OGC Opinion No. 10-12-14

The Office of General Counsel issued the following opinion on December 30, 2010, representing the position of the New York State Insurance Department.

RE: XYZ, Inc. (d/b/a XYZ Purchasing Group) – Proposed Identity Theft Purchasing Group Insurance Program

Questions Presented:

1) May a New York-licensed excess line broker procure insurance for the New York members of a Purchasing Group providing coverage for electronic media liability, computer information security liability and privacy liability, which coverage is evidenced by certificates of insurance issued in this State to New York members by DEF Company (“DEF”), unauthorized insurer, and which certificates are issued under the group insurance policy (the “Master Policy”) issued to the Purchasing Group?

2) May the New York-licensed excess line broker that procures the certificates of insurance under the Master Policy covering New York members of the Purchasing Group electronically submit and file the excess line documents required by Insurance Law § 2118 (McKinney Supp. 2010) with the Excess Line Association of New York (“ELANY”)?

3) May the insurance transaction under the Program involving interactions between the Purchasing Group, the New York licensed excess line broker and the Purchasing Group’s New York members, from application through issuance of the certificate of insurance, be conducted entirely by electronic means?

4) Does the Total Cost Form that will be used under the Program as a service fee agreement by the New York licensed excess line broker, which is in electronic format and will be made available to each New York member of the Purchasing Group online, and upon which the electronic signature of the insured member will be affixed or otherwise associated with the Total Cost Form, constitute a written memorandum signed by the party to be charged in compliance with the requirement set forth in Insurance Law § 2119(c)(1)?

Conclusions:

1) Yes. A New York-licensed excess line broker may procure those types of coverage under the Master Policy for the New York members of the Purchasing Group whose risks are resident in
New York State that constitute liability insurance under the federal Liability Risk Retention Act, 15 U.S.C. §§ 3901 et seq. (“LRRA”) (West 2008).

2) Yes. The New York-licensed excess line broker may submit and file the excess line documents required by Insurance Law § 2118 (McKinney Supp. 2010) with ELANY electronically.

3) Yes, the entire transaction, from application through delivery of the certificate of insurance, may be conducted entirely by electronic means. However, only those New York members of the Purchasing Group who have consented to engage in an electronic transaction to obtain identity-theft insurance coverage through the Program may be required to participate in the insurance transaction by electronic means. As to those New York members of the Purchasing Group who have not consented to engage in an electronic transaction, the Program must accommodate such members’ needs and transactions involving them must be conducted using paper and non-electronic means of communication such as postal service mailings.

4) Yes, but only a Total Cost Form that has been electronically signed by a New York member who has consented to engage in an electronic transaction under the Program will be in compliance with the requirement set forth in Insurance Law § 2119(c)(1). As to those New York members of the Purchasing Group who have not consented to engage in an electronic transaction under the Program, in order to collect a service fee the New York licensed excess line broker must provide those members with a Total Cost Form in hard copy format to which the member may affix a “wet” signature, in order to comply with the statutory requirement.

Facts:

The inquirer reports that ABC, Inc. (“ABC”) is the insurance program administrator for XYZ, Inc. (d/b/a XYZ Purchasing Group). The Purchasing Group operates in 48 states and is registered as a purchasing group in New York State. ABC is licensed as a surplus line broker in all states; both the inquirer and ABC are licensed as property/casualty insurance brokers and excess line brokers in New York State. As of the time of the inquiry, the Purchasing Group was not doing business in New York State but plans to begin seeking New York members soon, pending the Department’s approval of its proposed program.

The Purchasing Group was established in April 2009 in Delaware and became registered as a purchasing group in New York State later that year. The Purchasing Group, in response to Question 13 of its registration application in New York State, described the nature of its membership as, “Each of the Members of the purchasing group operate businesses that collect, use and/or disclose personally identifiable information (PII) on its employees and/or customers. They also each belong to a data theft risk mitigation program that provides various risk management benefits, one of which is liability insurance provided at the same premium for each RPG member, respectively.” The inquirer is identified as the President and CEO of the Purchasing Group.

The inquirer reports that the Purchasing Group was formed to promote data theft risk management best practices and to make available to its members business liability insurance to cover their data theft and related risks.

The Proposed Program

The inquirer reports that business under the Program will be conducted electronically, to the extent possible, and the inquirer describes the elements of the proposed Program as follows:

1. ABC provides members with online access to insurance, including proper disclosures pertaining to excess lines market. Please see our online application and disclosure per Exhibit A, which includes a) excess lines disclosure and b) edited version of Total Cost Form per 2119. Other edited options remain.

2. In lieu of obtaining a written physical signature for Total Cost Form, which we understand is not required by ELANY but which process requires your approval, the insured would ‘sign’ electronically as per the ‘check box’ following their review, acknowledgement and agreement to the disclosure(s). Policy premium tax and stamping costs are provided on the Certificate of insurance issued to the Insured per Exhibit B.

3. Prior to providing the insured member with their Certificate, ABC would electronically submit each member’s certificate to ELANY for their review, approval and stamp. ELANY would, in turn, remit the Certificate back to ABC. ABC would then post the Certificate to the insured’s internet account.

The Web site of XYZ, Inc. reports that it created the purchasing group and that it is accessible to businesses that collect, use and disclose sensitive information. Further, ABC, “a pioneer and original provider of data and identity theft solutions” manages the purchasing group structure and operations and is its insurance program administrator. In addition, ABC, as the Purchasing Group’s program administrator and excess line broker, is responsible for all sales, billing, excess line disclosures and delivery of policies/certificates, non-renewals, return premiums and payment of premium taxes/fees. The inquirer acknowledges that ABC recognizes the need to seek the insurance in the authorized market and the inquirer represents that it made a diligent search before selecting DEF, which is an unauthorized insurer in New York State, to write the master policy to the Purchasing Group and issue the certificates to Purchasing Group members.

The Purchasing Group’s insurance policy provides low limits of “Data Theft liability insurance” coverage for its members. The inquirer reports that the expectation is that most of the members who purchase insurance coverage through the Purchasing Group will be small businesses. Because the premiums for the insurance are very small, approximately $50 per policy certificate each year, the inquirer asserts that the only way to provide the coverage efficiently is through the Purchasing Group’s online member’s section and portal on its Internet Web site. Thus, the inquirer asserts, the entire insurance process, from application through the delivery of certificates to members, will need to be effectuated by electronic means, to the extent possible. A Purchasing Group member can, if they wish, apply for and obtain the insurance by non-electronic means, on a special case basis.

The Purchasing Group members will complete and submit applications to ABC for insurance coverage under the Master Policy online and the member will be able to access the certificate of insurance issued to it online and print it out. Both the excess line disclosure and the Total Cost Form, which is a service fee agreement under Insurance Law § 2119, will be effectuated electronically online. The signing of the application and Total Cost Form will be effectuated online by the member checking off a box on the form, next to language indicating their intent to apply for coverage or to agree to pay the service fee to the excess line broker.

The certificate of insurance, below where it enumerates the types of coverage provided, contains the statement that the coverage is “Subject to Policy Aggregate Limit of Liability for Coverages A-F” of $50,000, except that Coverage G is in addition to the foregoing limit. The inquirer reports that the “aggregate limit” is for each Purchasing Group member individually, only as to its coverage, and not a group aggregate shared among the members.

The inquirer’s original inquiry letter stated that there were seven insurance coverages available under the Program. However, four of the coverages being offered did not appear to constitute liability insurance under the LRRA - - specifically, cyber extortion coverage, crisis management expense coverage, identity theft expenses coverage and breach notification expense coverage - and, therefore, could not be written on a group basis to the Purchasing Group, and the inquirer advised that the Purchasing Group will not be providing any of those coverages to its members, either in New York State or in other states in which it is conducting business, and that an endorsement has been issued to the Purchasing Group deleting the insuring agreements from the Purchasing Group’s Master Policy effective September 1, 2010. The Master Policy now affords only three insurance coverages - - electronic media liability, computer information security liability and privacy liability, to those members of the Purchasing Group who choose to purchase the insurance.

The insurance coverages that are currently being afforded under the policy are described in the insuring agreements section of the Master Policy, as follows:

A. Electronic Media Liability pays on behalf of the Insured damages and claims expenses which the Insured becomes legally obligated to pay because of a claim made against any Insured for specified acts with respect to the display of electronic content on the Insured’s Internet site. The specified acts include things such as defamation, violation of privacy rights, misappropriation of ideas, copyright infringement, infringement of domain names and improper deep-linking or framing.

B. Computer Information Security Liability pays on behalf of the insured damages and claims expenses which the Insured becomes legally obligated to pay: 1. because of a claim against the insured for theft or unauthorized disclosure of a data asset stored on computer systems, including theft of a data asset containing personally identifiable non-public information that results in identity theft; the alteration, corruption, destruction or deletion of a data asset shored on computer systems; or the failure to prevent the transmission of malicious code from computer systems to third party computer systems – that directly results from a failure of computer security to prevent a security breach. Or, 2. because of any claim against an insured for the theft of a data asset stored on the Insured’s hardware or data storage media that was physically stolen from a premises controlled by the Insured.

C. Privacy Liability pays on behalf of the Insured damages and claims expenses which the Insured becomes legally obligated to pay because of theft of personally identifiable non-public information that is in the care, custody or control of the Insured; the Insured’s failure to timely disclose a security breach in violation of any breach notice law; and failure by the Insured to comply with a privacy policy that prohibits or restricts the Insurer’s disclosure of a person’s information, or requires the Insured to provide access under certain conditions, or the Insured’s failure to comply with a privacy policy that prohibits or restricts disclosure or mandates procedures and requirements to prevent the loss of personally identifiable non-public information.

Analysis:

Section 3901(a)(5) of the federal Liability Risk Retention Act, 15 U.S.C. §§ 3901 et seq. (“LRRA”), which is relevant to the inquiry, defines “purchasing group” as follows:

(5) ‘purchasing group’ means any group which –

(A) has as one of its purposes the purchase of liability insurance on a group basis;

(B) purchases such insurance only for its group members and only to cover their similar or related liability exposure, as described in subparagraph (C);

(C) is composed of members whose businesses or activities are similar or related with respect to the liability to which members are exposed by virtue of any related, similar, or common business, trade, product, services, premises, or operations; and

(D) is domiciled in any State;

Article 59 of the New York Insurance Law implements the LRRA in New York State, and its language mirrors that of the LRRA.

1. Procuring Insurance Coverage on an Excess Line Basis under the Program for New York Members of the Purchasing Group

A purchasing group may purchase “liability” ¹ insurance, as the term is defined in the LRRA, on a group basis for its members that are resident in states in which the purchasing group is registered to do business. The three insurance coverages that are now being provided under the Purchasing Group’s Master Policy clearly constitute liability insurance because they cover the legal liability of a member business for damages to its customers resulting from incidents involving identity thefts that occur because of a failure on the part of the member to protect its customer’s identifying elements. A New York licensed excess line broker may procure these coverages on an excess line basis for the New York members in accordance with § 301.6 of Regulation 134 (N.Y. Comp. Codes R. & Regs. tit. 11, sec.301).

2. Electronic Filings of Excess Line Documents

The Department’s position, enunciated in Opinion of Office of General Counsel (“OGC Opinion”) No. 05-06-01 (June 2, 2005), is that Insurance Law §§ 2118(b)(7) and 2103(i) specifically provide that submission and filing of excess line documents may be accomplished by electronic or other media transmission as long as the Superintendent first approves the proposed methods of electronic submission, recording and stamping of these documents. In the foregoing opinion, the Department also concluded that there is nothing in the Insurance Law that prohibits the use of electronic signatures on excess line broker affidavits submitted to ELANY.

ELANY has adopted a process and procedure for electronic submissions to it and it does accept excess line documents that are submitted to it electronically. Once ELANY receives excess line documents electronically, if they are acceptable and in compliance with the law, ELANY will stamp the documents electronically. The inquirer had originally presented to ELANY a proposal that the purchasing group itself would stamp the excess line documents applicable to its New York members in real-time, prior to their submission to ELANY, but ELANY rejected this idea. The Department concurs with ELANY that such self-stamping of the electronic documents by the Purchasing Group would not be in compliance with Insurance Law § 2118(b) and Regulation 41 (N.Y. Comp. Codes R. & Regs. tit.11, sec. 27), which require that the documents be submitted by the New York licensed excess line broker to ELANY for stamping. Section 27.6 of the Regulation provides as follows:

(a) Within 45 days after date of procurement of a policy from an unauthorized insurer, the excess line broker shall submit to the excess line association, for recording and stamping, all documents required by section 2118 of the Insurance Law, including all affidavits required by section 27.5 of this Part.

(b) No excess line broker shall deliver, nor provide to any producing broker for delivery, an excess line insurance policy declarations page or cover note unless the first page of the declarations page or cover note bears the stamp applied by the Excess Line Association of New York or a duplicate copy of the declarations page or cover note bearing the stamp is attached to the original.

Subdivision (b) of Section 301.6 of Regulation 134 addresses the excess line broker requirement in the context of a purchasing group situation and it states as follows:

(b) An excess line broker procuring a liability insurance policy from an unauthorized insurer for a purchasing group or a member of such group shall in such transaction comply with sections 2117, 2118 and 2122 of the Insurance Law and Part 27 (Regulation No. 41) of this Title, in the following manner:
(1) Affidavit by broker or an excess line broker, evidencing the requisite number or declinations, may be executed and filed by the licensee on behalf of more than one member of a purchasing group, where liability insurance for such members was procured during the 30 days prior to the filing of the affidavit, provided that such affidavit specifies all applicable information required in the affidavit for each such included member.
(2) Affidavit by insured. The required affidavit by the insured shall be executed by and filed for each insured member of the purchasing group.

3. Conducting the Insurance Transactions Under the Program by Electronic Means

The Department has consistently encouraged the use of electronic transactions in connection with the marketing and sale of insurance. See Circular Letter No. 33 (1999) and Supplement 1 to Circular Letter No. 33 (September 3, 2003). However, in effectuating an electronic insurance transaction, those statutes that require that the elements of a transaction must be done in a certain manner are not preempted. Most statutory requirements contained in the Insurance Law may be met in an electronic environment; most existing provisions of the Insurance Law do not pose any impediment to electronic commerce. For example, those statutes requiring a “writing” permit electronic documents.

The federal Electronic Signatures in Global and National Commerce Act (“E-Sign”), 15 U.S.C.A. §§ 7001-7031, provides that electronic records may not be denied legal effect, validity or enforceability because they are created electronically. Also, under E-Sign, consumer’s consent to the use of an electronic record must be obtained. See, 15 U.S.C.A. § 7001(c)(1). Similarly, § 306 of New York State’s Electronic Signatures and Records Act (“ESRA”), Article III of the N.Y. State Tech. Law (McKinney Supp. 2010) provides that in any legal proceeding under the Civil Practice Law and Rules an electronic record or an electronic signature may be admitted into evidence.

N.Y. State Tech. Law § 304 (McKinney Supp. 2010) provides that:

Nothing in this article shall require any entity or person to use an electronic record or an electronic signature unless otherwise provided by law.

Therefore, a member applying for insurance may not be required to use an electronic record or electronic signature under the Program. Further, § 309 provides that nothing in Article III shall require that an entity or person use either an electronic record or an electronic signature, unless otherwise required by law. Thus, engaging in an electronic transaction involving both electronic records and electronic signatures must be voluntary. This means that a person may not be required to engage in an electronic transaction or to use an electronic signature without consent, and to use an electronic signature is fundamental to the validity of an electronic transaction. See OGC Opinion No. 07-02-20 (February 22, 2007) and OGC Opinion No.08-04-05 (April 2, 2008).

As to those members of the Purchasing Group who have chosen to engage in an electronic transaction in connection with procuring insurance under the Program the entire insurance transaction, all of the elements of the insurance transaction under the Program, from application through delivery of the certificate of insurance coverage, may be effectuated electronically. See OGC Op. No.08-04-05.

However, any member who has not consented to engage in an electronic transaction under the Program, for example, a member who has not chosen to engage in an electronic transaction in connection with procuring insurance under the Program, must be accommodated and be afforded the means to participate in the insurance transaction by other than electronic means. Specifically, this would involve correspondence by mail and the ability to sign documents by applying their “wet” signature to a paper document, including the application and the Total Cost Form (discussed below). The inquirer confirmed that such persons would be able to apply for and be issued the insurance coverage off-line, using paper forms that they can sign by hand.

4. The Total Cost Form

The New York licensed excess line broker under the Program proposes to utilize a Total Cost Form in electronic format in order to meet the following requirements contained in Insurance Law § 2119(c)(1):

(c)(1) No insurance broker may receive any compensation, other than commissions deductible from premiums on insurance policies or contracts, from any insured or prospective insured for or on account of the sale, solicitation or negotiation of, or other services in connection with, any contract of insurance made or negotiated in this state or for any other services on account of such insurance policies or contracts, including adjustment of claims arising therefrom, unless such compensation is based upon a written memorandum, signed by the party to be charged, and specifying or clearly defining the amount or extent of such compensation. [Emphasis added]

Under the Program, an electronic Total Cost Form will be available online to Purchasing Group members and they will sign the form electronically, online. The electronic version of the Total Cost Form constitutes a “written memorandum” and it meets that part of the statutory requirements. The statute also requires that the written memorandum be signed by the party to be charged, in this instance by the member of the Purchasing Group who is being charged the service fee by the excess line broker. Here, the signature of the member, the party to be charged, would be evidenced by the member’s checking off a box on the electronic form, which appears next to language indicating that by checking the box they are thereby indicating the member’s intent to agree to pay the service fee specified on the form to the New York licensed excess line broker. The same process to effectuate a signature will also be used on the insurance application.

The term “electronic signature” is defined in ESRA § 302(3) as follows:

…an electronic sound, symbol or process, attached to or logically associated with an electronic record and executed or adopted by a person with the intent to sign the record.

A checked box on an electronic form on the Internet constitutes a valid electronic signature in New York because it is an electronic symbol or process that is logically associated with the electronic record and the act of the Purchasing Group member in marking off the checked box evidences their intent to sign the total cost form. See, OGC Opinion dated September 16, 2005. The burden is on the broker to demonstrate that adequate protocols are in place to ensure the validity of these signatures.

However, as noted in the analysis to Question 3 above, applicable law provides that persons may not be required to engage in an electronic transaction, and the same analysis applies to the signing of a Total Cost Form, which is a part of the insurance transaction under the Program. Therefore, electronic Total Cost Forms prepared for those members of the Purchasing Group who have consented to engage in an electronic transaction under the Program and upon which the member affixes their electronic signature would meet the statutory requirement for a written memorandum signed by the party to be charged and under which the licensed excess line broker may collect a service fee. However, as to those members of the Purchasing Group who have not consented to engage in an electronic transaction under the Program, in order to collect a service fee from them, the licensed excess line broker would have to provide them with a Total Cost Form in hard copy format upon which the member could then affix his or her “wet” signature to the form in order for the excess line broker to be in compliance with the statutory requirement.

For further information you may contact Principal Attorney Barbara A. Kluger at the New York City Office.

¹ Section 3901(a) (2) of the LRRA defines the term as follows: “’liability’ – (A) means legal liability for damages (including costs of defense, legal costs and fees, and other claims expenses) because of injuries to other persons, damage to their property, or other damage or loss to such other persons resulting from or arising out of – (i) any business (whether profit or nonprofit), trade, product, services premises, or operations, or (ii) any activity of any State or local government, or any agency or political subdivision thereof; and (B) does not include personal risk liability and an employer’s liability with respect to its employees other than legal liability under the Federal Employers’ Liability Act (45 U.S.C. 1 et seq.).”