)(H) and (I)).

"Nonpublic personal financial information" means:

"Opt out" means a direction by a consumer that a licensee not disclose nonpublic financial information about that consumer to a nonaffiliated third party, other than as permitted by part IV of this article.

"Personally identifiable financial information" means any information:

"Personally identifiable financial information" does not include:

"Publicly available information" means any information that a licensee has a reasonable basis to believe is lawfully made available to the general public from:

A licensee has a reasonable basis to believe that information is lawfully made available to the general public if the licensee has taken steps to determine:

§431:___-201 Initial privacy notice to consumers required. (a) A licensee shall provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to:

(b) A licensee is not required to provide an initial notice to a consumer under subsection (a)(2) of this section if:

(c) A licensee establishes a customer relationship at the time the licensee and the consumer enter into a continuing relationship.

(d) When an existing customer obtains a new insurance product or service from a licensee that is to be used primarily for personal, family, or household purposes, the licensee satisfies the initial notice requirements of subsection (a) of this section as follows:

(e) A licensee may provide the initial notice required by subsection (a)(1) of this section within a reasonable time after the licensee establishes a customer relationship if:

(f) When a licensee is required to deliver an initial privacy notice by this section, or uses a short-form initial notice for non-customers according to 431:___-203(c), the licensee shall deliver the notice according to 431:___-206.

§431:___-202 Annual privacy notice to customers required. (a) A licensee shall provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. Annually means at least once in any period of twelve consecutive months during which that relationship exists. A licensee may define the twelve-consecutive-month period, but the licensee shall apply it to customers on a consistent basis.

(b) A licensee is not required to provide an annual notice to a former customer. A former customer is an individual with whom a licensee no longer has a continuing relationship.

(c) When a licensee is required by this section to deliver an annual privacy notice, the licensee shall deliver it according to section 431:___-206.

§431:___-203 Information to be included in privacy notices. (a) The initial, annual and revised privacy notices that a licensee provides under sections 431___-201, 431:___-202, and 431:___-205 shall include each of the following items of information, in addition to any other information the licensee wishes to provide, that applies to the licensee and to the consumers to whom the licensee sends its privacy notice:

(b) If a licensee discloses nonpublic personal financial information as authorized under sections 431:___-402 and 431:___-403, the licensee is not required to list those exceptions in the initial or annual privacy notices required by sections 431:___-201 and 431:___-202. When describing the categories of parties to whom disclosure is made, the licensee is required to state only that it makes disclosures to other affiliated or nonaffiliated third parties, as applicable, as permitted by law.

(c) Short-form initial notice with opt out notice for non-customers. A licensee may satisfy the initial notice requirements in sections 431:___-201(a)(2) and 431:___-204(c) for a consumer who is not a customer by providing a short-form initial notice at the same time as the licensee delivers an opt out notice as required in section 431:___-204. A short-form initial notice shall:

The licensee shall deliver its short-form initial notice according to section 431:___-206. The licensee is not required to deliver its privacy notice with its short-form initial notice. The licensee instead may provide the consumer a reasonable means of obtaining the licensee's privacy notice. If a consumer who receives the licensee’s short-form notice requests the licensee’s privacy notice, the licensee shall deliver its privacy notice according to section 431:___-206.

(d) The licensee’s notice may include:

§431:___-204 Form and delivery of opt out notice to consumers; opt out methods. (a) An opt out notice provided by a licensee pursuant to section 431:___-301 shall clearly, conspicuously, and accurately explain to the consumer the right to opt out under that section. The notice shall include:

(b) A licensee may provide the opt out notice together with or on the same written or electronic form as the initial notice the licensee provides in accordance with 431:___-201.

(c) If a licensee provides the opt out notice later than required for the initial notice under section 431:___-201, the licensee shall also include a copy of the initial notice with the opt out notice in writing or, if the consumer agrees, electronically.

(d) If two or more consumers jointly obtain an insurance product or service from a licensee, the licensee may provide a single opt out notice. The licensee’s opt out notice shall explain how the licensee will respond to an opt out direction by a joint consumer. The licensee shall allow any of the joint consumers to exercise the right to opt out. The licensee shall not require all joint consumers to opt out before it implements any opt out direction. The licensee may either:

(e) The licensee shall deliver the opt out notice according to section 431:___-206.

(f) A licensee shall comply with a consumer’s opt out direction as soon as reasonably practicable after the licensee receives it.

(g) A consumer may exercise the right to opt out at any time.

(h) A consumer’s direction to opt out is effective until the consumer revokes it in writing or, if the consumer agrees, electronically. When a customer relationship terminates, the customer’s opt out direction continues to apply to the nonpublic personal financial information that the licensee collected during or related to that relationship. If the individual subsequently establishes a new customer relationship with the licensee, the opt out direction that applied to the former relationship shall not apply to the new relationship.

§431:___-205 Revised privacy notices. (a) Except as otherwise authorized in this article, a licensee shall not, directly or through an affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party other than as described in the initial notice that the licensee provided to that consumer under section 431:___-201, unless:

(b) The licensee shall deliver a revised privacy notice according to section 431:___-206.

§431:___-206 Delivery. (a) A licensee shall provide any notices required under this article in a manner that the licensee reasonably expects the consumer to receive actual notice in writing or, if the consumer agrees, electronically.

(b) A licensee reasonably expects that a customer will receive actual notice of the licensee’s annual privacy notice if:

(c) A licensee shall not provide any notice required by this article solely through an oral explanation of the notice, either in person or over the telephone.

(d) For customers only, a licensee shall provide the initial notice required by section 431:___-201(a)(1), the annual notice required by section 431:___-202(a), and the revised notice required by section 431:___-205 so that the customer can retain them, or obtain them later in writing or, if the customer agrees, electronically.

(e) A licensee may provide a joint notice from the licensee and one or more of its affiliates or other financial institutions, as identified in the notice, as long as the notice is accurate with respect to the licensee and the other institutions. A licensee also may provide a notice on behalf of another financial institution.

(f) If two or more consumers jointly obtain an insurance product or service from a licensee, the licensee may satisfy the initial, annual, and revised notice requirements of sections 431:___-201(a), 431:___-202(a), and 431:___-205 by providing a single notice for each respective section to those consumers, jointly.

§431:___-207 Surplus lines licensee notice and opt out compliance. A surplus lines broker or surplus lines insurer shall be deemed to be in compliance with the notice and opt out requirements for nonpublic personal financial information set forth in this article; provided:

§431:___-301 Limits on disclosure of nonpublic personal financial information to nonaffiliated third parties. (a) Except as otherwise authorized in this article, a licensee shall not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless:

(b) A licensee shall comply with this section, regardless of whether the licensee and the consumer have established a customer relationship. If a licensee fails to comply with this section, the licensee may not, directly or through any affiliate, disclose to an unaffiliated third party any nonpublic personal financial information about a consumer that the licensee has collected, regardless of whether the licensee collected it before or after receiving the direction to opt out from the consumer.

(c) A licensee may allow a consumer to select certain nonpublic personal financial information or certain nonaffiliated third parties with respect to which the consumer wishes to opt out.

§431:___-302 Limits on redisclosure and reuse of nonpublic personal financial information. (a) If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution under an exception in sections 431:___-402 and 431:___-403, the licensee’s disclosure and use of that information is limited as follows:

(b) If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution other than under an exception in sections 431:___-201 and 431:___-202, the licensee may disclose the information only:

(c) If a licensee discloses nonpublic personal financial information to a nonaffiliated third party under an exception in sections 431:___-201 and 431:___-202, the third party may disclose and use that information only as follows:

(d) If a licensee discloses nonpublic personal financial information to a nonaffiliated third party other than under an exception in sections 431:___-201 and 431:___-202 of this article, the third party may disclose the information only:

§431:____-303 Limits on sharing account number information for marketing purposes. (a) A licensee shall not, directly or through an affiliate, disclose, other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer’s policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.

(b) Subsection (a) does not apply if a licensee discloses a policy number or similar form of access number or access code:

§431:___-401 Exception to opt out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing. (a) The opt out requirements in sections 431:___-204 and 431:___-301 shall not apply when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee:

(b) The services a nonaffiliated third party performs for a licensee under subsection (a) may include marketing of the licensee’s own products or services or marketing of financial products or services offered pursuant to joint agreements between the licensee and one or more financial institutions.

(c) For purposes of this section, "joint agreement" means a written contract pursuant to which a licensee and one or more financial institutions jointly offer, endorse, or sponsor a financial product or service.

§431:___-402 Exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions. (a) The requirements for initial notice in section 431:___-201(a)(2), the opt out in sections 431:___-204 and 431:___-301, and requirements for disclosure for service providers and joint marketing in sections 431:___-401 do not apply if the licensee discloses nonpublic personal financial information as necessary to effect, administer or enforce a transaction that a consumer requests or authorizes, or in connection with:

(b) As used in this section, "necessary to effect, administer, or enforce a transaction" means that the disclosure is:

§431:-___-403 Other exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information. (a) The requirements for initial notice in section 431:___-201(a)(2), the opt out in sections 431:___-204 and 431:___-301, and requirement for disclosure for service providers and joint marketing in sections 431:___-401 shall not apply when a licensee discloses nonpublic personal financial information:

(b) A consumer may revoke consent by subsequently exercising the right to opt out of future disclosures of nonpublic personal information as permitted under section 431:___-204(g).

§431:___-501 Protection of Fair Credit Reporting Act. Nothing in this article shall be construed to modify, limit, or supersede the operation of the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.), and no inference shall be drawn on the basis of the provisions of this article regarding whether information is transaction or experience information under Section 603 of that Act.

§431:___-502 Nondiscrimination. A licensee shall not unfairly discriminate against any consumer or customer because that consumer or customer has opted out from disclosure of his or her nonpublic personal financial information pursuant to the provisions of this article.

§431:___-503 Violation. A violation of this article shall be deemed an unfair or deceptive trade practice in violation 431:13-102.

§431:___-504 Rules. The commissioner shall have the authority to establish administrative rules to further the purposes of this article."

SECTION 2. A contract between a licensee and a nonaffiliated third party for services or functions performed by the third party on the licensee’s behalf entered into on or before July 1, 2000, satisfies the provisions of section 431:___-401(a)(2) of section 1 of this Act, regardless of whether the contract requires that the third party maintain the confidentiality of nonpublic personal information.

SECTION 3. The commissioner may extend the time for licensee compliance until July 1, 2001, to provide sufficient time for licensees to establish policies and systems to comply with the requirements of this Act; provided that by July 1, 2001, a licensee shall provide an initial notice, as required by 431:____-201 of section 1 of this Act, to consumers who are the licensee’s customers on July 1, 2001.

SECTION 4. If any section or portion of a section of this Act or its applicability to any person or circumstance is held invalid by a court, the remainder of the Act or the applicability of the provision to other persons or circumstances shall not be affected.

SECTION 5. This Act shall take effect upon its approval.