AZ Regulatory Bulletin 2002-02: Information Privacy Issues; Correction of Bulletin 2001-11

STATE OF ARIZONA

DEPARTMENT OF INSURANCE

JANE DEE HULL

2910 NORTH 44th STREET, SUITE 210

CHARLES R. COHEN

Governor

PHOENIX, ARIZONA 85018-7256

Director of Insurance

602/912-8456 (phone) 602/912-8452 (fax)

Regulatory Bulletin 2002-02

TO:

Insurance Institutions, Producers, Insurance Support Organizations,

Insurance Trade Associations and Other Interested Parties

FROM:

Charles R. Cohen

Director of Insurance

DATE:

February 25, 2002

RE:

Information Privacy Issues; Correction of Bulletin 2001-11

This bulletin revises information contained in Regulatory Bulletin 2001-11, issued on

August 31, 2001, regarding the Department’s interpretation of the contents of the

privacy notice required by A.R.S. § 20-2104.

A.R.S. § 20-2104(C) provides that the notice shall include certain information listed in

the subsection or “shall either contain the information required for compliance with the

notice requirements established under section 503 of the Gramm Leach Bliley act (15

U.S.C. § 6803)…” In regulatory bulletin 2001-11, the Department interpreted this

provision as follows:

If an insurance entity elects to use the GLB notice it has developed for use

in other states as its notice under A.R.S. § 20-2104, the insurance entity

must include an addendum that apprises applicants and policyholders of

their rights under A.R.S. §§ 20-2108 and 20-2109.…In Arizona,

information practices include the rights and procedures set forth in A.R.S.

§§ 20-2108 and 20-2109. Consequently, those practices must be

disclosed in, or as an addendum to, the privacy notice used in Arizona.

Several insurers have questioned the Department’s interpretation of A.R.S. § 20-2104,

contending that use of the term “or” in the statute must be read to permit either the

information listed in A.R.S. § 20-2104(C) or the information listed in 15 U.S.C. § 6803.

The Department agrees, and withdraws that portion of the circular letter that requires an

insurer using its GLB notice to also include, either in the notice or in an addendum, the

rights specified in A.R.S

f A.R.S. § 20-2104,

contending that use of the term “or” in the statute must be read to permit either the

information listed in A.R.S. § 20-2104(C) or the information listed in 15 U.S.C. § 6803.

The Department agrees, and withdraws that portion of the circular letter that requires an

insurer using its GLB notice to also include, either in the notice or in an addendum, the

rights specified in A.R.S. § 20-2108 and 20-2109.

Regulatory Bulletin 2002-02

02/25/02

Page 2

GLB does require that the notice describe an insurance entity’s “policies and

practices…with respect to disclosing nonpublic personal information to nonaffiliated

third parties…” GLB § 503(b). The Department does wish to remind insurers using a

GLB notice that the notice must accurately reflect the insurer’s practices in Arizona.

Arizona law imposes greater restrictions on disclosure of information to nonaffiliated

third parties. A.R.S. § 20-2113 prohibits disclosure of an individual’s personal

information unless the individual has either consented to disclosure or there is an

applicable exception. A.R.S. § 20-2113(11) allows disclosure of very limited

information1 to a person who wishes to use the information for marketing a product or

service if the insurer or producer gives the individual an opportunity to opt out and the

individual does not opt out. The person receiving the information must agree to no

further disclosure. Unlike with GLB, Arizona law does not permit an insurer to share

nonpublic information when an insured fails to opt out.

It is the Department’s interpretation that in allowing an insurer to use its GLB notice, the

Legislature did not intend to remove or change any substantive protections against

disclosure that are found in A.R.S. § 20-2113. Thus, when using a GLB notice, insurers

must be careful to make sure that the notice accurately reflects the insurer's policies

and practices in Arizona for disclosure of information to third parties

interpretation that in allowing an insurer to use its GLB notice, the

Legislature did not intend to remove or change any substantive protections against

disclosure that are found in A.R.S. § 20-2113. Thus, when using a GLB notice, insurers

must be careful to make sure that the notice accurately reflects the insurer's policies

and practices in Arizona for disclosure of information to third parties.

Please direct any questions about this regulatory bulletin to Vista Thompson Brown,

Executive Assistant for Policy Affairs, 602-912-8456, vbrown@id.state.az.us.

1 Under this exception, the insurance entity may not share: (1) medical record information, (2) privileged

information, (3) personal information relating to an individual’s character, personal habits, mode of living

or general reputation, or (4) any classification derived from the individual’s information.