The following words and terms, when used in this chapter,
have the following meanings, unless the context requires otherwise:
Act-The Insurance Department Act of 1921
(40
P. S. §§
1-321)
Affiliate-A company that controls, is
controlled by or is under common control with another company.
Clear and conspicuous-That a notice is
reasonably understandable and designed to call attention to the nature and
significance of the information in the notice. Examples include:
(i)
Reasonably
understandable. A licensee makes its notice reasonably understandable
if it does all of the following:
(A) Presents
the information in the notice in clear, concise sentences, paragraphs and
sections.
(B) Uses short
explanatory sentences or bullet lists whenever possible.
(C) Uses definite, concrete, everyday words
and active voice whenever possible.
(D) Avoids multiple negatives.
(E) Avoids legal and highly technical
business terminology whenever possible.
(F) Avoids explanations that are imprecise
and readily subject to different interpretations.
(ii)
Designed to call
attention. A licensee designs its notice to call attention to the
nature and significance of the information in it if the licensee does all of
the following:
(A) Uses a plain-language
heading to call attention to the notice.
(B) Uses a typeface and type size that are
easy to read.
(C) Provides wide
margins and ample line spacing.
(D)
Uses boldface or italics for key words.
(E) In a form that combines the licensee's
notice with other information, uses distinctive type size, style and graphic
devices, such as shading or sidebars.
(iii)
Notices on websites.
If a licensee provides a notice on a webpage, the licensee designs its notice
to call attention to the nature and significance of the information in it if
the licensee uses text or visual cues to encourage scrolling down the page if
necessary to view the entire notice and ensure that other elements on the
website (such as text, graphics, hyperlinks or sound) do not distract attention
from the notice, and the licensee either:
(A)
Places the notice on a screen that consumers frequently access, such as a page
on which transactions are conducted.
(B) Places a link on a screen that consumers
frequently access, such as a page on which transactions are conducted, that
connects directly to the notice and is labeled appropriately to convey the
importance, nature and relevance of the notice.
Collect-To obtain information that the
licensee organizes or can retrieve by the name of an individual or by
identifying number, symbol or other identifying particular assigned to the
individual, irrespective of the source of the underlying information.
Commissioner-The Insurance Commissioner of
the Commonwealth.
Company-A corporation, limited liability
company, business trust, general or limited partnership, association, sole
proprietorship or similar organization.
Consumer-An individual who seeks to
obtain, obtains or has obtained an insurance product or service from a licensee
that is to be used primarily for personal, family or household purposes, and
about whom the licensee has nonpublic personal financial information, or that
individual's legal representative. Examples include:
(i) An individual who provides nonpublic
personal financial information to a licensee in connection with obtaining or
seeking to obtain financial, investment or economic advisory services relating
to an insurance product or service is a consumer regardless of whether the
licensee establishes an ongoing advisory relationship.
(ii) An applicant for insurance prior to the
inception of insurance coverage is a licensee's consumer.
(iii) An individual who is a consumer of
another financial institution is not a licensee's consumer solely because the
licensee is acting as agent for, or provides processing or other services to,
that financial institution.
(iv) An
individual about whom a licensee discloses nonpublic personal financial
information to a nonaffiliated third party other than as permitted under
Subchapter D (relating to exceptions to limits on disclosures of nonpublic
personal financial information) and the individual is one of the following:
(A) A beneficiary of a life insurance policy
underwritten by the licensee.
(B) A
claimant under an insurance policy issued by the licensee.
(C) An insured or an annuitant under an
insurance policy or an annuity, respectively, issued by the licensee.
(D) A mortgagor of a mortgage covered under a
mortgage insurance policy.
(v) Provided that the licensee provides the
initial, annual and revised notices under §§
146a.11,
146a.12 and
146a.15 (relating to initial
privacy notice to consumers required; annual privacy notice to customers
required; and revised privacy notices) to the plan sponsor, group or blanket
insurance policyholder, group annuity contractholder, or workers' compensation
policyholder, and further provided that the licensee does not disclose to a
nonaffiliated third party nonpublic personal financial information about such
an individual other than as permitted under Subchapter D, an individual is not
the consumer of the licensee solely because the individual is one of the
following:
(A) A participant or a beneficiary
of an employee benefit plan that the licensee administers or sponsors or for
which the licensee acts as a trustee, insurer or fiduciary.
(B) Covered under a group or blanket
insurance policy or group annuity contract issued by the licensee.
(C) A claimant in a workers' compensation
plan.
(vi) The
individuals described in subparagraph (v) are consumers of a licensee if the
licensee does not meet all the conditions of subparagraph (v).
(vii) In no event shall the individuals,
solely by virtue of the status described in subparagraph (v), be deemed to be
customers for purposes of this chapter.
(viii) An individual is not a licensee's
consumer solely because the individual is a beneficiary of a trust for which
the licensee is a trustee.
(ix) An
individual is not a licensee's consumer solely because the individual has
designated the licensee as trustee for a trust.
Consumer reporting agency-The term has
the same meaning as in section 603(f) of the Federal Fair Credit Reporting Act
(15 U.S.C.A. §
1681a(f)).
Control-The term includes any of the
following:
(i) Ownership, control or
power to vote 25% or more of the outstanding shares of any class of voting
security of the company, directly or indirectly, or acting through one or more
other persons.
(ii) Control in any
manner over the election of a majority of the directors, trustees or general
partners (or individuals exercising similar functions) of the
company.
(iii) The power to
exercise, directly or indirectly, a controlling influence over the management
or policies of the company, as determined by the Commissioner.
Customer-A consumer who has a customer
relationship with a licensee.
Customer relationship-A continuing
relationship between a consumer and a licensee under which the licensee
provides one or more insurance products or services to the consumer that are to
be used primarily for personal, family or household purposes. Examples are as
follows:
(i) A consumer has a
continuing relationship with a licensee if either:
(A) The consumer is a current policyholder of
an insurance product issued by or through the licensee.
(B) The consumer obtains financial,
investment or economic advisory services relating to an insurance product or
service from the licensee for a fee.
(ii) A consumer does not have a continuing
relationship with a licensee if one of the following applies:
(A) The consumer applies for insurance but
does not purchase the insurance.
(B) The licensee sells the consumer airline
travel insurance in an isolated transaction.
(C) The individual is no longer a current
policyholder of an insurance product or no longer obtains insurance services
with or through the licensee.
(D)
The consumer is a beneficiary or claimant under a policy and has submitted a
claim under a policy choosing a settlement option involving an ongoing
relationship with the licensee.
(E)
The consumer is a beneficiary or a claimant under a policy and has submitted a
claim under that policy choosing a lump sum settlement option.
(F) The customer's policy is lapsed, expired
or otherwise inactive or dormant under the licensee's business practices, and
the licensee has not communicated with the customer about the relationship for
a period of 12-consecutive months, other than annual privacy notices, material
required by law or regulation, communication at the direction of a state or
Federal authority, or promotional materials.
(G) The individual is an insured or an
annuitant under an insurance policy or annuity, respectively, but is not the
policyholder or owner of the insurance policy or annuity.
(H) The individual's last known address
according to the licensee's records is deemed invalid. For the purposes of this
section, an address of record is deemed invalid if mail sent to that address by
the licensee has been returned by the postal authorities as undeliverable and
if subsequent attempts by the licensee to obtain a current valid address for
the individual have been unsuccessful.
Department-The Insurance Department of the
Commonwealth.
Federal model privacy form-The model form
in 16 CFR Part 313, Appendix A (relating to model privacy form), or a successor
provision, which is determined by Federal regulation to be compliant with the
requirements of the Gramm-Leach-Bliley Act (15 U.S.C.A. §§
6801-6827).
Financial institution-An institution the
business of which is engaging in activities that are financial in nature or
incidental to the financial activities as described in section 4(k) of the Bank
Holding Company Act of 1956 (12 U.S.C.A. §
1843(k)). The term does not
include the following:
(i) A person or
entity with respect to any financial activity that is subject to the
jurisdiction of the Commodity Futures Trading Commission under the Commodity
Exchange Act (7 U.S.C.A.
§§
1-
25).
(ii) The Federal Agricultural Mortgage
Corporation or any entity charged and operating under the Farm Credit Act of
1971 (12 U.S.C.A.
§§
2001-
2279cc).
(iii) Institutions chartered by Congress
specifically to engage in securitizations, secondary market sales (including
sales of servicing rights) or similar transactions related to a transaction of
a consumer, as long as the institutions do not sell or transfer nonpublic
personal financial information to a nonaffiliated third party.
Financial product or service-A product or
service that a financial holding company could offer by engaging in an activity
that is financial in nature or incidental to the financial activity under
section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C.A. §
1843(k)). Financial service
includes a financial institution's evaluation or brokerage of information that
the financial institution collects in connection with a request or an
application from a consumer for a financial product or service.
Health care-The term includes the
following:
(i) Preventative,
diagnostic, therapeutic, rehabilitative, maintenance or palliative care,
services, procedures, tests or counseling that either:
(A) Relates to the physical, mental or
behavioral condition of an individual.
(B) Affects the structure or function of the
human body or any part of the human body, including the banking of blood,
sperm, organs or any other tissue.
(ii) Prescribing, dispensing or furnishing to
an individual drugs or biologicals, or medical devices or health care equipment
and supplies.
Health care provider-A physician or other
health care practitioner licensed, accredited or certified to perform specified
health services consistent with State law, or a health care facility.
Health information-Any information or
data except age or gender, whether oral or recorded in any form or medium,
created by or derived from a health care provider or the consumer or customer
that relates to one or more of the following:
(i) The past, present or future physical,
mental or behavioral health or condition of an individual.
(ii) The provision of health care to an
individual.
(iii) Payment for the
provision of health care to an individual.
Insurance product or service-A product or
service that is offered by a licensee under the insurance laws of the
Commonwealth. Insurance service includes a licensee's evaluation, brokerage or
distribution of information that the licensee collects in connection with a
request or an application from a consumer for an insurance product or service.
Licensee-
(i) A licensed insurer, as defined in section
201-A of the act (40 P. S. §
65.1-A), a
producer and other persons or entities licensed or required to be licensed, or
authorized or required to be authorized, or registered or required to be
registered under the act or The Insurance Company Law of 1921 (40 P. S.
§§
341-999), including health
maintenance organizations holding a certificate of authority under section 201
of the Health Care Facilities Act (35 P. S. §
448.201).
(ii) The term does not include:
(A) Bail bondsmen as defined in
42 Pa.C.S. §
5741
(relating to definitions).
(B)
Motor vehicle physical damage appraisers as defined in section 2 of the Motor
Vehicle Physical Damage Appraiser Act (
63 P. S. §
852) and §
62.1 (relating to
definitions).
(C) Public adjusters
as defined in section 1 of the act of December 20, 1983 (P. L. 260, No. 72)
(
63
P. S. §
1601) and §
115.1 (relating to
definitions).
(D) An entity
providing continuing care as defined in section 3 and licensed under section 4
of the Continuing-Care Provider Registration and Disclosure Act (40 P. S.
§§
3203 and
3204).
(iii) Subject to subparagraph (iv), the term
does not include governmental health insurance programs such as the following:
(A) The Children's Health Insurance Program
as provided for in the Children's Health Care Act (40 P. S. §§
991.2301-991.2361).
(B) The Medicaid Program as provided for in
62
P. S. §§
441.1-449.
(C) The Medicare+Choice Program as provided
for in the Balanced Budget Act of 1997, sections 1851-1859, Medicare Part C
under Title XVIII of the Social Security Act.
(iv) The term includes a licensee that
enrolls, insures or otherwise provides insurance related services to
participants that procure health insurance through a governmental health
insurance program exempted under subparagraph (iii).
(v) A licensee is not subject to the notice
and opt out requirements for nonpublic personal financial information in this
subchapter and Subchapters B-D if the licensee is an employee, agent or other
representative of another licensee ("the principal") and both of the following
apply:
(A) The principal otherwise complies
with, and provides the notices required by, this chapter.
(B) The licensee does not disclose nonpublic
personal financial information to any person other than the principal or its
affiliates in a manner permitted by this chapter.
(vi) Subject to subparagraph (vii), the term
"licensee" shall also include a nonadmitted insurer that accepts business
placed through a surplus lines licensee (as defined in
40
P. S. §
991.1602 (relating to definition
of surplus lines licensee)) in this Commonwealth, but only in regard to the
surplus lines placements placed under Article XVI of The Insurance Company Law
(40
P. S. §§
991.1601-991.1625).
(vii) A surplus lines licensee or surplus
lines insurer shall be deemed to be in compliance with the notice and opt out
requirements for nonpublic personal financial information in this subchapter
and Subchapters B-D provided both of the following apply:
(A) The surplus lines licensee or insurer
does not disclose nonpublic personal financial information of a consumer or a
customer to nonaffiliated third parties for any purpose, including joint
servicing or marketing under §
146a.31 (relating to exception to
opt out requirements for disclosure of nonpublic personal financial information
for service providers and joint marketing), except as permitted by §
146a.32 or §
146a.33 (relating to exceptions to
notice and opt out requirements for disclosure of nonpublic personal financial
information for processing and servicing transactions; and other exceptions to
notice and opt out requirements for disclosure of nonpublic personal financial
information).
(B) The broker or
insurer delivers a notice to the consumer at the time a customer relationship
is established on which the following is printed in 16-point
type:
PRIVACY NOTICE
"NEITHER THE U. S. BROKERS THAT HAVE HANDLED THIS INSURANCE
NOR THE INSURERS THAT HAVE UNDERWRITTED THIS INSURANCE WILL DISCLOSE NONPUBLIC
PERSONAL FINANCIAL INFORMATION CONCERNING THE BUYER TO NONAFFILIATED THIRD
PARTIES EXCEPT AS PERMITTED BY LAW."
Nonaffiliated third party-
(i) Any person except either:
(A) A licensee's affiliate.
(B) A person employed jointly by a licensee
and any company that is not the licensee's affiliate (but nonaffiliated third
party includes the other company that jointly employs the person).
(ii) Nonaffiliated third party
includes any company that is an affiliate solely by virtue of the direct or
indirect ownership or control of the company by the licensee or its affiliate
in conducting merchant banking or investment banking activities of the type
described in section 4(k)(4)(H) or insurance company investment activities of
the type described in section 4(k)(4)(I) of the Federal Bank Holding Company
Act (12 U.S.C.A.
§§
1843(k)(4)(H) and
(I)).
Nonpublic personal financial
information-
(i) The term
means the following:
(A) Personally
identifiable financial information.
(B) Any list, description or other grouping
of consumers (and publicly available information pertaining to them) that is
derived using any personally identifiable financial information that is not
publicly available.
(ii)
The term does not include any of the following:
(A) Publicly available information, except as
included on a list described in subparagraph (i)(B).
(B) Any list, description or other grouping
of consumers (and publicly available information pertaining to them) that is
derived without using any personally identifiable financial information that is
not publicly available.
(C) Health
information.
(iii)
Examples of lists are as follows:
(A)
Nonpublic personal financial information includes any list of individuals'
names and street addresses that is derived in whole or in part using personally
identifiable financial information that is not publicly available, such as
account numbers.
(B) Nonpublic
personal financial information does not include any list of individuals' names
and addresses that contains only publicly available information, is not derived
in whole or in part using personally identifiable financial information that is
not publicly available, and is not disclosed in a manner that indicates that
any of the individuals on the list is a consumer of a financial
institution.
Personally identifiable financial
information-
(i) The term
means any of the following:
(A) Information
that a consumer provides to a licensee to obtain an insurance product or
service from the licensee.
(B)
Information about a consumer resulting from a transaction involving an
insurance product or service between a licensee and a consumer.
(C) Information that the licensee otherwise
obtains about a consumer in connection with providing an insurance product or
service to that consumer.
(ii) Examples are as follows:
(A)
Information included.
Personally identifiable financial information includes:
(I) Information a consumer provides to a
licensee on an application to obtain an insurance product or service.
(II) Account balance information and payment
history.
(III) The fact that an
individual is or has been one of the licensee's customers or has obtained an
insurance product or service from the licensee.
(IV) Information about the licensee's
consumer if it is disclosed in a manner that indicates that the individual is
or has been the licensee's consumer.
(V) Information that a consumer provides to a
licensee or that the licensee or its agent otherwise obtains in connection with
collecting on a loan or servicing a loan.
(VI) Information the licensee collects
through an Internet cookie (an information-collecting device from a web
server).
(VII) Information from a
consumer report.
(B)
Information not included. Personally identifiable financial
information does not include:
(I) A list of
names and addresses of customers of an entity that is not a financial
institution.
(II) Information that
does not identify a consumer, such as aggregate information or blind data that
does not contain personal identifiers such as account numbers, names or
addresses.
(III) Health
information.
Publicly available
information-Information that a licensee has a reasonable basis to
believe is lawfully made available to the public from one or more of the
following:
(i) Federal, State or local
government records.
(ii) Widely
distributed media.
(iii)
Disclosures to the public that are required to be made by Federal, State or
local law.
Reasonable basis-
(i) A licensee has a reasonable basis to
believe that information is lawfully made available to the public if the
licensee has taken steps to determine the following:
(A) That the information is of the type that
is available to the public.
(B)
Whether an individual can direct that the information not be made available to
the public and, if so, that the licensee's consumer has not done so.
(ii) The term includes the
following conditions:
(A) A licensee has a
reasonable basis to believe that mortgage information is lawfully made
available to the public if the licensee has determined that the information is
of the type included on the public record in the jurisdiction where the
mortgage would be recorded.
(B) A
licensee has a reasonable basis to believe that an individual's telephone
number is lawfully made available to the public if the licensee has located the
telephone number in the telephone book or the consumer has informed the
licensee that the telephone number is not unlisted.
(iii) Examples are as follows:
(A)
Government records.
Publicly available information in government records includes information in
government real estate records and security interest filings.
(B)
Widely distributed media
. Publicly available information from widely distributed media includes
information from a telephone book, a television or radio program, a newspaper
or a website that is available to the public on an unrestricted basis. A
website is not restricted merely because an Internet service provider or a site
operator requires a fee or a password, so long as access is available to the
public.
