17-08 – Gramm Leach Bliley Act Annual Privacy Notices – 20 CSR 100-6.100, August 3, 2017

INSURANCE BULLETIN 17-08 Gramm Leach Bliley Act Annual Privacy Notices – 20 CSR 100-6.100 Issued: August 3, 2017

The following Bulletin is issued by the Missouri Department of Insurance, Financial Institutions and Professional Registration (“Department”) to inform and educate the reader on the specified issue. It does not have the force and effect of law, is not an evaluation of any specific facts or circumstances, and is not binding on the Department or an insurer. See §374.015, RSMo.

To: All insurers, producers and other persons and entities required to be registered with or licensed by this Department to transact business in this state

From: Chlora Lindley-Myers, Director

Re: Gramm Leach Bliley Act Annual Privacy Notices – 20 CSR 100-6.100

The purpose of this Bulletin is to respond to and address inquiries the Department received with regard to annual Gramm Leach Bliley privacy notices currently required under Regulation 20 CSR 100-6.100 and how those have been impacted by recent federal legislative changes.

On Dec. 4, 2015, the Fixing America’s Surface Transportation (FAST) Act was enacted into law and effective immediately. The FAST Act includes amendments to the Gramm Leach Bliley Act (GLBA) to eliminate the requirement for financial institutions to provide GLBA annual notices provided certain conditions are met, thus eliminating a duplicative and costly notification requirement. Financial institutions continue to be required to provide initial privacy notices as required under the GLBA. The department is currently undergoing a comprehensive review of all administrative rules, pursuant to Governor Eric R. Greitens’ Executive Order 17-03. Part of that comprehensive review includes a review of 20 CSR 100-6.100, entitled “Privacy of Financial Information”. This regulation was originally filed in October, 2002, becoming effective on April 30, 2003.

In line with the recent federal legislative changes and to eliminate unnecessary and costly duplication to the insurance industry, operating in multiple jurisdictions across the country, this Bulletin is to notify licensees subject to the GLBA annual notice requirements contained in 20 CSR 100-6.100 of a regulatory “safe harbor”.

By the issuance of this Bulletin, the department notifies and advises all licensees that the department will not take an enforcement action against a licensee to enforce the annual privacy notice requirements under 20 CSR 100-6.100(2) (B), provided the licensee:

(i) Provides nonpublic personal information to nonaffiliated third parties only in accordance with 20 CSR 100-6.100 (4) (A), 20 CSR 100-6.100 (4) (B) and 20 CSR100-6.100 (4) (C); and

(ii) Has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers in accordance with 20 CSR 100-6.100 (2)(A) or 20 CSR 100-6.100 (2) (B).

If, at any time, a licensee fails to comply with any of the criteria described in paragraph (i) or (ii), then the regulatory “safe harbor” set forth above shall not apply and the licensee will still be obligated to provide the annual privacy notice required under 20 CSR 100-6.100 (2) (B).

Finally, this regulatory “safe harbor” does not impact or effect any obligation of a licensee to provide the GLBA initial privacy notices that are specified under 20 CSR 100-6.100 (2) (A). Licensees are directed to review 20 CSR 100-6.100 (2) (A) for more information regarding these requirements.

This Bulletin and the regulatory “safe harbor” outlined above shall remain in effect until the rescission of 20 CSR 100-6.100 or this Bulletin, whichever is earlier.

Licensees with questions regarding this Bulletin may contact Angela Nelson, Director of the Division of Market Regulation at 573-751-2430.

####