[31 Pa.B. 4426]
[Continued from previous Web Page] Section 146a.44. Effective date.
The CBC stated that they understand the importance of retaining the July 1, 2001, effective date for these regulations and that they appreciate the additional 6 months to come into compliance before enforcement. However, given the timing of the implementation of these regulations and the HIPAA regulation, the CBC has recommended that enforcement of these regulations coincide with the HIPAA Privacy April 14, 2003, compliance date.
Harleysville, Highmark, IBS, IFP, PAMIC and PBA expressed similar concerns with the compliance date of the regulations.
The Department has maintained the July 1, 2001, effective and compliance date in this final-form regulations. The Department has maintained this effective and compliance date to prevent the Federal preemption of insurance privacy laws in this Commonwealth under Title V of the GLBA. Also under the GLBA, the failure of a state to adopt a sufficient privacy regulation will result in the state's inability to override the Federal insurance consumer protection regulations that were issued by the Federal banking agencies in final-form on December 4, 2000, under section 305 of the GLBA. See 65 Fed. Reg. 233, 75821 (to be codified at 12 CFR Parts 14, 208, 343 and 536). These regulations will become effective on October 1, 2001, and they pertain generally to the sale of insurance by financial institutions and specifically to matters such as referral fees, separation of banking and insurance sales areas and disclosures regarding the nature of insurance products that are sold by banks. Because the counterpart Federal banking privacy regulations are effective on July 1, 2001, the Department is essentially required under the GLBA to maintain a similar effective date for its privacy regulation promulgated under Title V of the GLBA.
However, given that the regulations will have a retroactive effective date, the Department has committed to assisting the insurance industry in complying with the regulation, rather than strictly enforcing the regulation at the outset. For example, for the 6-month period following the effective date of the final-form regulations, the Department will engage in a formal question and answer procedure to address any concerns that are raised as a result of implementing this rulemaking. Also, the Department intends to utilize its market surveillance unit, as opposed to its market conduct or enforcement unit to assist the insurance industry with any compliance issues that may be encountered. Finally, the Department plans to meet with the industry to address any implementation problems that may arise.
Affected Parties
The rulemaking applies to all persons possessing a license issued by the Department, and all persons required to be licensed by the Department, unless specifically exempted.
Fiscal Impact
State Government
There will be no increase in cost to the Department due to the adoption of Chapter 146a.
General Public
There will be no fiscal impact to the public due to the adoption of Chapter 146a.
Political Subdivisions
The rulemaking will not impose additional costs on political subdivisions.
Private Sector
The rulemaking will impose additional costs of insurance companies, financial institutions and other nonexempted licensees doing the business of insurance in this Commonwealth. However, the adoption of this rulemaking will not be the cause of that additional cost. Insurance entities, financial institutions and other nonexempted licensees are required by Title V of the GLBA to comply with several statutory privacy requirements found in the Federal act. Title V of GLBA also requires various state and Federal regulators of the financial services industries to promulgate regulations for their respective regulated communities in order to further explain and define those statutory privacy requirements in the Federal act. For example, the Federal banking regulators (the Office of the Comptroller of the Currency (OCC)), the Federal Deposit Insurance Corporation, the Office of Thrift Supervision and the Board of Governors of the Federal Reserve System (BGFRS)) have already promulgated final-form regulations pertaining to the privacy of nonpublic personal financial information when such information is collected by the various Federal banking entities within their regulatory jurisdiction. See e.g. 12 CFR 40.1 et seq. (OCC regulations) and 12 CFR. 216.1 et seq. (BGFRS regulations). Therefore, the Federal requirements in the GLBA are the catalyst for the increase in the cost to insurers, financial institutions and other nonexempted licensees.
Paperwork
Unless specifically excluded under the § 146a.2 definition of licensee of the proposed rulemaking, the rulemaking will affect all licensees doing the business of insurance in this Commonwealth by imposing additional paperwork requirements pertaining to the delivery and tracking of opt out notices.
Effectiveness/Sunset Date
The final-form rulemaking will become effective July 1, 2001, as previously provided in Department Notice 2000-08 and as stated in § 146a.44.
Contact Person
Any questions regarding this final-form rulemaking, should be directed to Peter J. Salvatore, Regulatory Coordinator, Special Projects Office, 1326 Strawberry Square, Harrisburg, PA 17120, (717) 787-4429. In addition, questions may be e-mailed to psalvatore@state.pa.us or faxed to (717) 772-1969.
Regulatory Review
Under section 5(a) of the Regulatory Review Act, (71 P. S. § 745.5(a)), on March 21, 2001, the Department submitted a copy of this rulemaking to IRRC and to the Chairpersons of the House Insurance Committee and the Senate Banking and Insurance Committee. In addition to the submitted rulemaking, the Department has provided IRRC and the Committees with a copy of a detailed Regulatory Analysis Form prepared by the agency in compliance with Executive Order 1996-1, ''Regulatory Review and Promulgation.'' A copy of that material is available to the public upon request.
In preparing this final-form rulemaking, the Department considered all comments received from IRRC, the Committees and the public. This final-form rulemaking was deemed approved by the House and Senate Committees on July 5, 2001. In accordance with section 5a(d) of the Regulatory Review Act (71 P. S. § 745.5a(d)), IRRC met on July 12, 2001, and approved the final-form rulemaking in accordance with section 5.1(e) of the Regulatory Review Act.
Findings
The Commissioner finds that:
(1) Public notice of intention to adopt this rulemaking as amended by this order has been given under sections 201 and 202 of the act of July 31, 1968 (P. L. 769, No. 240) (45 P. S. §§ 1201 and 1202) and the regulations thereunder, 1 Pa. Code §§ 7.1 and 7.2.
(2) The adoption of this rulemaking in the manner provided in this order is necessary and appropriate for the administration and enforcement of the authorizing statutes.
Order
The Commissioner, acting under the authorizing statutes, orders that:
(1) The regulations of the Department, 31 Pa. Code, are amended by adding §§ 146a.1, 146a.2, 146a.11--146a.16, 146a.21--146a.23, 146a.31--146a.33 and 146a.41--146a.44 and Appendix A, to read as set forth in Annex A.
(2) The Commissioner shall submit this order and Annex A to the Office of General Counsel and Office of Attorney General for approval as to form and legality as required by law.
(3) The Commissioner shall certify this order and Annex A and deposit them with the Legislative Reference Bureau as required by law.
(4) The regulations adopted by this order shall take effect July 1, 2001
M. DIANE KOKEN,
Insurance Commissioner(Editor's Note: For the text of the order of the Independent Regulatory Review Commission relating to this order, see 31 Pa.B. 4136 (July 28, 2001).)
Fiscal Note: Fiscal Note 11-206 remains valid for the final adoption of the subject regulations.
Annex A
TITLE 31. INSURANCE
PART VIII. MISCELLANEOUS PROVISIONS
CHAPTER 146a. PRIVACY OF CONSUMER FINANCIAL INFORMATION Subch.
A. GENERAL PROVISIONS B. PRIVACY AND OPT OUT NOTICES FOR FINANCIAL INFORMATION C. LIMITS ON DISCLOSURES OF FINANCIAL INFORMATION D. EXCEPTIONS TO LIMITS ON DISCLOSURES OF NONPUBLIC PERSONAL FINANCIAL INFORMATION E. ADDITIONAL PROVISIONS
Subchapter A. GENERAL PROVISIONS Sec.
146a.1. Purpose. 146a.2. Definitions. § 146a.1. Purpose.
(a) Purpose. This chapter governs the treatment of nonpublic personal financial information about individuals by various licensees of the Department. This chapter:
(1) Requires a licensee to provide notice to individuals about its privacy policies and practices.
(2) Describes the conditions under which a licensee may disclose nonpublic personal financial information about individuals to affiliates and nonaffiliated third parties.
(3) Provides methods for individuals to prevent a licensee from disclosing that information.
(b) Scope. This chapter applies to nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees. Unless otherwise specified, this chapter generally does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes.
(c) Compliance. A licensee domiciled in this Commonwealth that is in compliance with this chapter in a state that has not enacted laws or regulations that meet the requirements of Title V of the act of November 12, 1999 (Pub. L. No. 106-102, 113 Stat. 1338) known as the Gramm-Leach-Bliley Act (Financial Services Modernization Act of 1999) (15 U.S.C.A. §§ 6801--6827) may nonetheless be deemed to be in compliance with Title V of the Gramm-Leach-Bliley Act in the other state.
(d) Examples. The examples provided in this chapter are for illustrative purposes only and do not otherwise limit or restrict the scope of this chapter.
§ 146a.2. Definitions.
The following words and terms, when used in this chapter, have the following meanings, unless the context requires otherwise:
Act--The Insurance Department Act of 1921 (40 P. S. §§ 1--321)
Affiliate--A company that controls, is controlled by or is under common control with another company.
Clear and conspicuous--That a notice is reasonably understandable and designed to call attention to the nature and significance of the information in the notice. Examples include:
(i) Reasonably understandable. A licensee makes its notice reasonably understandable if it does all of the following:
(A) Presents the information in the notice in clear, concise sentences, paragraphs and sections.
(B) Uses short explanatory sentences or bullet lists whenever possible.
(C) Uses definite, concrete, everyday words and active voice whenever possible.
(D) Avoids multiple negatives.
(E) Avoids legal and highly technical business terminology whenever possible.
(F) Avoids explanations that are imprecise and readily subject to different interpretations.
(ii) Designed to call attention. A licensee designs its notice to call attention to the nature and significance of the information in it if the licensee does all of the following:
(A) Uses a plain-language heading to call attention to the notice.
(B) Uses a typeface and type size that are easy to read.
(C) Provides wide margins and ample line spacing.
(D) Uses boldface or italics for key words.
(E) In a form that combines the licensee's notice with other information, uses distinctive type size, style and graphic devices, such as shading or sidebars.
(iii) Notices on websites. If a licensee provides a notice on a webpage, the licensee designs its notice to call attention to the nature and significance of the information in it if the licensee uses text or visual cues to encourage scrolling down the page if necessary to view the entire notice and ensure that other elements on the website (such as text, graphics, hyperlinks or sound) do not distract attention from the notice, and the licensee either:
(A) Places the notice on a screen that consumers frequently access, such as a page on which transactions are conducted.
(B) Places a link on a screen that consumers frequently access, such as a page on which transactions are conducted, that connects directly to the notice and is labeled appropriately to convey the importance, nature and relevance of the notice.
Collect--To obtain information that the licensee organizes or can retrieve by the name of an individual or by identifying number, symbol or other identifying particular assigned to the individual, irrespective of the source of the underlying information.
Commissioner--The Insurance Commissioner of the Commonwealth.
Company--A corporation, limited liability company, business trust, general or limited partnership, association, sole proprietorship or similar organization.
Consumer--An individual who seeks to obtain, obtains or has obtained an insurance product or service from a licensee that is to be used primarily for personal, family or household purposes, and about whom the licensee has nonpublic personal financial information, or that individual's legal representative. Examples include:
(i) An individual who provides nonpublic personal financial information to a licensee in connection with obtaining or seeking to obtain financial, investment or economic advisory services relating to an insurance product or service is a consumer regardless of whether the licensee establishes an ongoing advisory relationship.
(ii) An applicant for insurance prior to the inception of insurance coverage is a licensee's consumer.
(iii) An individual who is a consumer of another financial institution is not a licensee's consumer solely because the licensee is acting as agent for, or provides processing or other services to, that financial institution.
(iv) An individual about whom a licensee discloses nonpublic personal financial information to a nonaffiliated third party other than as permitted under Subchapter D (relating to exceptions to limits on disclosures of nonpublic personal financial information) and the individual is one of the following:
(A) A beneficiary of a life insurance policy underwritten by the licensee.
(B) A claimant under an insurance policy issued by the licensee.
(C) An insured or an annuitant under an insurance policy or an annuity, respectively, issued by the licensee.
(D) A mortgagor of a mortgage covered under a mortgage insurance policy.
(v) Provided that the licensee provides the initial, annual and revised notices under §§ 146a.11, 146a.12 and 146a.15 (relating to initial privacy notice to consumers required; annual privacy notice to customers required; and revised privacy notices) to the plan sponsor, group or blanket insurance policyholder, group annuity contractholder, or workers' compensation policyholder, and further provided that the licensee does not disclose to a nonaffiliated third party nonpublic personal financial information about such an individual other than as permitted under Subchapter D, an individual is not the consumer of the licensee solely because the individual is one of the following:
(A) A participant or a beneficiary of an employee benefit plan that the licensee administers or sponsors or for which the licensee acts as a trustee, insurer or fiduciary.
(B) Covered under a group or blanket insurance policy or group annuity contract issued by the licensee.
(C) A claimant in a workers' compensation plan.
(vi) The individuals described in subparagraph (v) are consumers of a licensee if the licensee does not meet all the conditions of subparagraph (v).
(vii) In no event shall the individuals, solely by virtue of the status described in subparagraph (v), be deemed to be customers for purposes of this chapter.
(viii) An individual is not a licensee's consumer solely because the individual is a beneficiary of a trust for which the licensee is a trustee.
(ix) An individual is not a licensee's consumer solely because the individual has designated the licensee as trustee for a trust.
Consumer reporting agency--The term has the same meaning as in section 603(f) of the Federal Fair Credit Reporting Act (15 U.S.C.A. § 1681a(f)).
Control--The term includes any of the following:
(i) Ownership, control or power to vote 25% or more of the outstanding shares of any class of voting security of the company, directly or indirectly, or acting through one or more other persons.
(ii) Control in any manner over the election of a majority of the directors, trustees or general partners (or individuals exercising similar functions) of the company.
(iii) The power to exercise, directly or indirectly, a controlling influence over the management or policies of the company, as determined by the Commissioner.
Customer--A consumer who has a customer relationship with a licensee.
Customer relationship--A continuing relationship between a consumer and a licensee under which the licensee provides one or more insurance products or services to the consumer that are to be used primarily for personal, family or household purposes. Examples are as follows:
(i) A consumer has a continuing relationship with a licensee if either:
(A) The consumer is a current policyholder of an insurance product issued by or through the licensee.
(B) The consumer obtains financial, investment or economic advisory services relating to an insurance product or service from the licensee for a fee.
(ii) A consumer does not have a continuing relationship with a licensee if one of the following applies:
(A) The consumer applies for insurance but does not purchase the insurance.
(B) The licensee sells the consumer airline travel insurance in an isolated transaction.
(C) The individual is no longer a current policyholder of an insurance product or no longer obtains insurance services with or through the licensee.
(D) The consumer is a beneficiary or claimant under a policy and has submitted a claim under a policy choosing a settlement option involving an ongoing relationship with the licensee.
(E) The consumer is a beneficiary or a claimant under a policy and has submitted a claim under that policy choosing a lump sum settlement option.
(F) The customer's policy is lapsed, expired or otherwise inactive or dormant under the licensee's business practices, and the licensee has not communicated with the customer about the relationship for a period of 12-consecutive months, other than annual privacy notices, material required by law or regulation, communication at the direction of a state or Federal authority, or promotional materials.
(G) The individual is an insured or an annuitant under an insurance policy or annuity, respectively, but is not the policyholder or owner of the insurance policy or annuity.
(H) The individual's last known address according to the licensee's records is deemed invalid. For the purposes of this section, an address of record is deemed invalid if mail sent to that address by the licensee has been returned by the postal authorities as undeliverable and if subsequent attempts by the licensee to obtain a current valid address for the individual have been unsuccessful.
Department--The Insurance Department of the Commonwealth.
Financial institution--An institution the business of which is engaging in activities that are financial in nature or incidental to the financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C.A. § 1843(k)). The term does not include the following:
(i) A person or entity with respect to any financial activity that is subject to the jurisdiction of the Commodity Futures Trading Commission under the Commodity Exchange Act (7 U.S.C.A. §§ 1--25).
(ii) The Federal Agricultural Mortgage Corporation or any entity charged and operating under the Farm Credit Act of 1971 (12 U.S.C.A. §§ 2001--2279cc).
(iii) Institutions chartered by Congress specifically to engage in securitizations, secondary market sales (including sales of servicing rights) or similar transactions related to a transaction of a consumer, as long as the institutions do not sell or transfer nonpublic personal financial information to a nonaffiliated third party.
Financial product or service--A product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to the financial activity under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C.A. § 1843(k)). Financial service includes a financial institution's evaluation or brokerage of information that the financial institution collects in connection with a request or an application from a consumer for a financial product or service.
Health care--The term includes the following:
(i) Preventative, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, services, procedures, tests or counseling that either:
(A) Relates to the physical, mental or behavioral condition of an individual.
(B) Affects the structure or function of the human body or any part of the human body, including the banking of blood, sperm, organs or any other tissue.
(ii) Prescribing, dispensing or furnishing to an individual drugs or biologicals, or medical devices or health care equipment and supplies.
Health care provider--A physician or other health care practitioner licensed, accredited or certified to perform specified health services consistent with State law, or a health care facility.
Health information--Any information or data except age or gender, whether oral or recorded in any form or medium, created by or derived from a health care provider or the consumer or customer that relates to one or more of the following:
(i) The past, present or future physical, mental or behavioral health or condition of an individual.
(ii) The provision of health care to an individual.
(iii) Payment for the provision of health care to an individual.
Insurance product or service--A product or service that is offered by a licensee under the insurance laws of the Commonwealth. Insurance service includes a licensee's evaluation, brokerage or distribution of information that the licensee collects in connection with a request or an application from a consumer for an insurance product or service.
Licensee--
(i) A licensed insurer, as defined in section 201-A of the act (40 P. S. § 65.1-A), a producer and other persons or entities licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered under the act or The Insurance Company Law of 1921 (40 P. S. §§ 341--999), including health maintenance organizations holding a certificate of authority under section 201 of the Health Care Facilities Act (35 P. S. § 448.201).
(ii) The term does not include:
(A) Bail bondsmen as defined in 42 Pa.C.S. § 5741 (relating to definitions).
(B) Motor vehicle physical damage appraisers as defined in section 2 of the Motor Vehicle Physical Damage Appraiser Act (63 P. S. § 852) and § 62.1 (relating to definitions).
(C) Public adjusters as defined in section 1 of the act of December 20, 1983 (P. L. 260, No. 72) (63 P. S. § 1601) and § 115.1 (relating to definitions).
(D) An entity providing continuing care as defined in section 3 and licensed under section 4 of the Continuing-Care Provider Registration and Disclosure Act (40 P. S. §§ 3203 and 3204).
(iii) Subject to subparagraph (iv), the term does not include governmental health insurance programs such as the following:
(A) The Children's Health Insurance Program as provided for in the Children's Health Care Act (40 P. S. §§ 991.2301--991.2361).
(B) The Medicaid Program as provided for in 62 P. S. §§ 441.1--449.
(C) The Medicare+Choice Program as provided for in the Balanced Budget Act of 1997, sections 1851--1859, Medicare Part C under Title XVIII of the Social Security Act.
(iv) The term includes a licensee that enrolls, insures or otherwise provides insurance related services to participants that procure health insurance through a governmental health insurance program exempted under subparagraph (iii).
(v) A licensee is not subject to the notice and opt out requirements for nonpublic personal financial information in Subchapters A--D if the licensee is an employee, agent or other representative of another licensee (''the principal'') and both of the following apply:
(A) The principal otherwise complies with, and provides the notices required by, this chapter.
(B) The licensee does not disclose nonpublic personal financial information to any person other than the principal or its affiliates in a manner permitted by this chapter.
(vi) Subject to subparagraph (vii), the term ''licensee'' shall also include a nonadmitted insurer that accepts business placed through a surplus lines licensee (as defined in 40 P. S. § 991.1602 (relating to definition of surplus lines licensee)) in this Commonwealth, but only in regard to the surplus lines placements placed under Article XVI of The Insurance Company Law (40 P. S. §§ 991.1601--991.1625).
(vii) A surplus lines licensee or surplus lines insurer shall be deemed to be in compliance with the notice and opt out requirements for nonpublic personal financial information in Subchapters A--D provided both of the following apply:
(A) The surplus lines licensee or insurer does not disclose nonpublic personal financial information of a consumer or a customer to nonaffiliated third parties for any purpose, including joint servicing or marketing under § 146a.31 (relating to exception to opt out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing), except as permitted by § 146a.32 or § 146a.33 (relating to exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions; and other exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information).
(B) The broker or insurer delivers a notice to the consumer at the time a customer relationship is established on which the following is printed in 16-point type:
Privacy Notice
''Neither the U. S. brokers that have handled this insurance nor the insurers that have underwritten this insurance will disclose nonpublic personal financial information concerning the buyer to nonaffiliated third parties except as permitted by law.''
Nonaffiliated third party--
(i) Any person except either:
(A) A licensee's affiliate.
(B) A person employed jointly by a licensee and any company that is not the licensee's affiliate (but nonaffiliated third party includes the other company that jointly employs the person).
(ii) Nonaffiliated third party includes any company that is an affiliate solely by virtue of the direct or indirect ownership or control of the company by the licensee or its affiliate in conducting merchant banking or investment banking activities of the type described in section 4(k)(4)(H) or insurance company investment activities of the type described in section 4(k)(4)(I) of the Federal Bank Holding Company Act (12 U.S.C.A. §§ 1843(k)(4)(H) and (I)).
Nonpublic personal financial information--
(i) The term means the following:
(A) Personally identifiable financial information.
(B) Any list, description or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable financial information that is not publicly available.
(ii) The term does not include any of the following:
(A) Publicly available information, except as included on a list described in subparagraph (i)(B).
(B) Any list, description or other grouping of consumers (and publicly available information pertaining to them) that is derived without using any personally identifiable financial information that is not publicly available.
(C) Health information.
(iii) Examples of lists are as follows:
(A) Nonpublic personal financial information includes any list of individuals' names and street addresses that is derived in whole or in part using personally identifiable financial information that is not publicly available, such as account numbers.
(B) Nonpublic personal financial information does not include any list of individuals' names and addresses that contains only publicly available information, is not derived in whole or in part using personally identifiable financial information that is not publicly available, and is not disclosed in a manner that indicates that any of the individuals on the list is a consumer of a financial institution.
Personally identifiable financial information--
(i) The term means any of the following:
(A) Information that a consumer provides to a licensee to obtain an insurance product or service from the licensee.
(B) Information about a consumer resulting from a transaction involving an insurance product or service between a licensee and a consumer.
(C) Information that the licensee otherwise obtains about a consumer in connection with providing an insurance product or service to that consumer.
(ii) Examples are as follows:
(A) Information included. Personally identifiable financial information includes:
(I) Information a consumer provides to a licensee on an application to obtain an insurance product or service.
(II) Account balance information and payment history.
(III) The fact that an individual is or has been one of the licensee's customers or has obtained an insurance product or service from the licensee.
(IV) Information about the licensee's consumer if it is disclosed in a manner that indicates that the individual is or has been the licensee's consumer.
(V) Information that a consumer provides to a licensee or that the licensee or its agent otherwise obtains in connection with collecting on a loan or servicing a loan.
(VI) Information the licensee collects through an Internet cookie (an information-collecting device from a web server).
(VII) Information from a consumer report.
(B) Information not included. Personally identifiable financial information does not include:
(I) A list of names and addresses of customers of an entity that is not a financial institution.
(II) Information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names or addresses.
(III) Health information.
Publicly available information--Information that a licensee has a reasonable basis to believe is lawfully made available to the public from one or more of the following:
(i) Federal, State or local government records.
(ii) Widely distributed media.
(iii) Disclosures to the public that are required to be made by Federal, State or local law.
Reasonable basis--
(i) A licensee has a reasonable basis to believe that information is lawfully made available to the public if the licensee has taken steps to determine the following:
(A) That the information is of the type that is available to the public.
(B) Whether an individual can direct that the information not be made available to the public and, if so, that the licensee's consumer has not done so.
(ii) The term includes the following conditions:
(A) A licensee has a reasonable basis to believe that mortgage information is lawfully made available to the public if the licensee has determined that the information is of the type included on the public record in the jurisdiction where the mortgage would be recorded.
(B) A licensee has a reasonable basis to believe that an individual's telephone number is lawfully made available to the public if the licensee has located the telephone number in the telephone book or the consumer has informed the licensee that the telephone number is not unlisted.
(iii) Examples are as follows:
(A) Government records. Publicly available information in government records includes information in government real estate records and security interest filings.
(B) Widely distributed media. Publicly available information from widely distributed media includes information from a telephone book, a television or radio program, a newspaper or a website that is available to the public on an unrestricted basis. A website is not restricted merely because an Internet service provider or a site operator requires a fee or a password, so long as access is available to the public.
Subchapter B. PRIVACY AND OPT OUT NOTICES FOR FINANCIAL INFORMATION Sec.
146a.11. Initial privacy notice to consumers required. 146a.12. Annual privacy notice to customers required. 146a.13. Information to be included in privacy notices. 146a.14. Form of opt out notice to consumers and opt out methods. 146a.15. Revised privacy notices. 146a.16. Delivery. § 146a.11. Initial privacy notice to consumers required.
(a) Initial notice requirement. A licensee shall provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to:
(1) Customer. An individual who becomes the licensee's customer, not later than when the licensee establishes a customer relationship, except as provided in subsection (e).
(2) Consumer. A consumer, before the licensee discloses nonpublic personal financial information about the consumer to any nonaffiliated third party, if the licensee makes a disclosure other than as authorized by §§ 146a.32 and 146a.33 (relating to exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions; and other exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information).
(b) When initial notice to a consumer is not required. A licensee is not required to provide an initial notice to a consumer under subsection (a)(2) if either:
(1) The licensee does not disclose any nonpublic personal financial information about the consumer to any nonaffiliated third party, other than as authorized by §§ 146a.32 and 146a.33, and the licensee does not have a customer relationship with the consumer.
(2) A notice has been provided by an affiliated licensee, as long as the notice clearly identifies all licensees to whom the notice applies and is accurate with respect to the licensee and the other institutions.
(c) When the licensee establishes a customer relationship.
(1) General rule. A licensee establishes a customer relationship at the time the licensee and the consumer enter into a continuing relationship.
(2) Examples of establishing customer relationship. A licensee establishes a customer relationship when the consumer either:
(i) Becomes a policyholder of a licensee that is an insurer when the insurer delivers an insurance policy or contract to the consumer, or in the case of a licensee that is an insurance producer or insurance broker, obtains insurance through that licensee.
(ii) Agrees to obtain financial, economic or investment advisory services relating to insurance products or services for a fee from the licensee.
(d) Existing customers. When an existing customer obtains a new insurance product or service from a licensee that is to be used primarily for personal, family or household purposes, the licensee satisfies the initial notice requirements of subsection (a) in either of the following ways:
(1) The licensee may provide a revised policy notice, under § 146a.15 (relating to revised privacy notices), that covers the customer's new insurance product or service.
(2) If the initial, revised or annual notice that the licensee most recently provided to that customer was accurate with respect to the new insurance product or service, the licensee does not need to provide a new privacy notice under subsection (a).
(e) Exceptions to allow subsequent delivery of notice.
(1) A licensee may provide the initial notice required by subsection (a)(1) within a reasonable time after the licensee establishes a customer relationship if either of the following conditions is met:
(i) Establishing the customer relationship is not at the customer's election.
(ii) Providing notice not later than when the licensee establishes a customer relationship would substantially delay the customer's transaction and the customer agrees to receive the notice at a later time.
(2) Examples of exceptions are as follows:
(i) Not at customer's election. Establishing a customer relationship is not at the customer's election if a licensee acquires or is assigned a customer's policy from another financial institution or residual market mechanism and the customer does not have a choice about the licensee's acquisition or assignment.
(ii) Substantial delay of customer's transaction. Providing notice not later than when a licensee establishes a customer relationship would substantially delay the customer's transaction when the licensee and the individual agree over the telephone to enter into a customer relationship involving prompt delivery of the insurance product or service.
(iii) No substantial delay of customer's transaction. Providing notice not later than when a licensee establishes a customer relationship would not substantially delay the customer's transaction when the relationship is initiated in person at the licensee's office or through other means by which the customer may view the notice, such as on a website.
(f) Delivery. When a licensee is required to deliver an initial privacy notice by this section, the licensee shall deliver it according to § 146a.16 (relating to delivery). If the licensee uses a short-form initial notice for noncustomers according to § 146a.13(d), the licensee may deliver its privacy notice according to § 146a.13(d)(3).
§ 146a.12. Annual privacy notice to customers required.
(a) Notice.
(1) General rule. A licensee shall provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. Annually means at least once in any period of 12 consecutive months during which that relationship exists. A licensee may define the 12-consecutive-month period, but the licensee shall apply it to the customer on a consistent basis.
(2) Example. A licensee provides a notice annually if it defines the 12-consecutive-month period as a calendar year and provides the annual notice to the customer once in each calendar year following the calendar year in which the licensee provided the initial notice. For example, if a customer opens an account on any day of year 1, the licensee shall provide an annual notice to that customer by December 31 of year 2.
(b) Termination.
(1) Termination of customer relationship. A licensee is not required to provide an annual notice to a former customer. A former customer is an individual with whom a licensee no longer has a continuing relationship.
(2) Examples.
(i) A licensee no longer has a continuing relationship with an individual if the individual no longer is a current policyholder of an insurance product or no longer obtains insurance services with or through the licensee.
(ii) A licensee no longer has a continuing relationship with an individual if the individual's policy is lapsed, expired or otherwise inactive or dormant under the licensee's business practices, and the licensee has not communicated with the customer about the relationship for a period of 12-consecutive months, other than to provide annual privacy notices, material required by law or regulation, or promotional materials.
(iii) For the purposes of this section, a licensee no longer has a continuing relationship with an individual if the individual's last known address according to the licensee's records is deemed invalid. An address of record is deemed invalid if mail sent to that address by the licensee has been returned by the postal authorities as undeliverable and if subsequent attempts by the licensee to obtain a current valid address for the individual have been unsuccessful.
(iv) A licensee no longer has a continuing relationship with a customer in the case of providing real estate settlement services, at the time the customer completes execution of all documents related to the real estate closing, payment for those services has been received, or the licensee has completed all of its responsibilities with respect to the settlement, including filing documents on the public record, whichever is later.
(c) Delivery. When a licensee is required by this section to deliver an annual privacy notice, the licensee shall deliver it according to § 146a.16 (relating to delivery).
§ 146a.13. Information to be included in privacy notices.
(a) General rule. The initial, annual and revised privacy notices that a licensee provides under §§ 146a.11, 146a.12 and 146a.15 (relating to initial privacy notice to consumers required; annual privacy notice to customers required; and revised privacy notices) shall include all of the following items of information, in addition to other information the licensee wishes to provide, that applies to the licensee and to the consumers to whom the licensee sends its privacy notice:
(1) The categories of nonpublic personal financial information that the licensee collects.
(2) The categories of nonpublic personal financial information that the licensee discloses.
(3) The categories of affiliates and nonaffiliated third parties to whom the licensee discloses nonpublic personal financial information, other than those parties to whom the licensee discloses information under §§ 146a.32 and 146a.33 (relating to exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions; and other exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information).
(4) The categories of nonpublic personal financial information about the licensee's former customers that the licensee discloses and the categories of affiliates and nonaffiliated third parties to whom the licensee discloses nonpublic personal financial information about the licensee's former customers, other than those parties to whom the licensee discloses information under §§ 146a.32 and 146a.33.
(5) If a licensee discloses nonpublic personal financial information to a nonaffiliated third party under § 146a.31 (relating to exception to opt out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing) (and no other exception in §§ 146a.32 and 146a.33 applies to that disclosure), a separate description of the categories of information the licensee discloses and the categories of nonaffiliated third parties with whom the licensee has contracted.
(6) An explanation of the consumer's right under § 146a.21(a) (relating to limitation on disclosure of nonpublic personal financial information to nonaffiliated third parties) to opt out of the disclosure of nonpublic personal financial information to any nonaffiliated third parties, including the methods by which the consumer may exercise that right at that time.
(7) Any disclosures that the licensee makes under section 603(d)(2)(A)(iii) of the Federal Fair Credit Reporting Act (15 U.S.C.A. § 1681a(d)(2)(A)(iii)).
(8) The licensee's policies and practices with respect to protecting the confidentiality and security of nonpublic personal financial information.
(9) Any disclosure that the licensee makes under subsection (b).
(b) Description of parties subject to exceptions. If a licensee discloses nonpublic personal financial information as authorized under §§ 146a.32 and 146a.33, the licensee is not required to list those exceptions in the initial or annual privacy notices required by §§ 146a.11 and 146a.12. When describing the categories of parties to whom disclosure is made, the licensee is required to state only that it makes disclosures to other affiliated or nonaffiliated third parties, as applicable, as permitted by law.
(c) Examples.
(1) Categories of nonpublic personal financial information that the licensee collects. A licensee satisfies the requirement to categorize the nonpublic personal financial information it collects if the licensee categorizes it according to the source of the information, as applicable:
(i) Information from the consumer.
(ii) Information about the consumer's transactions with the licensee or its affiliates.
(iii) Information about the consumer's transactions with nonaffiliated third parties.
(iv) Information from a consumer reporting agency.
(2) Categories of nonpublic personal financial information a licensee discloses.
(i) A licensee satisfies the requirement to categorize nonpublic personal financial information it discloses if the licensee categorizes the information according to source, as described in subsection (c)(1), as applicable, and provides examples to illustrate the types of information in each category. These examples include:
(A) Information from the consumer, including application information, such as assets and income and identifying information, such as name, address and Social Security number.
(B) Transaction information, such as information about balances, payment history and parties to the transaction.
(C) Information from consumer reports, such as a consumer's creditworthiness and credit history.
(ii) A licensee does not adequately categorize the information that it discloses if the licensee uses only general terms, such as transaction information about the consumer.
(iii) If a licensee reserves the right to disclose all of the nonpublic personal financial information about consumers that it collects, the licensee may simply state that fact without describing the categories or examples of nonpublic personal financial information that the licensee discloses.
(3) Categories of affiliates and nonaffiliated third parties to whom the licensee discloses.
(i) A licensee satisfies the requirement to categorize the affiliates and nonaffiliated third parties to which the licensee discloses nonpublic personal financial information about consumers if the licensee identifies the types of businesses in which they engage.
(ii) Types of businesses may be described by general terms only if the licensee uses illustrative examples of significant lines of business. For example, a licensee may use the term financial products or services if it includes appropriate examples of significant lines of businesses, such as life insurer, automobile insurer, consumer banking or securities brokerage.
(iii) A licensee also may categorize the affiliates and nonaffiliated third parties to which it discloses nonpublic personal financial information about consumers using more detailed categories.
(4) Disclosures under exception for service providers and joint marketers. If a licensee discloses nonpublic personal financial information under the exception in § 146a.31 to a nonaffiliated third party to market products or services that it offers alone or jointly with another financial institution, the licensee satisfies the disclosure requirement of subsection (a)(5) if it does all of the following:
(i) Lists the categories of nonpublic personal financial information it discloses, using the same categories and examples the licensee used to meet the requirements of subsection (a)(2), as applicable.
(ii) States whether the nonaffiliated third party is either:
(A) A service provider that performs marketing services on the licensee's behalf or on behalf of the licensee and another financial institution.
(B) A financial institution with whom the licensee has a joint marketing agreement.
(5) Simplified notices. If a licensee does not disclose, and does not wish to reserve the right to disclose, nonpublic personal financial information about customers or former customers to affiliates or nonaffiliated third parties except as authorized under §§ 146a.32 and 146a.33, the licensee may simply state that fact, in addition to the information it shall provide under subsection (a)(1), (8) and (9), and subsection (b).
(6) Confidentiality and security. A licensee describes its policies and practices with respect to protecting the confidentiality and security of nonpublic personal financial information if it does both of the following:
(i) Describes in general terms who is authorized to have access to the information.
(ii) States whether the licensee has security practices and procedures in place to ensure the confidentiality of the information in accordance with the licensee's policy. The licensee is not required to describe technical information about the safeguards it uses.
(d) Short-form initial notice with opt out notice for noncustomers.
(1) A licensee may satisfy the initial notice requirements in § 146a.11(a)(2) and § 146a.14(c) (relating to form of opt out notice to consumers and opt out methods) for a consumer who is not a customer by providing a short-form initial notice at the same time as the licensee delivers an opt out notice as required in § 146a.14.
(2) A short-form initial notice shall do all of the following:
(i) Be clear and conspicuous.
(ii) State that the licensee's privacy notice is available upon request.
(iii) Explain a reasonable means by which the consumer may obtain that notice.
(3) The licensee shall deliver its short-form initial notice according to § 146a.16 (relating to delivery). The licensee is not required to deliver its privacy notice with its short-form initial notice. The licensee instead may simply provide the consumer a reasonable means to obtain its privacy notice. If a consumer who receives the licensee's short-form notice requests the licensee's privacy notice, the licensee shall deliver its privacy notice according to § 146a.16.
(4) Examples of obtaining privacy notice are included in this paragraph. The licensee provides a reasonable means by which a consumer may obtain a copy of its privacy notice if the licensee does either of the following:
(i) Provides a toll-free telephone number that the consumer may call to request the notice.
(ii) For a consumer who conducts business in person at the licensee's office, maintains copies of the notice on hand that the licensee provides to the consumer immediately upon request.
(e) Future disclosures. The licensee's notice may include categories of:
(1) Nonpublic personal financial information that the licensee reserves the right to disclose in the future, but does not currently disclose.
(2) Affiliates or nonaffiliated third parties to whom the licensee reserves the right in the future to disclose, but to whom the licensee does not currently disclose, nonpublic personal financial information.
(f) Sample clauses. Sample clauses illustrating some of the notice content required by this section are included in Appendix A (relating to sample clauses).
[Continued on next Web Page]
No part of the information on this site may be reproduced for profit or sold for profit.This material has been drawn directly from the official Pennsylvania Bulletin full text database. Due to the limitations of HTML or differences in display capabilities of different browsers, this version may differ slightly from the official printed version.
