EMERGENCY ORDER OF THE COMMISSIONER OF INSURANCE
RENUMBERING, AMENDING AND CREATING A RULE.
The Commissioner of Insurance orders the following emergency rule to renumber and amend Ins 25.13 (4) and (title) to Ins 25.13 (4) (title) and (a), and to create Ins 25.13 (4) (b), relating to an exception to the annual privacy notice requirements and affecting small business.
The statement of scope for this rule SS 105-16, was approved by the Governor on October 27, 2016, published in Register No. 731A1, on November 11, 2016, and approved by the Deputy Commissioner on November 28, 2016. This emergency rule was approved by the Governor on April 20, 2017. Analysis prepared by the Office of the Commissioner of Insurance (OCI).
FINDING OF EMERGENCY
The Commissioner of Insurance finds that an emergency exists and that the attached rule is necessary for the immediate preservation of the public peace, health, safety, or welfare. Facts constituting the emergency are as follows:
Chapter Ins 25, Wis. Adm. Code, establishes regulations protecting consumer health and financial information and establishes requirements for regulated licensees to protect the information and provide various notices. Due to changes in Gramm-Leach-Bliley Act (GLBA), Title V, (PL 102-106), by the Fixing America’s Surface Transportation Act (FAST Act), Public Law 114-94 § 75001, the Commissioner is promulgating this emergency rule to conform Wisconsin insurance law to be consistent with the amended federal law. The amendments relieve regulated licensees, in limited circumstances, from the requirements of providing annual issuance of privacy notices as similarly allowed under federal law. Delay in implementation of the limited exception needlessly prolongs the administrative burden on all regulated licensees that provide the currently required annual notice. Statutes interpreted:
Statutory authority:
Explanation of OCI’s authority to promulgate the proposed rule:
The Commissioner has the general authority to promulgate rules necessary to administer and enforce chs. 600 to 655, Stats. In addition the Commissioner has specific rule-making authority granted in ss. 227.11 (2) (a) and 601.41. Stats. Further, ch. Ins. 25, Wis. Adm. Code, is specifically promulgated pursuant to the authority granted by ss. 601.41 (3) (a) (“The commissioner shall have rule-making authority under s. 227.11 (2).”), 610.70, 628.34 (12), and 633.17, Stats., (“The commissioner shall promulgate rules necessary for the implementation of this chapter, in addition to the rules permitted under s. 633.13 (2) and required under ss. 633.14 (3) and 633.15 (1) (b), Stats.”) These provisions both permit and require the Commissioner to promulgate rules governing consumer privacy of financial and health information through the use of notices. Section 601.41 (3), Stats., grants the Commissioner general rule-making authority which allows for the prudent oversight of Wisconsin’s insurance industry. Related statutes or rules:
None.
Plain language analysis:
The emergency rule changes s. Ins 25.13 (4), Wis. Adm. Code, to track the language contained in the Fixing America’s Surface Transportation Act (FAST Act), Public Law 114-94 §75001, that amended Section 503, 12 U.S.C. § 6803, of the GLBA (PL 102-106) privacy notice requirements. The additional exception from providing consumers an annual privacy notice is narrowly available to insurers doing the business of insurance in this state only if the insurer can meet two requirements: (i) that the licensee does not share nonpublic personal information except as permitted in certain statutory exceptions and, (ii) that licensee’s business practices with regards to their disclosure of nonpublic personal financial information have not changed since their most recent disclosure of their privacy policy sent to their customers. The exception is permitted only until the insurer no longer meets either of the requirements. This proposed narrow exception balances the need to keep Wisconsin’s insurance market competitive by ensuring regulatory consistency with federal privacy laws while also creating a clear set of conditions that protect consumers by requiring updated disclosure of privacy policies when business practices change. Summary of and comparison with any existing or proposed federal statutes and regulations:
This proposed amendment to s. Ins 25.13 (4), Wis. Adm. Code, would make Wisconsin law consistent with the GLBA Section 503, 12 U.S.C. § 6803 and relieve compliant insurers from providing annual notices while maintaining consumer protections by requiring privacy notices be mailed when business practices change. Specifically the exemption under GLBA that will be mirrored in s. Ins 25.13, Wis. Adm. Code, reads: S.503 (f) Exception to annual notice requirement A financial institution that –
(1) provides nonpublic personal information only in accordance with the provisions of subsection (b) (2) or (e) of section 6802 of this title or regulations prescribed under section 6804 (b) of this title, and
(2) has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers in accordance with this section, shall not be required to provide an annual disclosure under this section until such time as the financial institution fails to comply with any criteria described in paragraph (1) or (2).
Additionally, the National Association of Insurance Commissioners Market Regulation and Consumer Affairs (D) Committee adopted a Model Bulletin that implemented the key provisions of the FAST Act’s GLBA amendments. Therefore amending s. Ins 25.13, Wis. Adm. Code, will achieve regulatory uniformity. If s. Ins 25.13, Wis. Adm. Code, is not amended there could be market participant confusion and conflict between Wisconsin Insurance regulations and federal privacy laws. Comparison with rules in adjacent states:
Illinois: Recently submitted notice of proposed amendment to 41 Ill. Reg. 4002.50 , published in the Illinois Register Vol 40, Issue 53 pg.16513, that proposes changes consistent with changes to the privacy notice proposed by Wisconsin.
Iowa: Iowa promulgated Iowa Code section 505.8 amended Chapter 90 by creating 191—90.4(4) (505) that is consistent with the proposed change to Wisconsin law. The regulation was filed November 30, 2016, and was effective January 25, 2017. Michigan: Mich. Admin. Code r 500.551 etc. contains the similar requirement for providing annual notices but does not contain the most recent modification as contained in this proposed rule.
Minnesota: Adopted the NAIC model act implementing the GLBA that contains the similar requirement for providing annual notices but does not contain the most recent modification as contained in this proposed rule.
A summary of the factual data and analytical methodologies that OCI used in support of the proposed rule:
The OCI has reviewed NAIC models and insurer’s financial information to support the analysis that this rule change is beneficial to the state of Wisconsin and its insurance industry. Further, these amendments relieve insurers from the burden of costly annual mailings to consumers when able to comply with two conditions. The proposed rule change still protects Wisconsin’s insureds by promoting transparency with regard to the treatment and use of their sensitive personal information and licensed insurance companies are required to send notices if their policies and treatment of sensitive personal information changes from what was previously disclosed. One company estimates that it could save $70,000 annually in printing, postage, and mailing supplies.
Analysis and supporting documentation that OCI used in support of the OCI’s determination of the rule’s effect on small business or in preparation of an economic impact analysis:
This proposed emergency rule will have a moderately positive economic impact as it will eliminate the need for financial institutions to send their customers redundant privacy notices. This ability to reduce the frequency of mailing privacy notices will decrease costs and will have a positive effect on small businesses in Wisconsin. The annual notice to consumers requires printing, postage and supplies all at increasing costs to insurers. Those insurers who are able to comply will directly and immediately benefit from the exception.
Effect on small business:
This rule will not negatively affect regulated small businesses as the proposed rule change would no longer require them to send out annual privacy notices provided they are able to comply with the terms of the exceptions. The proposed rule change would also have a beneficial financial effect on small business that can be measured by the savings realized by not sending out annual privacy notices.
A copy of any comments and opinion prepared by the Board of Veterans Affairs under s. 45.03 (2m), Stats., for rule proposed by the Department of Veterans Affairs. None.
Agency contact person:
or by contacting Karyn Culver, Paralegal, at:
Phone: (608) 267-9586
Address: 125 South Webster St – 2nd Floor, Madison WI 53703-3474
Mail: PO Box 7873, Madison, WI 53707-7873
Place where comments are to be submitted and deadline for submission:
A public hearing will be held in compliance with s. 227.24 (4), Stats., as the Office will concurrently issue the permanent rule for Notice of Hearing and deliver to Legislative Council the permanent rule as soon as possible following publication of the emergency rule. Specific time, date and location for comments will be provided in the Notice of Hearing.
The proposed rule changes are:
SECTION 1. Ins 25.13 (4) (title) is renumbered Ins 25.13 (4) (title) and (a), and are amended to read:
Ins 25.13 (4) Exception Exceptions. The annual privacy notice requirement in this section does not apply when a licensee complies with either of the following:
