Alaska Privacy Regulation Does Not Comply with State Law

A proposed state privacy regulation does not comply with the enabling legislation, and therefore the state Insurance Division does not have authority to adopt the rule, according to the National Association of Independent Insurers (NAII).

“The federal Gramm-Leach-Bliley Act (GLBA) notice cannot be used to fulfill the requirements mandated by the Alaska Legislature,” Kathleen Jensen, NAII insurance services counsel, said in a letter to the division.

The 2001 state law authorizing the Insurance Division to adopt a privacy regulation stipulates the regulation must be at least as restrictive as a model by the National Conference of Insurance Legislators (NCOIL), Jensen noted. But since the NCOIL model includes privacy notice requirements and the division’s proposal does not include such a requirement, the proposed regulation is less restrictive than the NCOIL model and therefore contrary to state law, she said.

“We are aware that the Insurance Division anticipates insurance companies will utilize the notice provisions contained in GLBA,” Jensen said. “Unfortunately, the division’s proposed regulation significantly diverges from GLBA in virtually every other aspect so that an insurer cannot utilize a GLBA notice.”

Differences between GLBA and the proposed state regulation, Jensen said, include:
· The GLBA notice contains an opt-out provision, allowing disclosure of information unless the person involved specifically asks that such information not be shared. The proposed state regulation requires the person to authorize the disclosure before the information can be shared.
· GLBA requires the privacy notice and opt-out provision to be sent annually. But the Alaskan proposal requires the authorization to be received every other year. The annual GLBA notice does not need to be sent to consumers but the definition of “consumer” is vastly different in the Alaskan proposal.

“The practical aspect of this is that an insurer would not be required to send the notice under GLBA but would be so required under the Alaskan proposal,” Jensen asserted. “The inclusion of notice requirements in the regulation would be a substantive change and would be very important to both insurers and consumers in Alaska.”

Jensen commented that the division is attempting to adopt a regulation that is consistent with a law that in part regulates the disclosure of personal information by banks in Alaska, whereas it appears that the Legislature never intended that law to apply to insurance companies.

NAII also is concerned that the proposed regulation would require a specific authorization before a company can share information with an affiliate, she said. But it is necessary for affiliates within a family of companies to share information not only to facilitate the insurance transaction but also to benefit consumers.

“For example, it is customary for a family of insurance companies to have different levels of companies for individuals with differing levels of risk,” she said. “If an applicant applies for insurance from a company in one level but in fact would qualify for insurance from a higher level affiliate, at a lower cost, the initial company would be prohibited from sharing the applicant’s information with an affiliate offering lower rates. Prohibiting the disclosure of the information between affiliates would harm consumers in Alaska.”

The regulation also is contrary to state law when it applies its terms to workers’ compensation insurance although the enabling legislation primarily applied to insurance for personal, family or household purposes, according to Jensen.

“Clearly the purpose of workers’ compensation insurance is to protect businesses and is not for personal, family or household purposes,” Jensen added.

Topics Carriers Legislation Alaska