January 21, 2018

Katie MacFarland

National Institute of Standards and Technology

100 Bureau Drive, Stop 2000

Gaithersburg, MD 20899

VIA Electronic Mail: privacyframework@nist.gov

RE: Docket No. 180821780-8780-01: Developing the Administration’s Approach to Consumer 

Privacy

Dear Ms. MacFarland:

The American Property Casualty Insurance Association (APCIA) appreciates the opportunity to respond to the 

National Institute of Standards and Technology’s (NIST) Request for Information (RFI) on the development of 

the Privacy Framework (Framework). Consumer privacy and data security are priority issues for the 

insurance industry and, as such, we strive to maintain the balance between protecting consumer privacy and 

trust while meeting consumer product expectations. We believe the RFI identifies a well-balanced approach 

consistent with U.S. privacy expectations and NIST’s mission to promote innovation and industrial 

competitiveness. 

In particular, the RFI identifies seven minimum attributes for an effective Framework. We agree that all of 

these attributes are important elements of a workable Framework that can be utilized across industry 

segments. From our perspective, Attribute #4, “risk-based, outcome-based, voluntary, and non-prescriptive”

and Attribute #6, “compatible with or may be paired with other privacy approaches” are fundamental for the 

reasons identified below. 

Risk-Based, Outcome-Based, Voluntary, and Non-Prescriptive

A risk-based, outcome-based, voluntary and non-prescriptive Framework allows companies to efficiently 

maximize human, financial and technical resources thereby meeting or exceeding consumer privacy 

expectations and fostering innovation. It is important to focus on the sensitivity of different types of personal 

information when evaluating actual risk and the controls to put in place. Associating the application of 

privacy principles in appropriately defined circumstances helps ensure that organizations are striking an 

appropriate balance between risk based due diligence and consumer protection. 

Compatible or Paired with other Privacy Approaches

The insurance industry has been subject to the Gramm-Leach-Bliley Act (GLBA) and implementing privacy 

regulations for over two decades. Increasingly, states are considering, and adopting, privacy laws that have 

general applicability to all industries, including insurers. This complex patchwork of federal and state laws 

creates a difficult compliance environment that could negatively impact consumers rather than help them. 

The challenge only increase for companies operating globally as the international patchwork of laws 

continues to emerge as well. Hence, the compatibility attribute of the Privacy Framework is critical. We 

believe the Framework should help enable compliance with existing privacy laws and regulations rather than 

imposing a new set of requirements. This harmonization/compatibility will serve to foster innovation and 

speed to market by reducing the time spent analyzing and applying multiple privacy regulations. 
2

In addition, the RFI solicits feedback on the adoption of specific privacy practices. At this time, we do not 

have any specific examples to share, but note that NIST should work collaboratively with other government 

agencies to facilitate and promote research into privacy-enhancing technologies, such as de-identification 

and the use of cryptographic technologies. The research should not only focus on the benefits, limitations, 

and use of the technologies themselves, but also how to apply such technologies across different systems. 

This research could make it easier for businesses to implement privacy controls; lead to better consumer 

protection; and, more generally, foster regulation that meets consumer expectations and offers consumer 

benefits rather than establishing excessive regulatory requirements that only create burdensome 

implementation and execution measures. 

****

We thank NIST for its collaborative approach and look forward to continuing to participate in the 

development of the Privacy Framework. We welcome the opportunity to answer any question you may have 

or to be of further assistance 

Respectfully submitted,

Angela Gleason

Senior Counsel