Act 1526 of 2005

Arkansas Insurance Department

Mike Huckabee

Julie Benafield Bowman

Governor

Commissioner

January 17, 2006

BULLETIN NO. 1-2006

TO:

All Licensed Foreign, Alien and Domestic Insurers, Accredited/Trusteed

Reinsurers, Farmers' Mutual Aid Associations, Hospital and Medical Service

Corporation, Health Maintenance Organizations, Fraternal Benefit Societies,

Insurer Trade Associations, Rate Service or Advisory Organizations; All Agent

and Broker Trade Associations, All Third Party Administrators, Adjuster Trade

Association; Approved But Not Admitted Surplus Line Insurers and Licensed

Funeral Directors Holding Permits to sell Prepaid Funeral Benefit Contract;

Licensed Employee Leasing Firms/Groups; Licensed Managing General

Agents/Agencies; Registered Life Care and Continuing Care Facilities; Licensed

Surplus Line Brokers; Registered Notary Bond Surety Corporations; and Other

Interested Parties.

FROM:

ARKANSAS INSURANCE DEPARTMENT

SUBJECT:

ACT 1526 of 2005

The Arkansas Insurance Department issues this Bulletin to inform all above-referenced parties

of Act 1526 of 2005 (“Act”), codified as Ark. Code Ann. §§ 4-110-101, et seq. The stated

purpose of the Act is to ensure that Arkansans’ sensitive personal information is protected. The

Act requires all persons or businesses to take all reasonable steps to destroy such information

that is not to be retained. “Business” includes “a financial institution organized, chartered, or

holding a license or authorization certificate under the law of this state, or any other state, the

United States, or of any other country or the parent or subsidiary of a financial institution.” Ark.

Code Ann. § 4-110-103(2)(A).

The destruction of customers’ personal information must be accomplished so that the

information is unreadable and undecipherable. Businesses must also, with some exceptions,

inform customers when there has been a breach of security

te, or any other state, the

United States, or of any other country or the parent or subsidiary of a financial institution.” Ark.

Code Ann. § 4-110-103(2)(A).

The destruction of customers’ personal information must be accomplished so that the

information is unreadable and undecipherable. Businesses must also, with some exceptions,

inform customers when there has been a breach of security. This means that “any resident of

Arkansas whose unencrypted [computerized] personal information was, or is reasonably

believed to have been, acquired by an unauthorized person” must be notified if one of the

exceptions in Act 1526 does not apply.

The Act contains an exemption for persons or businesses that are regulated by state or federal

law that provides greater protection for personal information and at least as thorough disclosure

requirements for security breaches as are provided by the Act. Arkansas Insurance Department

Rule and Regulation 77, “Standards for Safeguarding Customer Privacy” was promulgated

pursuant to the federal Gramm-Leach-Bliley Act and Ark. Code Ann. § 23-63-113. Rule 77 does

not save Department licensees from having to comply with the Act, because Rule 77 does not

apply to all persons/business, while the Act does. Also, Rule 77 does not provide greater

1200 West Third Street, Little Rock, AR 72201-1904 · (501) 371-2600 · (501) 371-2618 fax · www.insurance.arkansas.gov

Information (800) 282-9134 · Consumer Services (800) 852-5494 · Seniors (800) 224-6330 · Criminal Inv. (866) 660-0888

icensees from having to comply with the Act, because Rule 77 does not

apply to all persons/business, while the Act does. Also, Rule 77 does not provide greater

1200 West Third Street, Little Rock, AR 72201-1904 · (501) 371-2600 · (501) 371-2618 fax · www.insurance.arkansas.gov

Information (800) 282-9134 · Consumer Services (800) 852-5494 · Seniors (800) 224-6330 · Criminal Inv. (866) 660-0888

protection and at least as thorough disclosure requirements as the Act; for instance, Rule 77

has no disclosure requirements for breaches of security.

Therefore, the Arkansas Insurance Department urges all persons and businesses, as defined in

the Act, to take steps to ensure that they are meeting all of the Act’s requirements, lest they be

subject to penalties. The Arkansas Attorney General is charged with enforcement of the Act.

The text of the Act can be found at http://www.arkleg.state.ar.us/. The statutes can be found at

the State of Arkansas website: http://www.state.ar.us/.

All carriers are instructed to provide copies of this Bulletin to their appointed producers.

Questions regarding this Bulletin should be directed to the Office of the Arkansas Attorney

General at 1-800-482-8982, 682-2341 or email www.arkansasag.gov.

(signed by Julie Benafield Bowman)+

________________________________

JULIE BENAFIELD BOWMAN

INSURANCE COMMISSIONER

(January 17, 2006)

________________________________

DATE