GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2001
S	4
SENATE BILL 461*
 Insurance and Consumer Protection Committee Substitute Adopted 4/24/01
 House Committee Substitute Favorable 7/18/01 
Fourth Edition Engrossed 7/24/01 

Short Title:	Insurance Information Privacy-AB.	()	
Sponsors:	     	
Referred to:	     	
March 15, 2001

A BILL TO BE ENTITLED
AN ACT TO MAKE THE NORTH CAROLINA INSURANCE INFORMATION AND PRIVACY PROTECTION ACT COMPLY WITH THE CONSUMER INFORMATION PRIVACY REQUIREMENTS IN THE FEDERAL GRAMM-LEACH-BLILEY ACT, PUBLIC LAW 106-102.  

The General Assembly of North Carolina enacts:
SECTION 1.  G.S. 58‑39‑10 reads as rewritten:
"§ 58‑39‑10.  Scope.
(a)	The obligations imposed by this Article shall apply to those insurance institutions, agents, or insurance‑support organizations  that:
(1)	In the case of life, health, or disability insurance:
a.	Collect, receive, or maintain information in connection with insurance transactions that pertains to natural persons who are residents of this State; or
b.	Engage in insurance transactions with applicants, individuals, or policyholders who are residents of this State; and
(2)	In the case of property or casualty insurance:
a.	Collect, receive, or maintain information in connection with insurance transactions involving policies, contracts, or certificates of insurance delivered, issued for delivery, or renewed in this State; 
b.	Engage in insurance transactions involving policies, contracts, or certificates of insurance delivered, issued for delivery, or renewed in this  State; or
c.	Engage in transactions involving mortgage guaranty insurance where the mortgage guaranty policies, contracts, or certificates of insurance are delivered, issued for delivery, or renewed in this State.
(b)	The rights granted by this Article shall extend to:
(1)	In the case of life, health, or disability insurance, the following persons who are residents of this State:
a.	Natural persons who are the subject of information collected, received, or maintained in connection with insurance transactions; and
b.	Applicants, individuals, or policyholders who engage in or seek to engage in insurance transactions;
(2)	In the case of property or casualty insurance, the following persons:
a.	Natural persons who are the subject of information collected, received, or maintained in connection with insurance transactions involving policies, contracts, or certificates of insurance delivered, issued for delivery, or renewed in this State; and
b.	Applicants, individuals, or policyholders who engage in or seek to engage in (i) insurance transactions involving policies, contracts, or certificates of insurance delivered, issued for delivery, or renewed in this State; or (ii) mortgage guaranty insurance transactions involving policies, contracts, or certificates of insurance delivered, issued for delivery, or renewed in this State.
(c)	For purposes of this section, a person shall be considered a resident of this State if the person's last known mailing address, as shown in the records of the insurance institution, agent, or insurance‑support organization, is located in this State.
(d)	Notwithstanding subsections (a) and (b) of this section, this Article shall not apply to information collected from the public records of a governmental authority and maintained by an insurance institution or its representatives for the purpose of insuring the title to real property located in this State.
(e)	This Article applies to credit insurance that is subject to Article 57 of this Chapter."
SECTION 2.  G.S. 58‑39‑15(1) reads as rewritten:
"(1)	"Adverse underwriting decision" means:
a.	Any of the following actions with respect to insurance transactions involving insurance coverage that is individually underwritten:
1.	A declination of insurance coverage;
2.	A termination of insurance coverage;
3.	Failure of an agent to apply for insurance coverage with a specific insurance institution that an agent represents and that is requested by an applicant;
4.	In the case of a property or casualty insurance coverage:
I.	Placement by an insurance institution or agent of a risk with a residual market mechanism, an unauthorized insurer, or an insurance institution that specializes in substandard risks; or
II.	The charging of a higher rate on the basis of information that differs from that which the applicant or policyholder furnished; or
5.	In the case of a life, health, or disability insurance coverage, an offer to insure at higher than standard rates.
b.	Notwithstanding subdivision (1)a. of this section, the following actions shall not be considered adverse underwriting decisions, but the insurance institution or agent responsible for their occurrence shall nevertheless provide the applicant or policyholder with the specific reason or reasons for their occurrence:
1.	The termination of an individual policy form on a class or statewide basis;
2.	A declination of insurance coverage solely because such coverage is not available on a class or statewide basis; or
3.	The rescission of a policy."
SECTION 3.  G.S. 58‑39‑15(9) reads as rewritten:
"(9)	"Individual" means any natural person who:
a.	In the case of property or casualty insurance, is a past, present, or proposed named insured or certificate holder;
b.	In the case of life, health, or disability insurance, is a past, present, or proposed principal insured or certificate holder;
c.	Is a past, present or proposed policy owner;
d.	Is a past or present applicant;
e.	Is a past or present claimant;
f.	Derived, derives, or is proposed to derive insurance coverage under an insurance policy or certificate subject to this Article; or
g.	Is the subject of personal information collected or maintained by an insurance institution, agent, or insurance‑support organization in connection with mortgage guaranty insurance." 
SECTION 4.  Article 39 of Chapter 58 of the General Statutes is amended by adding a new section to read:
"§ 58‑39‑26. Federal privacy disclosure notice requirements.
(a)	Disclosure Required. – In addition to the notice requirements of G.S. 58‑39‑25, an insurance institution or agent shall provide,  to all applicants and policyholders no later than (i) before the initial disclosure of personal information under G.S. 58‑39‑75(11) or (ii) the time of the delivery of the insurance policy or certificate,  a clear and conspicuous notice, in written or electronic form, of the insurance institution or agent's policies and practices with respect to:
(1)	Disclosing nonpublic personal information to affiliates and nonaffiliated third parties, consistent with section 502 of Public Law 106‑102, including the categories of information that may be disclosed.
(2)	Disclosing nonpublic personal information of persons who have ceased to be customers of the financial institution.
(3)	Protecting the nonpublic personal information of consumers.
These disclosures shall be made in accordance with the regulations prescribed under section 505 of Public Law 106‑102.
(b)	Information to Be Included. – The disclosure required by subsection (a) of this section shall include:
(1)	The policies and practices of the insurance institution or agent with respect to disclosing nonpublic personal information to nonaffiliated third parties, other than agents of the insurance institution or agent, consistent with section 502 of Public Law 106‑102, and including:
a.	The categories of persons to whom the information is or may be disclosed, other than the persons to whom the information may be provided under section 502(e) of Public Law 106‑102.
b.	The policies and practices of the insurance institution or agent with respect to disclosing of nonpublic personal information of persons who have ceased to be customers of the insurance institution or agent.
(2)	The categories of nonpublic personal information that are collected by the insurance institution or agent.
(3)	The policies that the insurance institution or agent maintains to protect the confidentiality and security of nonpublic personal information in accordance with section 501 of Public Law 106‑102.
(4)	The disclosures required, if any, under section 603(d)(2)(A)(iii) of the Fair Credit Reporting Act.
(c)	In the case of a policyholder, the notice required by this section shall be provided not less than annually during the continuation of the policy. As used in this subsection, 'annually' means at least once in any period of 12 consecutive months during which the policy is in effect."
SECTION 5.  Article 39 of Chapter 58 of the General Statutes is amended by adding a new section to read:
"§ 58‑39‑27. Privacy notice and disclosure requirement exceptions.
(a)	Under G.S. 58‑39‑25 and G.S. 58‑39‑26, an insurance institution or agent may provide a joint notice from the insurance institution or agent and one or more of its affiliates or other financial institutions, as defined in the notice, as long as the notice is accurate with respect to the insurance institution or agent and the other institutions.
(b)	An insurance institution or agent may satisfy the notice requirements of G.S. 58‑39‑25 and G.S. 58‑39‑26 by providing a single notice if two or more applicants or policyholders jointly obtain or apply for an insurance product.
(c)	An insurance institution or agent may satisfy the notice requirements of G.S. 58‑39‑25 and G.S. 58‑39‑26 through the use of separate or combined notices.
(d)	An insurance institution or agent is not required to provide the notices required by G.S. 58‑39‑25 and G.S. 58‑39‑26 to:
(1)	Any applicant or policyholder whose last known address, according to the insurance institution's or agent's records is deemed invalid. The applicant's or policyholder's last known address shall be deemed invalid if mail sent to that address has been returned by the postal authorities as undeliverable and if subsequent reasonable attempts to obtain a current valid address for the applicant or policyholder have been unsuccessful; or
(2)	Any policyholder whose policy is lapsed, expired, or otherwise inactive or dormant under the insurance institution's business practices, and the insurance institution has not communicated with the policyholder about the relationship for a period of 12 consecutive months, other than annual privacy notices, material required by law or regulation, or promotional materials.
(e)	If an agent does not share information with any person other than the agent's principal or an affiliate of the principal, and if the principal provides all notices required by G.S. 58‑39‑25 and G.S. 58‑39‑26, the agent is not required to provide the notices required by G.S. 58‑39‑25 and G.S. 58‑39‑26. G.S. 58‑39‑75 applies to the sharing of information with an affiliate under this subsection.
(f)	When an agent discloses a policyholder's personal information, other than medical information, to an insurance institution solely for the purposes of renewal, transfer, replacement, reinstatement, or modification of an existing policy, the agent is not required to provide the notices required by G.S. 58‑39‑25 and G.S. 58‑39‑26.
(g)	For the purposes of G.S. 58‑39‑26 only, the terms 'applicant' or 'policyholder' include respectively a person who applies for, or a certificate holder who obtains, insurance coverage under a group or blanket insurance contract, employee benefit plan, or group annuity contract, regardless of whether the coverage is individually underwritten. An insurance institution or agent that does not disclose personal information about an applicant or policyholder under a group or blanket insurance contract, employee benefit plan, or group annuity contract, except as permitted under G.S. 58‑39‑75(1) through (10) and G.S. 58‑39‑75(12) through (21), may satisfy any notice requirement that otherwise exists under G.S. 58‑39‑26 with respect to that applicant or policyholder by providing a notice of information practices to the holder of the group or blanket insurance or annuity contract or the employee benefit plan sponsor. If an insurance institution or agent discloses personal information about an applicant or policyholder as permitted by G.S. 58‑39‑75(11), it shall provide the notice required by G.S. 58‑39‑26 to the applicant or policyholder not less than 30 days before the information is disclosed, and it may satisfy any other notice requirement that otherwise exists under this section with respect to that applicant or policyholder by providing a notice of information practices to the holder of the group or blanket insurance or annuity contract or employee benefit plan sponsor."
SECTION 6.  Article 39 of Chapter 58 of the General Statutes is amended by adding a new section to read:
"§ 58‑39‑28. Exception for title and mortgage guaranty insurance.
(a)	A title insurance company shall give notice of its insurance information practices under G.S. 58‑39‑25 and G.S. 58‑39‑26 only at the time the final policy of title insurance is issued and is not subject to any annual notice requirement thereafter.
(b)	In the case of mortgage guaranty insurance, the notice required by G.S. 58‑39‑25 and G.S. 58‑39‑26 shall be provided at the time a master policy is issued and thereafter only if there is a material change in the insurer's policies and practices regarding the use or disclosure of personal information."
SECTION 7.  G.S. 58‑39‑75(1) reads as rewritten:
"(1)	With the written authorization of the individual, provided:
a.	If such authorization is submitted by another insurance institution, agent, or insurance‑support organization, the authorization meets the requirements of G.S. 58‑39‑35; or
b.	If such authorization is submitted by a person other than an insurance institution, agent, or insurance‑support organization, the authorization meets the requirements of G.S. 58‑39‑35 and is:
1.	Dated;
2.	Signed by the individual; and
3.	Obtained one year or less before the date a disclosure is sought pursuant to this paragraph; or".
SECTION 8.  G.S. 58‑39‑75(18) reads as rewritten:
"(18)	To a lienholder, mortgagee, assignee, lessor, or other person shown on the records of an insurance institution or agent as having a legal or beneficial interest in a policy of insurance only if:
a.	No medical record information is disclosed unless the disclosure would otherwise be permitted by this section; and
b.	The information disclosed is limited to that which is reasonably necessary to permit such person to protect its interest in such policy; or".
SECTION 9.  Article 39 of Chapter 58 of the General Statutes is amended by adding a new section to read:
"§ 58‑39‑76. Limits on sharing account number information for marketing purposes. 
(a)	General Prohibition on Disclosure of Account Numbers. – An insurance institution, insurance agent, or insurance‑support organization shall not disclose, other than to a consumer reporting agency, an account number or similar form of access number or access code for a credit card account, deposit account, or transaction account of a consumer to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.
(b)	Definitions. – As used in this section:
(1)	'Account number' means an account number, or similar form of access number or access code, but does not include a number or code in an encrypted form, as long as the insurance institution, insurance agent, or insurance‑support organization does not provide the recipient with a means to decode the number or code.
(2)	'Transaction account' means an account other than a deposit account or credit card account. A transaction account does not include an account to which third parties cannot initiate charges.
(c)	Exceptions. – Subsection (a) of this section does not apply if an insurance institution, insurance agent, or insurance‑support organization discloses an account number or similar form of access number or access code:
(1)	To the insurance institution's, insurance agent's, or insurance‑support organization's agent or service provider solely in order to perform marketing for the insurance institution's, insurance agent's, or insurance‑support organization's own products or services, as long as the agent or service provider is not authorized to directly initiate charges to the account; or
(2)	To a participant in a private label credit card program or an affinity or similar program where the participants in the program are identified to the customer when the customer enters into the program." 
SECTION 10.  G.S. 58‑39‑75(12) reads as rewritten:
"(12)	To an affiliate whose only use of the information will be in connection with an audit of the insurance institution or agent or the marketing of an insurance product or service, provided the affiliate agrees not to disclose the information for any other purpose or to unaffiliated  persons; and further provided that no medical record information may be disclosed to the affiliate for the marketing of an insurance product or service; or ".
SECTION 11.  G.S. 58‑39‑75(2) reads as rewritten:
"(2)	To a person other than an insurance institution, agent, or insurance‑support organization, provided such disclosure is reasonably necessary:
a.	To enable  that person to perform a business, professional, or insurance function for the disclosing insurance institution, agent, or insurance‑support organization, including, but not limited to, performing marketing functions and other functions regarding the provision of information concerning the disclosing institution's own products, services, and programs, and  that person agrees not to disclose the information further without the individual's written authorization unless the further disclosure:
1.	Would otherwise be permitted by this section if made by an insurance institution, agent, or insurance‑support organization; or
2.	Is reasonably necessary for  that person to perform its function for the disclosing insurance institution, agent, or insurance‑support organization; or
b.	To enable  that person to provide information to the disclosing insurance institution, agent, or insurance‑support organization for the purpose of:
1.	Determining an individual's eligibility for an insurance benefit or payment; or
2.	Detecting or preventing criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction; or".
SECTION 12.  G.S. 58‑39‑75 is amended by adding a new subdivision to read:
"(21)	To a person whose only use of an applicant's or policyholder's personal information, but not including medical record information, will be in connection with the marketing of a financial product or service intended to be provided by participants in a marketing program where the program participants and the types of information to be shared are identified to the applicant or policyholder when the applicant or policyholder is first offered the financial product or service. As used in this subdivision:
a.	'Financial institution' means any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 
§ 1843(k)).
b.	'Financial product or service' means any product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such  financial activity under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. § 1843(k)).
c.	'Marketing program' includes only those programs established by written agreement by the insurance institution and one or more financial institutions under which they jointly offer, endorse, or sponsor a financial product or service."
SECTION 13.  If any section or provision of this act is declared unconstitutional, preempted, or otherwise invalid by the courts, it does not affect the validity of the act as a whole or any part other than the part so declared to be unconstitutional, preempted, or otherwise invalid.
SECTION 14.  This act becomes effective January 1, 2002, and applies to policies and contracts newly issued or renewed on and after that date. For the purposes of the application of this act to policies or contracts renewed on and after January 1, 2002, the renewal of a policy or contract is presumed to occur on each anniversary of the date on which coverage was first effective on the person or persons covered by the policy or contract.