Chapter Ins 25

Ins 25.35(1)(a) (a) Information the licensee receives under an exception. If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution under an exception in s. Ins 25.55 or 25.60, the licensee may use or disclose that information only under the following conditions:

Ins 25.35(1)(a)1. 1. The licensee may disclose the information to the affiliates of the financial institution from which the licensee received the information.

Ins 25.35(1)(a)2. 2. The licensee may disclose the information to its affiliates, but the licensee’s affiliates may, in turn, disclose and use the information only to the extent that the licensee may disclose and use the information.

Ins 25.35(1)(a)3. 3. The licensee may disclose and use the information pursuant to an exception in s. Ins 25.55 or 25.60, in the ordinary course of business to carry out the activity covered by the exception under which the licensee received the information.

Ins 25.35(1)(b) (b) Example. If a licensee receives information from a nonaffiliated financial institution for claims settlement purposes, the licensee may disclose the information for fraud prevention, or in response to a properly authorized subpoena. The licensee may not disclose that information to a third party for marketing purposes or use that information for its own marketing purposes.

Ins 25.35(2) (2) Redisclosure outside exception.

Ins 25.35(2)(a) (a) Information a licensee receives outside of an exception. If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution other than under an exception in s. Ins 25.55 or 25.60, the licensee may not disclose the information except to any of the following:

Ins 25.35(2)(a)1. 1. To the affiliates of the financial institution from which the licensee received the information.

Ins 25.35(2)(a)2. 2. To its affiliates, but its affiliates may, in turn, disclose the information only to the extent that the licensee may disclose the information.

Ins 25.35(2)(a)3. 3. To any other person, if the disclosure would be lawful if made directly to that person by the financial institution from which the licensee received the information.

Ins 25.35(2)(b) (b) Example. If a licensee obtains a customer list from a nonaffiliated financial institution outside of the exceptions in s. Ins 25.55 or 25.60 it may do any of the following:

Ins 25.35(2)(b)1. 1. The licensee may use that list for its own purposes.

Ins 25.35(2)(b)2. 2. The licensee may disclose that list to another nonaffiliated third party only if the financial institution from which the licensee purchased the list could have lawfully disclosed the list to that third party. That is, the licensee may disclose the list in accordance with the privacy policy of the financial institution from which the licensee received the list, as limited by the opt out direction of each consumer whose nonpublic personal financial information the licensee intends to disclose, and the licensee may disclose the list in accordance with an exception in s. Ins 25.55 or 25.60, such as to the licensee’s attorneys or accountants.

Ins 25.35(3) (3) Information a licensee discloses under an exception. If a licensee discloses nonpublic personal financial information to a nonaffiliated third party under an exception in s. Ins 25.55 or 25.60, the third party may not disclose or use that information except under any of the following circumstances:

Ins 25.35(3)(a) (a) The third party may disclose the information to the licensee’s affiliates.

Ins 25.35(3)(b) (b) The third party may disclose the information to its affiliates, but its affiliates may, in turn, disclose and use the information only to the extent that the third party may disclose and use the information.

Ins 25.35(3)(c) (c) The third party may disclose and use the information pursuant to an exception in s. Ins 25.55 or 25.60 in the ordinary course of business to carry out the activity covered by the exception under which it received the information.

Ins 25.35(4) (4) Information a licensee discloses outside of an exception. If a licensee discloses nonpublic personal financial information to a nonaffiliated third party other than under an exception in s. Ins 25.55 or 25.60, the third party may not disclose the information except under any of the following circumstances:

Ins 25.35(4)(a) (a) To the licensee’s affiliates.

Ins 25.35(4)(b) (b) To the third party’s affiliates, but the third party’s affiliates, in turn, may disclose the information only to the extent the third party can disclose the information.

Ins 25.35(4)(c) (c) To any other person, if the disclosure would be lawful if the licensee made it directly to that person.

Ins 25.35 History History: Cr. Register, June, 2001, No. 546, eff. 7-1-01.

Ins 25.40 Ins 25.40 Limits on sharing account number information for marketing purposes.

Ins 25.40(1) (1) General prohibition on disclosure of account numbers. A licensee shall not, directly or through an affiliate, disclose, other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer’s policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer.

Ins 25.40(2) (2) Exceptions. Subsection (1) does not apply if a licensee discloses a policy number or similar form of access number or access code to any of the following:

Ins 25.40(2)(a) (a) To the licensee’s service provider solely in order to perform marketing for the licensee’s own products or services, as long as the service provider is not authorized to directly initiate charges to the account.

Ins 25.40(2)(b) (b) To a licensee who is a producer solely in order to perform marketing for the licensee’s own products or services.

Ins 25.40(2)(c) (c) To a participant in an affinity or similar program where the participants in the program are identified to the customer when the customer enters into the program.

Ins 25.40(3) (3) Examples.

Ins 25.40(3)(a) (a) Policy number. A policy number, or similar form of access number or access code, does not include a number or code in an encrypted form, as long as the licensee does not provide the recipient with a means to decode the number or code.

Ins 25.40(3)(b) (b) Policy or transaction account. For the purposes of this section, a policy or transaction account is an account other than a deposit account or a credit card account. A policy or transaction account does not include an account to which third parties cannot initiate charges.

Ins 25.40 History History: Cr. Register, June, 2001, No. 546, eff. 7-1-01.

subch. IV of ch. Ins 25 Subchapter IV — Exceptions to Limits on Disclosure of Financial Information

Ins 25.50 Ins 25.50 Exception to opt out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing.

Ins 25.50(1) (1) Services.

Ins 25.50(1)(a) (a) General rule. The opt out requirements in ss. Ins 25.17 and 25.30 do not apply when a licensee provides nonpublic personal financial information to either of the following:

Ins 25.50(1)(a)1. 1. A nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee complies with all of the following:

Ins 25.50(1)(a)1.a. a. It provides the initial notice in accordance with s. Ins 25.10.

Ins 25.50(1)(a)1.b. b. It enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, including use under an exception in s. Ins 25.55 or 25.60 in the ordinary course of business to carry out those purposes.

Ins 25.50(1)(a)2. 2. A nonaffiliated third party for the purpose of marketing goods or services under the brand name of a licensee under ch. Ins 15, or an affiliate of such a licensee, if the licensee complies with all of the following:

Ins 25.50(1)(a)2.a. a. It provides the initial notice in accordance with s. Ins 25.10.

Ins 25.50(1)(a)2.b. b. The licensee or its affiliate enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee or its affiliate disclosed the information, including use under an exception in s. Ins 25.55 or 25.60 in the ordinary course of business to carry out those purposes.

Ins 25.50(1)(a)2.c. c. The licensee or its affiliate contractually requires the third party to comply with the licensee’s or its affiliate’s standards that are reasonably designed to ensure the quality of the goods or services, and customer services.

Ins 25.50(1)(a)2.d. d. The licensee or affiliate enters into a contractual agreement with the third party that requires the third party to implement reasonable safeguards to protect the security and confidentiality of its nonpublic personal financial information and take action that is necessary to enforce those safeguards.

Ins 25.50(1)(am) (am) Solicitations. Nothing in this section shall be construed or otherwise permit telephone solicitation which would otherwise be prohibited under s. 100.52, Stats., or subch. V of ch. ATCP 127.

Ins 25.50(1)(b) (b) Example. If a licensee discloses nonpublic personal financial information under this section to a financial institution with which the licensee performs joint marketing, the licensee’s contractual agreement with that institution meets the requirements of par. (b) if it prohibits the institution from disclosing or using the nonpublic personal financial information except as necessary to carry out the joint marketing or under an exception in s. Ins 25.55 or 25.60 in the ordinary course of business to carry out that joint marketing.

Ins 25.50(2) (2) Service may include joint marketing. The services a nonaffiliated third party performs for a licensee under sub. (1) may include marketing of the licensee’s own products or services or marketing of financial products or services offered pursuant to joint agreements between the licensee and one or more financial institutions.

Ins 25.50(3) (3) Definition of “joint agreement”. For purposes of this section, “joint agreement” means a written contract pursuant to which a licensee and one or more financial institutions jointly offer, endorse or sponsor a financial product or service.

Ins 25.50 History History: Cr. Register, June, 2001, No. 546, eff. 7-1-01; CR: 03-083: am. (1) (a), cr. (1) (am) Register March 2004 No. 579, eff. 4-1-04.

Ins 25.55 Ins 25.55 Exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions.

Ins 25.55(1) (1) Exceptions for processing transactions at a consumer’s request. The requirements for initial notice in s. Ins 25.10 (1) (b), the opt out in ss. Ins 25.17 and 25.30, and service providers and joint marketing in s. Ins 25.50 do not apply if the licensee discloses nonpublic personal financial information as necessary to effect, administer or enforce a transaction that a consumer requests or authorizes, or in connection with any of the following:

Ins 25.55(1)(a) (a) Servicing or processing an insurance product or service that a consumer requests or authorizes.

Ins 25.55(1)(b) (b) Maintaining or servicing the consumer’s account with a licensee, or with another entity as part of a private label credit card program or other extension of credit on behalf of such entity.

Ins 25.55(1)(c) (c) A proposed or actual securitization, secondary market sale (including sales of servicing rights) or similar transaction related to a transaction of the consumer.

Ins 25.55(1)(d) (d) Reinsurance or stop loss or excess loss insurance, including, but not limited to, for the purpose of placing, replacing or making a claim under reinsurance or stop-loss or excess loss insurance.

Ins 25.55(2) (2) Processing transaction. “Necessary to effect, administer or enforce a transaction” means that the disclosure is any of the following:

Ins 25.55(2)(a) (a) Required, or is one of the lawful or appropriate methods, to enforce the licensee’s rights or the rights of other persons engaged in carrying out the financial transaction or providing the product or service.

Ins 25.55(2)(b) (b) Required, or is a usual, appropriate or acceptable method to accomplish any of the following:

Ins 25.55(2)(b)1. 1. To carry out the transaction or the product or service business of which the transaction is a part, and record, service or maintain the consumer’s account in the ordinary course of providing the insurance product or service.

Ins 25.55(2)(b)2. 2. To administer or service benefits or claims relating to the transaction or the product or service business of which it is a part.

Ins 25.55(2)(b)3. 3. To provide a confirmation, statement or other record of the transaction, or information on the status or value of the insurance product or service to the consumer or the consumer’s agent or broker.

Ins 25.55(2)(b)4. 4. To accrue or recognize incentives or bonuses associated with the transaction that are provided by a licensee or any other party.

Ins 25.55(2)(b)5. 5. To underwrite insurance at the consumer’s request or for any of the following purposes as they relate to a consumer’s insurance: account administration, reporting, investigating or preventing fraud or material misrepresentation, processing premium payments, processing insurance claims, administering insurance benefits including utilization review activities, participating in research projects, workers compensation premium audits, workers’ compensation first reports of injury, workers’ compensation loss runs or as otherwise required or specifically permitted by federal or state law.

Ins 25.55(2)(b)6. 6. In connection with any of the following:

Ins 25.55(2)(b)6.a. a. The authorization, settlement, billing, processing, clearing, transferring, reconciling or collection of amounts charged, debited or otherwise paid using a debit, credit or other payment card, check or account number, or by other payment means.

Ins 25.55(2)(b)6.b. b. The transfer of receivables, accounts or interests therein.

Ins 25.55(2)(b)6.c. c. The audit of debit, credit or other payment information.

Ins 25.55 History History: Cr. Register, June, 2001, No. 546, eff. 7-1-01.

Ins 25.60 Ins 25.60 Other exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information.

Ins 25.60(1) (1) Exceptions to opt out requirements. The requirements for initial notice to consumers in s. Ins 25.10 (1) (b), the opt out in ss. Ins 25.17 and 25.30, and service providers and joint marketing in s. Ins 25.50 do not apply when a licensee discloses nonpublic personal financial information under any of the following circumstances:

Ins 25.60(1)(a) (a) With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction.

Ins 25.60(1)(b) (b)

Ins 25.60(1)(b)1. 1. To protect the confidentiality or security of a licensee’s records pertaining to the consumer, service, product or transaction.

Ins 25.60(1)(b)2. 2. To protect against or prevent actual or potential fraud or unauthorized transactions.

Ins 25.60(1)(b)3. 3. For required institutional risk control or for resolving consumer disputes or inquiries.

Ins 25.60(1)(b)4. 4. To persons holding a legal or beneficial interest relating to the consumer.

Ins 25.60(1)(b)5. 5. To persons acting in a fiduciary or representative capacity on behalf of the consumer.

Ins 25.60(1)(c) (c) To provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating a licensee, persons that are assessing the licensee’s compliance with industry standards, and the licensee’s attorneys, accountants and auditors.

Ins 25.60(1)(d) (d) To the extent specifically permitted or required under other provisions of law and in accordance with the federal Right to Financial Privacy Act of 1978 (12 USC 3401 et seq.), to law enforcement agencies (including the Federal Reserve Board, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, Office of Thrift Supervision, National Credit Union Administration, the Securities and Exchange Commission, the Secretary of the Treasury, with respect to 31 U.S.C. Chapter 53, Subchapter II (Records and Reports on Monetary Instruments and Transactions) and 12 U.S.C. Chapter 21 (Financial Recordkeeping), a state insurance authority, and the Federal Trade Commission), self-regulatory organizations or for an investigation on a matter related to public safety.

Ins 25.60(1)(e) (e)

Ins 25.60(1)(e)1. 1. To a consumer-reporting agency in accordance with the federal Fair Credit Reporting Act (15 USC 1681 et seq.).

Ins 25.60(1)(e)2. 2. Disclosure from a consumer report reported by a consumer-reporting agency.

Ins 25.60(1)(f) (f) In connection with a proposed or actual sale, merger, transfer or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal financial information concerns solely consumers of the business or unit.

Ins 25.60(1)(g) (g)

Ins 25.60(1)(g)1. 1. To comply with federal, state or local laws, rules and other applicable legal requirements.

Ins 25.60(1)(g)2. 2. To comply with a properly authorized civil, criminal or regulatory investigation, or subpoena or summons by federal, state or local authorities.

Ins 25.60(1)(g)3. 3. To respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance or other purposes as authorized by law.

Ins 25.60(1)(h) (h) For purposes related to the replacement of a group benefit plan, a group health plan, a group welfare plan or a workers’ compensation policy.

Ins 25.60(2) (2) Example of revocation of consent. A consumer may revoke consent by subsequently exercising the right to opt out of future disclosures of nonpublic personal financial information as permitted under s. Ins 25.17 (6).