The New Privacy Baseline for Agents and Brokers

For decades, insurance producers have operated under the privacy framework established by the federal Gramm-Leach-Bliley Act (GLBA), which requires customer notices regarding their information-sharing practices, opt-outs for certain information sharing, and reasonable safeguards for sensitive data.

California’s new insurance privacy law, signed by Gov. Gavin Newsom (D) in September, upends that historic framework and is undoubtedly the new bar for privacy regulation in insurance.

The California Insurance Information and Privacy Protection Act (CIIPPA) overhauls the state’s previous insurance privacy regime and represents one of the most significant legal developments in this area since GLBA. Effective July 1, 2028, the law will govern how producers and admitted insurers (“licensees”) collect, process, retain, and share California consumers’ personal information. The new rules will also apply to surplus lines insurers, reinsurers, and third-party service providers. CIIPPA imposes significant new privacy obligations, including updated requirements related to privacy notices, consumer data rights, adverse underwriting decisions, processing and sharing of personal information, oversight of third-party service providers, and data retention and recordkeeping. It contains limited private rights of action and consumer opt-in requirements for certain data uses.

The act adds another layer of complexity to California’s myriad and ever-evolving requirements for insurance and other businesses’ data privacy and security practices. The state’s new insurance cybersecurity audit requirements, for instance, take effect on Jan. 1, 2027, while agents and brokers remain subject to the California Consumer Privacy Act (CCPA) with respect to personal information that falls outside the Insurance Code and GLBA exemptions.

The CIIPPA is a consumer-centric framework. Concerted industry efforts over the last two years to reduce unnecessary administrative burdens and compliance costs, including overly prescriptive and sometimes duplicative notice, recordkeeping, and contractual requirements, and to clarify obligations under the new law, faced resistance in the state legislature and the California Department of Insurance. Although the insurance commissioner is directed to issue regulations, sample forms, and compliance tools to support implementation of the new law, it is unclear whether the industry will face similar headwinds in any future regulatory process—particularly because both candidates still in the running for California insurance commissioner are viewed as even more consumer-leaning than current officeholder Ricardo Lara. The result is likely to be a messy and confusing compliance on-ramp for brokers, who will have to revisit long-standing compliance practices, operational processes, and third-party contractual arrangements.

Commercial Exclusion, For Now

The Council of Insurance Agents & Brokers, along with other industry organizations, did secure one significant change to the legislation to help rightsize and rationalize business obligations. Early versions of the act would have applied all provisions equally to commercial insurance and personal lines. However, The Council and others successfully argued that many of the new requirements would be very onerous or outright unworkable in commercial contexts (for instance, sending detailed privacy notices and effectuating robust consumer rights to correct and delete information for all individual drivers covered under a commercial auto policy). Lawmakers ultimately narrowed the bill to align more closely with the GLBA’s scope and limited its application to insurance products and services for personal, family, or household purposes.

The commercial exclusion from the CIIPPA is the right policy outcome and makes complete sense for businesses and consumers, but the issue is far from settled. California regulators have indicated that they could address commercial insurance in future legislation, and the CIIPPA may offer a starting point for that effort.

CIIPA Expands Disclosure Requirements

While the CIIPPA follows the familiar GLBA structure of requiring privacy notices at the outset of a consumer relationship, annually thereafter, and when material changes occur, its disclosure requirements are considerably more expansive. In addition to describing categories of information processed and shared, third-party data recipients, and opt-out and opt-in rights, producers must address:

• Other sources from which personal information is or may be collected
• The purposes for which they process and share data
• International data transfers
• Consumer data rights (e.g., rights to access, correct, delete)
• Rights related to adverse underwriting decisions (including receiving an explanation about why the decision was made, what personal information was used to make the decision, and the sources of that information)
• Other information specified by regulation

Many firms will need to revisit privacy notices that have remained largely unchanged for years as existing GLBA-compliant forms are unlikely to satisfy the more detailed CIIPPA disclosure requirements.

More Consumer Say In Data Usage

The CIIPPA still allows processing and sharing of non-sensitive personal information without opt-in or opt-out restrictions when reasonably necessary to conduct an insurance transaction and for other narrow purposes such as compliance with legal requirements. Beyond that, however, consumer consent requirements apply.

Among the more consequential changes from the GLBA approach is a more aggressive consumer consent framework. Opt-in consent (versus the historic opt-out model) is required for specific marketing and research activities (notably not defined in the law), as well as certain insurance transaction-related information sharing with third-party service providers that lack an ongoing relationship or written contract with the producer.

Opt-out consent is required for joint marketing activities; cross-marketing of insurance or financial products or services; marketing related to the licensee’s own products, goods, or services; sharing personal information (other than consumer reports) with affiliates; FAIR Plan clearinghouse activities; and other purposes that may be specified by regulation. Consumers must also have an opportunity to opt out before their sensitive personal information is shared for certain purposes, including conducting an insurance transaction.

The new law outright prohibits the sale of personal information for monetary or other valuable consideration.

Revisiting Third-Party Provider Contracts

The California law places significant attention on third-party service providers’ use of consumers’ personal information. Among other requirements, producers must:

• Exercise due diligence in selecting and overseeing service providers (not limited under the law to their data privacy practices)
• Develop written procedures governing the selection and oversight of service providers (again not limited to data privacy practices)
• Enter into contracts governing the processing and sharing of personal information
• Impose specific contractual obligations on service providers, including confidentiality, data deletion, and breach reporting requirements

Given the roughly 20-month compliance runway, firms should start reviewing and amending third-party service provider contracts sooner rather than later.

Private Right Of Action

Another unfortunate departure from the GLBA framework is the inclusion in the CIIPPA of private rights of action. Consumers may seek equitable relief under the new law when a licensee fails to properly effectuate their statutory rights, including accessing, correcting, amending, or deleting their personal information. This right also applies to receiving information related to “adverse underwriting decisions” (the definition of which goes well beyond what most of us would think of as true underwriting activities, including placement of risks with surplus lines carriers or a residual market). Further, licensees that improperly disclose information, including by failing to obtain the required opt-in consent or failing to honor an opt-out election, may be liable for the consumer’s actual damages. The statute also authorizes courts to award costs and reasonable attorneys’ fees to the prevailing party.

Notably, these rights of action are broader than those in the CCPA, which generally limits private lawsuits to certain data breach-related claims. This feature of the CIIPPA of course increases firms’ risk for compliance breakdowns.

California May Be Only The Beginning

Even as California crafted its insurance privacy framework, the National Association of Insurance Commissioners (NAIC) has been revising its own consumer privacy model law (initially developed as model state legislation for the GLBA framework). Industry stakeholders are watching closely because any eventual NAIC model could provide a template for action across states.

Of high concern for Council members in the NAIC model is a proposed “consumer”-based privacy obligation trigger, as opposed to obligations kicking in only when a consumer becomes a customer with an ongoing business relationship with the licensee. The proposed approach would impose significant burdens on licensees, including requiring privacy notices and other obligations, with respect to individuals who merely seek out insurance products or services, but who never actually purchase them or establish any business relationship.

Although the industry has plenty to say on improving the NAIC proposal, that path would hew much closer to the GLBA framework than does the CIIPPA. With the California bar set, it is unclear how other states will respond. Will they follow the NAIC or California example, or do their own thing? We expect that many firms will build their compliance programs around the California standard—the new highest common denominator. Even so, it seems preferable to have two possible compliance targets, California and a uniform approach for everyone else, rather than other jurisdictions all going their own way. The California ship may have sailed, but the more uniformity we can achieve across states around reasonable and meaningful privacy requirements, the more we’ll contain costs and burdens for the industry and deliver consistent consumer protections.

And hey, there’s always a chance that the federal government will enact a preemptive privacy framework. But that’s a topic for another column.