ORDER OF THE COMMISSIONER OF INSURANCE
TO AMEND, RENUMBER AND AMEND, AND TO CREATE A RULE.
The commissioner of insurance orders the following rule to amend 25.13 (title), renumber and amend Ins 25.13 (4) (intro.) and (a), and to create Ins 25.13 (4) (b), relating to an exception to the annual privacy notice requirements and affecting small business.
The statement of scope for this rule SS 105-16, was approved by the Governor on October 27, 2016, published in Register No. 731A1, on November 11, 2016, and approved by the Deputy Commissioner on November 28, 2016. The proposed rule was approved by the Governor on October 17, 2017, to submit to the legislature, and submitted to the legislature on October 23, 2017. The rule passed through committees and JCRAR on January 18, 2018 with no action taken. Analysis prepared by the Office of the Commissioner of Insurance (OCI).
Statutes interpreted:
Statutory authority:
Explanation of OCI’s authority to promulgate the proposed rule:
The Commissioner has the general authority to promulgate rules necessary to administer and enforce chs. 600 to 655, Stats., and as provided under ss. 227.11 (2) (a) and 601.41, Stats. Further, Ch. Ins. 25, Wis. Adm. Code, is specifically promulgated pursuant to the authority granted by ss. 601.41 (3) (a) (“The commissioner shall have rule-making authority under s. 227.11 (2).”), 610.70, 628.34 (12), and 633.17 (“The commissioner shall promulgate rules necessary for the implementation of this chapter, in addition to the rules permitted under s. 633.13 (2) and required under ss. 633.14 (3) and 633.15 (1) (b).”), Stats. These provisions both permit and require the commissioner to promulgate rules governing consumer privacy of financial and health information through the use of notices. Section 601.41 (3), Stats., grants the Commissioner general rule making authority which allows for the prudent oversight of Wisconsin’s insurance industry. Related statutes or rules:
None.
Plain language analysis:
The proposed rule changes s. Ins 25.13 (4), Wis. Adm. Code, to track the language contained in the Fixing America’s Surface Transportation Act (FAST Act), Public Law 114-94 §75001, that amended Section 503, 12 U.S.C. § 6803, of the Gramm-Leach-Bliley Act (“GLBA” PL 102-106) privacy notice requirements. The additional exception from providing consumers an annual privacy notice is narrowly available to insurers doing the business of insurance in this state only if the insurer can meet two requirements: (i) that the licensee does not share nonpublic personal information except as permitted in certain statutory exceptions and, (ii) that licensee’s business practices with regards to their disclosure of nonpublic personal financial information have not changed since their most recent disclosure of their privacy policy sent to their customers. The exception is permitted only until the insurer no longer meets either of the requirements. This proposed narrow exception balances the need to keep Wisconsin’s insurance market competitive, by ensuring regulatory consistency with federal privacy laws while also creating a clear set of conditions that protect consumers by requiring updated disclosure of privacy policies when business practices change. Summary of and comparison with any existing or proposed federal statutes and regulations:
This proposed amendment to Ins 25.13 (4), Wis. Adm. Code, would make Wisconsin law consistent with the GLBA Section 503, 12 U.S.C. § 6803 and relieve compliant insurers from providing annual notices while maintaining consumer protections by requiring privacy notices be mailed when business practices change. Specifically the exemption under GLBA that will be mirrored in Ins 25.13, reads:
S.503 (f) Exception to annual notice requirement. A financial institution that –
(1) provides nonpublic personal information only in accordance with the provisions of subsection (b) (2) or (e) of section 6802 of this title or regulations prescribed under section 6804 (b) of this title, and
(2) has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers in accordance with this section, shall not be required to provide an annual disclosure under this section until such time as the financial institution fails to comply with any criteria described in paragraph (1) or (2).
Additionally, the National Association of Insurance Commissioners Market Regulation and Consumer Affairs (D) Committee adopted a Model Bulletin that implemented the key provisions of the FAST Act’s GLBA amendments. Thus amending Ins 25.13 will achieve regulatory uniformity. If Ins 25.13 is not amended there could be market participant confusion and conflict between Wisconsin Insurance regulations and federal privacy laws.
Comparison with rules in adjacent states:
Illinois: Recently submitted notice of proposed amendment to 41 Ill. Reg. 4002.50, published in the Illinois Register Vol 40, Issue 53 pg.16513, that proposes changes consistent with changes to the privacy notice proposed by Wisconsin.
Iowa: Iowa promulgated Iowa Code section 505.8 amended Chapter 90 by creating 191—90.4(4) (505) that is consistent with the proposed change to Wisconsin law. The regulation was filed November 30, 2016, and was effective January 25, 2017. Michigan: Mich. Admin. Code r 500.551 etc. contains the similar requirement for providing annual notices but does not contain the most recent modification as contained in this proposed rule.
Minnesota: Adopted the NAIC model act implementing the GLBA that contains the similar requirement for providing annual notices but does not contain the most recent modification as contained in this proposed rule.
A summary of the factual data and analytical methodologies that OCI used in support of the proposed rule:
The OCI has reviewed NAIC models and insurer’s financial information to support the analysis that this rule change is beneficial to the state of Wisconsin and its insurance industry. Further, this amendment relieves insurers from the burden of costly annual mailings to consumers when able to comply with two conditions. The proposed rule change still protects Wisconsin’s insureds by promoting transparency with regard to the treatment and use of their sensitive personal information and licensed insurance companies are required to send notices if their policies and treatment of sensitive personal information changes from what was previously disclosed. One company estimates that it could save $70,000 annually in printing, postage, and mailing supplies.
Analysis and supporting documentation that OCI used in support of the OCI’s determination of the rule’s effect on small business or in preparation of an economic impact analysis:
This proposed rule will have a moderately positive economic impact as it will eliminate the need for financial institutions to send their customers redundant privacy notices. This ability to reduce the frequency of mailing privacy notices will decrease costs and will have a positive effect on small businesses in Wisconsin. The annual notice to consumers requires printing, postage and supplies all at increasing costs to insurers. Those insurers who are able to comply will directly and immediately benefit from the exception.
Effect on small business:
This rule will not negatively affect regulated small businesses as the proposed rule change would no longer require them to send out annual privacy notices provided they are able to comply with the terms of the exceptions. The proposed rule change would also have a beneficial financial effect on small business that can be measured by the savings realized by not sending out annual privacy notices.
A copy of any comments and opinion prepared by the Board of Veterans Affairs under s. 45.03 (2m), Stats., for rule proposed by the Department of Veterans Affairs. None.
Agency contact person:
A copy of the full text of the proposed rule changes, analysis and fiscal estimate may be obtained from the Web site at:
or by contacting Karyn Culver, Paralegal, at:
Phone: (608) 267-9586
Address: 125 South Webster St – 2nd Floor, Madison WI 53703-3474
Mail: PO Box 7873, Madison, WI 53707-7873
The rule changes are:
SECTION 1. Ins 25.13 (4) (title) is amended to read:
Ins 25.13 (4) Exception Exceptions.
SECTION 2. Ins 25.13 (4) (intro.) and (a), are renumbered and amended to read:
Ins 25.13 (4) (intro.) The annual privacy notice requirement in this section does not apply when a licensee complies with either of the following:
(a) When a licensee provides nonpublic personal financial information to any person described by s. Ins 25.50 (1) (a) 2.
