The Office of General Counsel issued the following informal opinion on November 13, 2001, representing the position of the New York State Insurance Department.
Re: Agent's disclosure of information to another insurer N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0-420.24 (2001) (Reg. 169)
Does an agents disclosure of insureds declaration pages, which contain nonpublic personal financial information, in order to have another insurer re-write the book of business, fall under the N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.14 or 420.15 (2001) exceptions to the notice and opt out requirements?
This disclosure would fall under the N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.14 exception, provided that the transaction is at the insureds request or with his authorization. The annual privacy notice requirement for customers contained in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.5 (2001) would, nevertheless, apply.
No additional facts were presented.
The inquirer did not indicate whether the transfer of business to another insurer is being done at the consumers request or with their authorization. Licensees should be aware that the transfer of a policy, not at the consumers request or with his authorization, might exceed the licensees authority to act on the consumer's behalf.
Assuming the transfer is done at the consumers request, N.Y. Comp. Codes R. & Regs. tit. 11, § 420.10(a)(1) (2001) would be applicable to disclosure of the insureds nonpublic personal financial information. It provides:
Conditions for disclosure. Except as otherwise authorized in this Part, a licensee may not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless:
(i) The licensee has provided to the consumer an initial notice as required under section 420.4 of this Part;
(ii) The licensee has provided to the consumer an opt out notice as required in section 420.7 of this Part.
(iii) The licensee has given the consumer a reasonable opportunity, before the licensee discloses the information to the nonaffiliated third party, to opt out of the disclosure; and
(iv) The consumer does not opt out.
N.Y. Comp. Codes R. & Regs. tit. 11, § 420.10(a)(2) (2001) provides:
Opt out definition. Opt out means a direction by the consumer that the licensee not disclose nonpublic personal financial information about that consumer to a nonaffiliated third party, other than as permitted by sections 420.13, 420.14 or 420.15 of this Part.
However, N.Y. Comp. Codes R. & Regs. tit. 11, § 420.14 (2001) contains exceptions to the initial notice and opt out requirements applicable to disclosure of nonpublic personal financial information for processing and servicing transactions. It provides:
(a) Exceptions for processing transactions at consumers request. The requirements for initial notice to the consumer in section 420.4(a)(2) of this Part, and the opt out provisions in sections 420.7 and 420.10of this Part and their application to service providers and joint marketing as described in section 420.13 of this Part, do not apply if the licensee discloses nonpublic personal financial information as necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes,or in connection with:
(1) Servicing or processing an insurance product or service that a consumer requests or authorizes;
(2) Maintaining or servicing the consumer's account with the licensee, or with another entity as part of a private label credit card program or other extension of credit on behalf of such entity;
(3) A proposed or actual securitization, secondary market sale (including sales of servicing rights), or similar transaction related to a transaction of the consumer;
(4) Reinsurance or stop loss or excess loss insurance; or
(5) The solicitation of insurance quotes on behalf of a consumer by an insurance agent or broker.
(b) "Necessary to effect, administer, or enforce a transaction" means that the disclosure is:
(1) Required, or is one of the lawful or appropriate methods, to enforce the licensee's rights or the rights of other persons engaged in carrying out the financial transaction or providing the product or service; or
(2) Required, or is a usual, appropriate, or acceptable method:
(i) To carry out the transaction or the product or service business of which the transaction is a part, and record, service or maintain the consumer's account in the ordinary course of providing the insurance product or service;
(ii) To administer or service benefits or claims relating to the transaction or the product or service business of which it is a part;
(iii) To provide a confirmation, statement or other record of the transaction, or information on the status or value of the insurance product or service to the consumer or the consumers agent or broker;
(iv) To accrue or recognize incentives or bonuses associated with the transaction that are provided by a licensee or any other party;
(v) To underwrite insurance at the consumers request or for reinsurance purposes, or for any of the following purposes as they relate to a consumers insurance: account administration, reporting, investigating or, preventing fraud or material misrepresentation, processing premium payments, processing insurance claims, administering insurance benefits (including utilization review activities), participating in research projects or as otherwise required or specifically permitted by federal or state law; or
(vi) In connection with:
(a) The authorization, settlement, billing, processing, clearing, transferring, reconciling or collection of amounts charged, debited, or otherwise paid using a debit, credit, or other payment card, check, or account number, or by other payment means;
(b) The transfer of receivables, accounts, or interests therein; or
(c) The audit of debit, credit, or other payment information.
Disclosure of the insureds declaration page, which contains nonpublic personal financial information, would come within the above exception, provided that the policy was being moved to another insurer at the insureds request. In such a case the disclosure would be "necessary to effect, administer or enforce a transaction that a consumer requests or authorizes . . ." and, accordingly, the exception in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.14 (2001) pertaining to the initial notice and opt out requirements would apply. The annual privacy notice requirement for customers contained in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.5 (2001) would, nevertheless, apply.
For further information you may contact Supervising Attorney Joan Siegel at the New York City Office.