Code of Vermont Rules › Agency 21 - DEPARTMENT OF FINANCIAL REGULATION › Sub-Agency 020 - INSURANCE DIVISION › Chapter 053 - REGULATION IH-2001-01 - PRIVACY OF CONSUMER FINANCIAL AND HEALTH INFORMATION REGULATION › Section 21 020 053 - REGULATION IH-2001-01 - PRIVACY OF CONSUMER FINANCIAL AND HEALTH INFORMATION REGULATION

Current through June, 2024
Article I GENERAL PROVSONS
Section 1 Authority
This regulation is promulgated pursuant to the authority
				  granted by
				  8 V.S.A. §§
												10,
				  15,
				  3381,
				  3541
				  et seq., 3688, 3829, 3858, 4062, 4108, 4113, 4201, 4362, 4373, 4464, 4480,
				  4481, 4515a, 4587, 4690, Chapter 129, 4812, 4836, 4902, 4990, 5104, 5111, 6015,
				  8005, 8014, 8053, and 1972, Act No. 72 (Adj. Sess.), §
											1.
Section 2 Purpose; Scope; Compliance
A. Purpose. This regulation governs the
				treatment of nonpublic personal financial information and nonpublic personal
				health information about individuals by all licensees under Parts 3 and 4 of
				title 8 V.S.A. This regulation:
(1) Requires
				a licensee to provide notice to individuals about its privacy policies and
				practices;
(2) Describes the
				conditions under which a licensee may disclose nonpublic personal financial
				information and nonpublic personal health information about individuals to
				nonaffiliated third parties; and
(3) Requires licensees to obtain consumer
				consent prior to disclosing that information subject to the exceptions in
				sections 14, 15, 16 and 17 of this regulation and subject to the federal Fair
				Credit Reporting Act and Vermont Fair Credit Reporting Act.
B. Scope. This regulation applies
				to:
(1) Nonpublic personal financial
				information about individuals who obtain or are claimants or beneficiaries of
				products or services primarily for personal, family or household purposes from
				licensees. This regulation does not apply to information about companies or
				about individuals who obtain financial products or services for business,
				commercial or agricultural purposes; and
(2) All nonpublic personal health
				information.
C.
				Compliance.
(1) A licensee domiciled in this
				state that is in compliance with this regulation in a state that has not
				enacted laws or regulations that meet the requirements of Title V of the
				Gramm-Leach-Bliley Act ( PL 106-102 ) may nonetheless be
				deemed to be in compliance with Title V of the Gramm-Leach-Bliley Act in such
				other state.
(2) For consumers who
				are not Vermont residents, a licensee domiciled in this state shall be deemed
				to be in compliance with Title V of the Gramm-Leach-Bliley Act in this state
				with respect to that consumer if the licensee is in compliance with a law or
				regulation enacted in the state of the consumer's domicile that meets the
				requirements of Title V of the Gramm-Leach-Bliley Act (
				PL
				106-102 ).
(3) A licensee not domiciled in this state
				shall comply with this rule for all transactions with Vermont
				consumers.
Section
				3 Rule of Construction
The examples in this regulation and the sample clauses in
				  Appendix A of this regulation are not exclusive. The examples in this
				  regulation and the sample clauses in the Appendix of this regulation provide
				  guidance concerning the rule's application in ordinary circumstances. The facts
				  and circumstances of each individual situation, however, will determine whether
				  compliance with an example or use of a sample clause, to the extent applicable,
				  constitutes compliance with this regulation.
Section 4 Definitions
As used in this regulation, unless the context requires
				  otherwise:
A. "Affiliate" means any
				company that controls, is controlled by or is under common control with another
				company.
B.
(1) "Clear and conspicuous" means that a
				notice is reasonably understandable and designed to call attention to the
				nature and significance of the information in the notice.
(2) Examples.
(a) Reasonably understandable. A licensee
				makes its notice reasonably understandable if it:
(i) Presents the information in the notice in
				clear, concise sentences, paragraphs, and sections;
(ii) Uses short explanatory sentences or
				bullet lists whenever possible;
(iii) Uses definite, concrete, everyday words
				and active voice whenever possible;
(iv) Avoids multiple negatives;
(v) Avoids legal and highly technical
				business terminology whenever possible;
(vi) Avoids explanations that are imprecise
				and readily subject to different interpretations; and,
(vii) Avoids contradictory, confusing or
				misleading language.
(b)
				Designed to call attention. A licensee designs its notice to call attention to
				the nature and significance of the information in it if the licensee:
(i) Uses a plain-language heading to call
				attention to the notice;
(ii) Uses
				a typeface and type size that are easy to read;
(iii) Provides wide margins and ample line
				spacing;
(iv) Uses boldface or
				italics for key words; and
(v) In a
				form that combines the licensee's notice with other information, uses
				distinctive type size, style, and graphic devices, such as shading or
				sidebars.
(c) Notices on
				web sites. If a licensee provides a notice on a web page, the licensee designs
				its notice to call attention to the nature and significance of the information
				in it if the licensee uses text or visual cues to encourage scrolling down the
				page if necessary to view the entire notice and ensure that other elements on
				the web site (such as text, graphics, hyperlinks or sound) do not distract
				attention from the notice, and the licensee either:
(i) Places the notice on a screen that
				consumers frequently access, such as a page on which transactions are
				conducted; or
(ii) Places a link on
				a screen that consumers frequently access, such as a page on which transactions
				are conducted, that connects directly to the notice and is labeled
				appropriately to convey the importance, nature and relevance of the
				notice.
C. "Collect" means to obtain information that
				the licensee organizes or can retrieve by the name of an individual or by
				identifying number, symbol or other identifying particular assigned to the
				individual, irrespective of the source of the underlying information.
D. "Commissioner" means the commissioner of
				the Department of Banking, Insurance, Securities and Health Care Administration
				of this state.
E. "Company" means a
				corporation, limited liability company, business trust, general or limited
				partnership, association, sole proprietorship or similar
				organization.
F.
(1) "Consumer" means an individual who seeks
				to obtain, obtains or has obtained an insurance product or service from a
				licensee that is to be used primarily for personal, family or household
				purposes, and about whom the licensee has nonpublic personal information, or
				that individual's legal representative.
(2) Examples.
(a) An individual who provides nonpublic
				personal information to a licensee in connection with obtaining or seeking to
				obtain financial, investment or economic advisory services relating to an
				insurance product or service is a consumer regardless of whether the licensee
				establishes an ongoing advisory relationship.
(b) An applicant for insurance prior to the
				inception of insurance coverage is a licensee's consumer.
(c) An individual who is a consumer of
				another financial institution is not a licensee's consumer solely because the
				licensee is acting as agent for, or provides processing or other services to,
				that financial institution.
(d) An
				individual is a licensee's consumer if:
(i)
(A) the individual is a beneficiary of a life
				insurance policy underwritten by the licensee;
(B) the individual is a claimant under an
				insurance policy issued by the licensee;
(C) the individual is an insured or an
				annuitant under an insurance policy or an annuity, respectively, issued by the
				licensee; or
(D) the individual is
				a mortgagor of a mortgage covered under a mortgage insurance policy;
				and
(ii) the licensee
				discloses nonpublic personal financial information about the individual to a
				nonaffiliated third party other than as permitted under Sections 14, 15 and 16
				of this regulation.
(e)
				Provided that the licensee provides the initial, annual and revised notices
				under Sections
				5,
				6 and 9 of
				this regulation to the plan sponsor, group or blanket insurance policyholder or
				group annuity contractholder, workers' compensation plan participant, and
				further provided that the licensee does not disclose to a nonaffiliated third
				party nonpublic personal financial information about such an individual other
				than as permitted under Sections 14, 15 and 16 of this regulation, an
				individual is not the consumer of the licensee solely because he or she is:
(i) A participant or a beneficiary of an
				employee benefit plan that the licensee administers or sponsors or for which
				the licensee acts as a trustee, insurer or fiduciary;
(ii) Covered under a group or blanket
				insurance policy or group annuity contract issued by the licensee; or
(iii) A beneficiary in a workers'
				compensation plan;
(f)
(i) The individuals described in subdivisions
				(e)(i) through (iii) of this subsection F are consumers of a licensee if the
				licensee does not meet all the conditions of subdivision (e).
(ii) In no event shall the individuals,
				solely by virtue of the status described in subdivision (e)(i)
				through
(iii) of this subsection F,
				be deemed to be customers for purposes of this regulation.
(g) An individual is not a licensee's
				consumer solely because he or she is a beneficiary of a trust for which the
				licensee is a trustee.
(h) An
				individual is not a licensee's consumer solely because he or she has designated
				the licensee as trustee for a trust.
G. "Consumer reporting agency" has the same
				meaning as in Section
				603(f)
				of the federal Fair Credit Reporting Act (
				15 U.S.C. §
												1681 a(f) ) and shall include any "credit
				reporting agency" within the meaning of
				9 V.S.A. §
												2480a(3).
H. "Control" means:
(1) Ownership, control or power to vote
				twenty-five percent (25%) or more of the outstanding shares of any class of
				voting security of the company, directly or indirectly, or acting through one
				or more other persons;
(2) Control
				in any manner over the election of a majority of the directors, trustees or
				general partners (or individuals exercising similar functions) of the company;
				or
(3) The power to exercise,
				directly or indirectly, a controlling influence over the management or policies
				of the company, as the commissioner determines.
I. "Customer" means a consumer who has a
				customer relationship with a licensee.
J.
(1)
				"Customer relationship" means a continuing relationship between a consumer and
				a licensee under which the licensee provides one or more insurance products or
				services to the consumer that are to be used primarily for personal, family or
				household purposes.
(2) Examples.
(a) A consumer has a continuing relationship
				with a licensee if:
(i) The consumer is a
				current policyholder of an insurance product issued by or through the licensee;
				or
(ii) The consumer obtains
				financial, investment or economic advisory services relating to an insurance
				product or service from the licensee for a fee.
(b) A consumer does not have a continuing
				relationship with a licensee if:
(i) The
				consumer applies for insurance but does not purchase the insurance;
(ii) The licensee sells the consumer travel
				insurance in an isolated transaction;
(iii) The individual is no longer a current
				policyholder of an insurance product or no longer obtains insurance services
				with or through the licensee;
(iv)
				The consumer is a beneficiary or claimant under a policy and has submitted a
				claim under a policy choosing a settlement option involving an ongoing
				relationship with the licensee;
(v)
				The consumer is a beneficiary or a claimant under a policy and has submitted a
				claim under that policy choosing a lump sum settlement option;
(vi) The customer's policy is lapsed,
				expired, or otherwise inactive or dormant under the licensee's business
				practices, and the licensee has not communicated with the customer about the
				relationship for a period of twelve (12) consecutive months, other than annual
				privacy notices, material required by law or regulation, communication at the
				direction of a state or federal authority, or promotional materials;
(vii) The individual is an insured or an
				annuitant under an insurance policy or annuity, respectively, but is not the
				policyholder or owner of the insurance policy or annuity; or
(viii) The individual's last known address
				according to the licensee's records is invalid. For purposes of this rule, an
				address of record is invalid if mail sent to that address by the licensee has
				been returned by the postal authorities as undeliverable and if subsequent
				attempts by the licensee to obtain a current valid address for the individual
				have been unsuccessful.
K.
(1)
				"Financial institution" means any institution the business of which is engaging
				in activities that are financial in nature or incidental to such financial
				activities as described in Section
				4(k)
				of the Bank Holding Company Act of 1956 (
				12 U.S.C. §
													1843(k) ).
(2) Financial institution does not include:
(i) Any person or entity with respect to any
				financial activity that is subject to the jurisdiction of the Commodity Futures
				Trading Commission under the Commodity Exchange Act (
				7
				U.S.C. §
														1 et seq.);
(ii) The Federal Agricultural Mortgage
				Corporation or any entity charged and operating under the Farm Credit Act of
				1971 (
				12 U.S.C. §
														2001 et seq.); or
(iii) Institutions chartered by Congress
				specifically to engage in securitizations, secondary market sales (including
				sales of servicing rights) or similar transactions related to a transaction of
				a consumer, as long as the institutions do not sell or transfer nonpublic
				personal information to a nonaffiliated third party.
L.
(1) "Financial product or service" means any
				product or service that a financial holding company could offer by engaging in
				an activity that is financial in nature or incidental to such a financial
				activity under Section
				4(k)
				of the Bank Holding Company Act of 1956 (
				12 U.S.C. §
													1843(k) ).
(2) Financial service includes a financial
				institution's evaluation or brokerage of information that the financial
				institution collects in connection with a request or an application from a
				consumer for a financial product or service.
M. "Health care" means:
(1) Preventive, diagnostic, therapeutic,
				rehabilitative, maintenance or palliative care, services, procedures, tests or
				counseling that:
(a) Relates to the physical,
				mental or behavioral condition of an individual; or
(b) Affects the structure or function of the
				human body or any part of the human body, including the banking of blood,
				sperm, organs or any other tissue; or
(2) Prescribing, dispensing or furnishing to
				an individual drugs or biologicals, or medical devices or health care equipment
				and supplies.
N. "Health
				care provider" means a physician or other health care practitioner licensed,
				accredited or certified to perform specified health services consistent with
				state law, or a health care facility.
O. "Health information" means any information
				or data except age or gender, whether oral or recorded in any form or medium,
				created by or derived from a health care provider or the consumer that relates
				to:
(1) The past, present or future physical,
				mental or behavioral health or condition of an individual;
(2) The provision of health care to an
				individual; or
(3) Payment for the
				provision of health care to an individual.
P.
(1)
				"Insurance product or service" means any product or service that is offered by
				a licensee pursuant to Parts 3 and 4 of title 8 V.S.A.
(2) Insurance service includes a licensee's
				evaluation, brokerage or distribution of information that the licensee collects
				in connection with a request or an application from a consumer for an insurance
				product or service.
Q.
(1) "Licensee" means all licensed insurers,
				producers and other persons licensed or required to be licensed, or authorized
				or required to be authorized, or registered or required to be registered
				pursuant to Parts 3 and 4 of title 8 V.S.A., except for persons registered
				under §
												4248 of
				title 8 V.S.A.
(2) A licensee is
				not subject to the notice and opt in requirements for nonpublic personal
				financial information set forth in Articles I, II, III and IV of this
				regulation if the licensee is an employee, agent or other representative of
				another licensee ("the principal") and:
(a)
				The principal otherwise complies with, and provides the notices required by,
				the provisions of this regulation; and
(b) The licensee does not disclose any
				nonpublic personal information to any person other than the principal or its
				affiliates except in a manner permitted by this regulation.
(3)
(a) Subject to subdivision (b) of this
				subdivision Q (3), "licensee" shall also include an unauthorized insurer that
				accepts business placed through a licensed surplus lines broker in this state,
				but only in regard to the surplus lines placements placed pursuant to chapter
				138 of title 8 V.S.A.
(b) A surplus
				lines broker or surplus lines insurer shall be deemed to be in compliance with
				the notice and opt in requirements for nonpublic personal financial information
				set forth in Articles I, II, III and IV of this regulation provided:
(i) The broker or insurer does not disclose
				nonpublic personal information of a consumer or a customer to third parties for
				any purpose, including joint servicing or marketing under Section 14 of this
				regulation, except as permitted by Section 15 or 16 of this regulation;
				and
(ii) The broker or insurer
				delivers a notice to the consumer at the time a customer relationship is
				established on which the following is printed in 16-point type:
PRIVACY NOTICE
"Neither the U.S. brokers that handled this insurance nor the
				  insurers that have underwritten this insurance will disclose nonpublic personal
				  information concerning the buyer to nonaffiliates of the brokers or insurers
				  except as permitted by law."
R.
(1)
				"Nonaffiliated third party" means any person except:
(a) A licensee's affiliate; or
(b) A person employed jointly by a licensee
				and any company that is not the licensee's affiliate (but nonaffiliated third
				party includes the other company that jointly employs the person).
(2) Nonaffiliated third party
				includes any company that is an affiliate solely by virtue of the direct or
				indirect ownership or control of the company by the licensee or its affiliate
				in conducting merchant banking or investment banking activities of the type
				described in Section
				4(k)(4)(H)
				of the federal Bank Holding Company Act and
				8 V.S.A. §
													12603 or insurance company investment
				activities of the type described in Section
				4(k)(4)(I)
				of the federal Bank Holding Company Act (
				12 U.S.C. §
													1843(k)(4)(H) and (I) ).
S. "Nonpublic personal
				information" means nonpublic personal financial information and nonpublic
				personal health information.
T.
(1) "Nonpublic personal financial
				information" means:
(a) Personally
				identifiable financial information; and
(b) Any list, description or other grouping
				of consumers (and publicly available information pertaining to them) that is
				derived using any personally identifiable financial information that is not
				publicly available.
(2)
				Nonpublic personal financial information does not include:
(a) Health information;
(b) Publicly available information, except as
				included on a list described in subdivision (1)(b) of this subsection (T);
				or
(c) Any list, description or
				other grouping of consumers (and publicly available information pertaining to
				them) that is derived without using any personally identifiable financial
				information that is not publicly available.
(3) Examples.
(a) Nonpublic personal financial information
				includes any list of individuals' names and street addresses that is derived in
				whole or in part using personally identifiable financial information that is
				not publicly available, such as account numbers.
(b) Nonpublic personal financial information
				does not include any list of individuals' names and addresses that contains
				only publicly available information, is not derived in whole or in part using
				personally identifiable financial information that is not publicly available,
				and is not disclosed in a manner that indicates that any of the individuals on
				the list is a consumer of a financial institution.
U. "Nonpublic personal health
				information" means health information:
(1)
				That identifies an individual who is the subject of the information;
				or
(2) With respect to which there
				is a reasonable basis to believe that the information could be used to identify
				an individual.
V.
(1) "Personally identifiable financial
				information" means any information:
(a) A
				consumer provides to a licensee to obtain an insurance product or service from
				the licensee;
(b) About a consumer
				resulting from a transaction involving an insurance product or service between
				a licensee and a consumer; or
(c)
				The licensee otherwise obtains about a consumer in connection with providing an
				insurance product or service to that consumer.
(2) Examples.
(a) Information included. Personally
				identifiable financial information includes:
(i) Information a consumer provides to a
				licensee on an application to obtain an insurance product or service;
(ii) Account balance information and payment
				history;
(iii) The fact that an
				individual is or has been one of the licensee's customers or has obtained an
				insurance product or service from the licensee;
(iv) Any information about the licensee's
				consumer if it is disclosed in a manner that indicates that the individual is
				or has been the licensee's consumer;
(v) Any information that a consumer provides
				to a licensee or that the licensee or its agent otherwise obtains in connection
				with collecting on a loan or servicing a loan;
(vi) Any information the licensee collects
				through an Internet cookie (an information-collecting device from a web
				server); and
(vii) Information from
				a consumer report.
(b)
				Information not included. Personally identifiable financial information does
				not include:
(i) Health
				information;
(ii) A list of names
				and addresses of customers of an entity that is not a financial institution;
				and
(iii) Information that does not
				identify a consumer, such as aggregate information or blind data that does not
				contain personal identifiers such as account numbers, names or addresses.
W.
(1) "Publicly available information" means
				any information that a licensee has a reasonable basis to believe is lawfully
				made available to the general public from:
(a) Federal, state or local government
				records;
(b) Widely distributed
				media; or
(c) Disclosures to the
				general public that are required to be made by federal, state or local
				law.
(2) Reasonable
				basis. A licensee has a reasonable basis to believe that information is
				lawfully made available to the general public if the licensee has taken steps
				to determine:
(a) That the information is of
				the type that is available to the general public; and
(b) Whether an individual can direct that the
				information not be made available to the general public and, if so, that the
				licensee's consumer has not done so.
(3) Examples.
(a) Government records. Publicly available
				information in government records includes information in government real
				estate records and security interest filings.
(b) Widely distributed media. Publicly
				available information from widely distributed media includes information from a
				telephone book, a television or radio program, a newspaper or a web site that
				is available to the general public on an unrestricted basis. A web site is not
				restricted merely because an Internet service provider or a site operator
				requires a fee or a password, so long as access is available to the general
				public.
(c) Reasonable basis.
(i) A licensee has a reasonable basis to
				believe that mortgage information is lawfully made available to the general
				public if the licensee has determined that the information is of the type
				included on the public record in the jurisdiction where the mortgage would be
				recorded.
(ii) A licensee has a
				reasonable basis to believe that an individual's telephone number is lawfully
				made available to the general public if the licensee has located the telephone
				number in the telephone book or the consumer has informed the licensee that the
				telephone number is not unlisted.