Missouri Code of State Regulations › Title 20 - DEPARTMENT OF COMMERCE AND INSURANCE › Division 100 - Insurer Conduct › Chapter 6 - Privacy of Consumer Information › Section 20 CSR 100-6.100 - Privacy of Financial Information

Current through Register Vol. 49, No. 14, July 15, 2024
PURPOSE: The purpose of this rule is to effectuate,
				  interpret, and carry out the provisions of section
				  362.422,
				  RSMo, regarding the disclosure of nonpublic personal information in violation
				  of Title V of the Gramm-Leach-Bliley Financial Modernization Act of
				  1999.
(1) Definitions. As
				used in this rule, unless the context requires otherwise:
(A) "Affiliate" means any company that
				controls, is controlled by, or is under common control with another
				company.
(B) "Clear and
				conspicuous" means that a notice is reasonably understandable and designed to
				call attention to the nature and significance of the information in the notice.
				For example:
1. A licensee makes its notice
				reasonably understandable if it-
A. Presents
				the information in the notice in clear, concise sentences, paragraphs, and
				sections;
B. Uses short explanatory
				sentences or bullet lists whenever possible;
C. Uses definite, concrete, everyday words
				and active voice whenever possible;
D. Avoids multiple negatives;
E. Avoids legal and highly technical business
				terminology whenever possible; and
F. Avoids explanations that are imprecise and
				readily subject to different interpretations;
2. A licensee designs its notice to call
				attention to the nature and significance of the information in it if the
				licensee-
A. Uses a plain-language heading to
				call attention to the notice;
B.
				Uses a typeface and type size that are easy to read;
C. Provides wide margins and ample line
				spacing;
D. Uses boldface or
				italics for key words; and
E. In a
				form that combines the licensee's notice with other information, uses
				distinctive type size, style, and graphic devices, such as shading or
				sidebars;
3. If a
				licensee provides a notice on a web page, the licensee designs its notice to
				call attention to the nature and significance of the information in it if the
				licensee uses text or visual cues to encourage scrolling down the page, if
				necessary, to view the entire notice and ensure that other elements on the web
				site (such as text, graphics, hyperlinks, or sound) do not distract attention
				from the notice, and the licensee either-
A.
				Places the notice on a screen that consumers frequently access, such as a page
				on which transactions are conducted; or
B. Places a link on a screen that consumers
				frequently access, such as a page on which transactions are conducted, that
				connects directly to the notice and is labeled appropriately to convey the
				importance, nature, and relevance of the notice;
(C) "Collect" means to obtain
				information that the licensee organizes or can retrieve by the name of an
				individual or by identifying number, symbol, or other identifying particular
				assigned to the individual, irrespective of the source of the underlying
				information;
(D) "Director" means
				the director of the Department of Commerce and Insurance;
(E) "Company" means a corporation, limited
				liability company, business trust, general or limited partnership, association,
				sole proprietorship, or similar organization;
(F) "Consumer" means an individual who seeks
				to obtain, obtains, or has obtained an insurance product or service from a
				licensee that is to be used primarily for personal, family, or household
				purposes, and about whom the licensee has nonpublic personal information, or
				that individual's legal representative. For example:
1. An individual who provides nonpublic
				personal information to a licensee in connection with obtaining, or seeking to
				obtain, financial, investment, or economic advisory services relating to an
				insurance product or service is a consumer regardless of whether the licensee
				establishes an ongoing advisory relationship;
2. An applicant for insurance prior to the
				inception of insurance coverage is a licensee's consumer;
3. An individual who is a consumer of another
				financial institution is not a licensee's consumer solely because the licensee
				is acting as agent for, or provides processing or other services to, that
				financial institution;
4. An
				individual is a licensee's consumer if:
A. The
				individual is:
(I) A beneficiary of a life
				insurance policy underwritten by the licensee;
(II) A claimant under an insurance policy or
				certificate issued by the licensee;
(III) An insured or an annuitant under an
				insurance policy or an annuity, respectively, issued by the licensee;
(IV) A mortgagor of a mortgage
				covered under a mortgage insurance policy; and
B. The licensee discloses nonpublic personal financial
				information about the individual to a nonaffiliated third party other than as
				permitted under subsections (4)(A), (4)(B), and (4)(C) of this
				rule;
5. Provided that the
				licensee provides the initial, annual, and revised notices under subsections
				(2)(A), (2)(B), and (2)(E) of this rule to the plan sponsor, group, or blanket
				insurance policyholder, or group annuity contractholder, and further provided
				that the licensee does not disclose to a nonaffiliated third party nonpublic
				personal financial information about such an individual other than as permitted
				under subsections (4)(A), (4)(B), and (4)(C) of this rule, an individual is not
				the consumer of the licensee solely because he or she is:
A. A participant or a beneficiary of an
				employee benefit plan that the licensee administers, or sponsors, or for which
				the licensee acts as a trustee, insurer, or fiduciary;
B. Covered under a group or blanket insurance
				policy or group annuity contract issued by the licensee;
6. The individuals described in subparagraphs
				(1)(F)5.A. and (1)(F)5.B. are consumers of a licensee if the licensee does not
				meet all the conditions of paragraph (1)(F)5. In no event shall the
				individuals, solely by virtue of the status described in subparagraphs
				(1)(F)5.A. and (1)(F)5.B. of this subsection, be deemed to be customers for
				purposes of this rule;
7. An
				individual is not a licensee's consumer solely because he or she is a
				beneficiary of a trust for which the licensee is a trustee;
8. An individual is not a licensee's consumer
				solely because he or she has designated the licensee as trustee for a trust;
(G) "Consumer reporting
				agency" has the same meaning as in section 603(f) of the federal Fair Credit
				Reporting Act (
				15 U.S.C.
				1681a(f) );
(H) "Control" means:
1. Ownership, control, or power to vote
				twenty-five percent (25%) or more of the outstanding shares of any class of
				voting security of the company, directly or indirectly, or acting through one
				(1) or more other persons;
2.
				Control in any manner over the election of a majority of the directors,
				trustees, or general partners (or individuals exercising similar functions) of
				the company; or
3. The power to
				exercise, directly or indirectly, a controlling influence over the management
				or policies of the company, as he director determines;
(I) "Customer" means a consumer who as a
				customer relationship with a licensee;
(J) "Customer relationship" means a
				continuing relationship between a consumer and licensee under which the
				licensee provides one or more insurance products or services to he consumer
				that are to be used primarily for personal, family, or household purposes.
1. A consumer has a continuing relationship
				with a licensee if-
A. The consumer is a
				current policy-older of an insurance product issued by or through the licensee;
				or
B. The consumer obtains
				financial, investment, or economic advisory services elating to an insurance
				product or service from the licensee for a fee.
2. A consumer does not have a continuing
				relationship with a licensee if-
A. The
				consumer applies for insurance but does not purchase the insurance;
B. The licensee sells the consumer airline
				travel insurance in an isolated transaction;
C. The individual is no longer a current
				policyholder of an insurance product or no longer obtains insurance services
				with or through the licensee;
D.
				The consumer is a beneficiary or claimant under a policy and has submitted a
				claim under a policy choosing a settlement option involving an ongoing
				relationship with he licensee;
E.
				The consumer is a beneficiary or a claimant under a policy and has submitted a
				claim under a policy choosing a lump sum settlement option;
F. The customer's policy is lapsed, expired,
				or otherwise inactive or dormant under the licensee's business practices, and
				he licensee has not communicated with the customer about the relationship for a
				period of twelve (12) consecutive months, other than annual privacy notices,
				material required by law or rule, communication at the direction of a state or
				federal authority, or promotional materials;
G. The individual is an insured or an
				annuitant under an insurance policy or annuity, respectively, but is not the
				policyholder or owner of the insurance policy or annuity; or
H. For the purposes of this rule, the
				individual's last known address according to he licensee's records is deemed
				invalid. An address of record is deemed invalid if mail sent to that address by
				the licensee has been returned by the postal authorities as undeliverable and
				if subsequent attempts by the licensee to obtain a current valid address for he
				individual have been unsuccessful;
(K) "Financial institution" means any
				institution the business of which is engaging in activities that are financial
				in nature or incidental to such financial activities as described in section
				4(k) of the Bank Holding Company Act of 1956 (
				12 U.S.C.
				1843(k) ).
1. Financial institution does not include:
A. Any person or entity with respect to any
				financial activity that is subject to the jurisdiction of the Commodity Futures
				Trading Commission under the Commodity Exchange Act (
				7
				U.S.C. 1
et seq.
);
B. The Federal Agricultural Mortgage
				Corporation or any entity charged and operating under the Farm Credit Act of
				1971 (
				12 U.S.C.
				2001
et seq.
); or
C. Institutions chartered by Congress
				specifically to engage in securitizations, secondary market sales (including
				sales of servicing rights) or similar transactions related to a transaction of
				a consumer, as long as the institutions do not sell or transfer nonpublic
				personal information to a nonaffiliated third party;
(L) "Financial product or service"
				means any product or service that a financial holding company could offer by
				engaging in an activity that is financial in nature or incidental to such a
				financial activity under section 4(k) of the Bank Holding Company Act of 1956 (
				12 U.S.C.
				1843(k) ). Financial service
				includes a financial institution's evaluation or brokerage of information that
				the financial institution collects in connection with a request or an
				application from a consumer for a financial product or service;
(M) "Insurance product or service" means any
				product or service that is offered by a licensee pursuant to the insurance laws
				of this state, including a licensee's evaluation, brokerage, or distribution of
				information that the licensee collects in connection with a request or an
				application from a consumer for an insurance product or service;
(N) "Licensee" means all licensed insurers,
				producers, and other persons licensed, authorized, or registered, or required
				to be licensed, authorized, or registered by the director pursuant to the laws
				of this state.
1. A licensee is not subject
				to the notice and opt out requirements for nonpublic personal financial
				information set forth in sections (1), (2), (3), and (4) of this rule if the
				licensee is an employee, agent, or other representative of another licensee
				("the principal") and:
A. The principal
				otherwise complies with, and provides notices pursuant to the provisions of
				this rule; and
B. The licensee
				does not disclose any nonpublic personal information to any other person other
				than the principal or its affiliates in a manner permitted by this rule, other
				than as permitted by subparagraph (4)(B)1.E.
2. Nonadmitted insurers.
A. Subject to subparagraph (1)(N)1.B.,
				"licensee" also includes a nonadmitted insurer that accepts business placed
				through a licensed surplus lines broker in this state, but only in regard to
				the surplus lines placements placed pursuant to Chapter 384, RSMo.
B. A surplus lines broker or surplus lines
				insurer is deemed to be in compliance with the notice and opt out requirements
				for nonpublic personal financial information set forth in sections (1), (2),
				(3), and (4) of this rule provided-
(I) The
				broker or insurer does not disclose nonpublic personal information of a
				consumer or a customer to nonaffiliated third parties for any purpose,
				including joint servicing or marketing under subsection (4)(A) of this rule,
				except as permitted by subsection (4)(B) or (4)(C) of this rule; and
(II) The broker or insurer delivers a notice
				to the consumer at the time a customer relationship is established on which the
				following is printed in sixteen- (16-) point type:
PRIVACY NOTICE
NEITHER THE U.S. BROKERS THAT HANDLED THIS INSURANCE NOR THE
				  INSURERS THAT HAVE UNDERWRITTEN THIS INSURANCE WILL DISCLOSE NONPUBLIC PERSONAL
				  INFORMATION CONCERNING THE BUYER TO NONAFFILIATES OF THE BROKERS OR INSURERS
				  EXCEPT AS PERMITTED BY LAW;
(O) "Nonaffiliated third party." Any person
				except a licensee's affiliate or a person employed jointly by a licensee and
				any company that is not the licensee's affiliate (but nonaffiliated third party
				includes the other company that jointly employs the person). Any company that
				is an affiliate solely by virtue of the direct or indirect ownership or control
				of the company by the licensee or its affiliate in conducting merchant banking
				or investment banking activities of the type described in section 4(k)(4)(H) or
				insurance company investment activities of the type described in section
				4(k)(4)(I) of the federal Bank Holding Company Act (
				12 U.S.C.
				1843(k)(4)(H) and (I) ) is a
				nonaffiliated third party;
(P)
				"Nonpublic personal information" means nonpublic personal financial
				information;
(Q) "Nonpublic
				personal financial information."
1.
				"Nonpublic personal financial information" means personally identifiable
				financial information; and any list, description, or other grouping of
				consumers (and publicly available information pertaining to them) that is
				derived using any personal identifiable financial information that is not
				publicly available.
2. Nonpublic
				personal financial information does not include-
A. Publicly available information, except as
				included on a list described in sub-paragraph (1)(Q)1.B.; or
B. Any list, description, or other grouping
				of consumers (and publicly available information pertaining to them) that is
				derived without using any personally identifiable financial information that is
				not publicly available.
(I) Nonpublic
				personal financial information includes any list of individuals' names and
				street addresses that is derived in whole or in part using personal
				identifiable financial information that is not publicly available, such as
				account numbers.
(II) Nonpublic
				personal financial information does not include any list of individuals' names
				and addresses that contains only publicly available information, is not derived
				in whole or in part using personal identifiable financial information that is
				not publicly available, and is not disclosed in a manner that indicates that
				any of the individuals on the list is a consumer of a financial
				institution;
(R) "Personal identifiable financial
				information" means any information-
1. A
				consumer provides to a licensee to obtain an insurance product or service from
				the licensee;
2. About a consumer
				resulting from a transaction involving an insurance product or service between
				a licensee and a consumer; or
3.
				The licensee otherwise obtains about a consumer in connection with providing an
				insurance product or service to that consumer;
4. Personal identifiable financial
				information includes-
A. Information a
				consumer provides to a licensee on an application to obtain an insurance
				product or service;
B. Account
				balance information and payment history;
C. The fact that an individual is or has been
				one of the licensee's customers or has obtained an insurance product or service
				from the licensee;
D. Any
				information about the licensee's consumer if it is disclosed in a manner that
				indicates that the individual is or has been the licensee's consumer;
E. Any information that a consumer provides
				to a licensee or that the licensee or its agent otherwise obtains in connection
				with collecting on a loan or servicing a loan;
F. Any information the licensee collects
				through an Internet cookie (an information-collecting device from a web
				server); and
G. Information from a
				consumer report.
5.
				Personally identifiable financial information does not include-
A. A list of names and addresses of customers
				of an entity that is not a financial institution; and
B. Information that does not identify a
				consumer, such as aggregate information or blind data that does not contain
				personal identifiers such as account numbers, names, or addresses;
(S) "Publicly available
				information" means any information that a licensee has a reasonable basis to
				believe is lawfully made available to the general public from federal, state,
				or local government records; widely distributed media; or disclosures to the
				general public made pursuant to federal, state, or local law.
1. A licensee has a reasonable basis to
				believe that information is lawfully made available to the general public if
				the licensee has taken steps to determine-
A.
				That the information is of the type that is available to the general public;
				and
B. Whether an individual can
				direct that the information not be made available to the general public and, if
				so, that the licensee's consumer has not done so.
2. Examples.
A. Publicly available information in
				government records includes information in government real estate records and
				security interest filings.
B.
				Publicly available information from widely distributed media includes
				information from a telephone book, a television or radio program, a newspaper,
				or a web site that is available to the general public on an unrestricted basis.
				A web site is not restricted merely because an Internet service provider or a
				site operator requires a fee or a password, so long as access is available to
				the general public.
C. Reasonable
				basis.
(I) A licensee has a reasonable basis
				to believe that mortgage information is lawfully made available to the general
				public if the licensee has determined that the information is of the type
				included on the public record in the jurisdiction where the mortgage would be
				recorded.
(II) A licensee has a
				reasonable basis to believe that an individual's telephone number is lawfully
				made available to the general public if the licensee has located the telephone
				number in the telephone book or the consumer has informed you that the
				telephone number is not unlisted;
(T) "Third-party claimant" has the same
				meaning as in subsection
				20 CSR
				100-1.010(1)(H).