Insurance Information and Privacy Protection Act.

(1) Existing law generally regulates the business of insurance in the state. Existing law, the Insurance Information and Privacy Protection Act, establishes privacy standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents, or insurance-support organizations that meet specified criteria. Under existing law, those insurance institutions, agents, and insurance-support organizations are exempted from the Confidentiality of Medical Information Act and specified consumer credit reporting laws. Existing law, the California Consumer Privacy Act of 2018, beginning on January 1, 2020, grants a consumer various rights with regard to the consumer's personal information that is held by a business, including the right to know what personal information is collected by a business, to have personal information held by that business deleted, and to direct a business to not sell the consumer's personal information, as specified. This bill would eliminate a consumer's right to request a business to delete or not sell the consumer's personal information under the California Consumer Privacy Act of 2018 if it is necessary to retain or share the consumer's personal information to complete an insurance transaction requested by the consumer. (2) Existing law requires an insurance institution or agent to provide a notice of information practices to all applicants or policyholders in connection with insurance transactions, as specified. Existing law prohibits an insurance institution, agent, or insurance-support organization from utilizing as its disclosure authorization form, a form or statement that authorizes the disclosure of personal or privileged information unless the form or statement meets specified requirements, including, among other things, that it be written in plain language, specifies the nature of the information authorized to be disclosed, and specifies the purposes for which the information is collected. This bill would require the notice of information practices to also be provided to the general public and would require the notice to include the categories of personal information to be collected and purposes for which the categories of personal information will be used. The bill would also require an insurance institution or agent to provide a clear and conspicuous notice that accurately reflects its privacy policies and practices, as specified. The bill would require the disclosure authorization form to set forth reasonable means by which an individual may exercise the right to opt out of any disclosures. The bill would require an insurance institution, agent, or insurance-support organization to implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of policyholder information. The bill would require the information security program to, among other things, ensure the security and confidentiality of policyholder information and protect against any anticipated threats or hazards to the security or integrity of policyholder information. (3) Existing law, the California Consumer Privacy Act of 2018, among other things, prohibits a business from selling the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers between 13 and 16 years of age, or the consumer's parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale of the consumer's personal information. Under existing law, a business that willfully disregards the consumer's age is deemed to have had actual knowledge of the consumer's age. This bill would enact similar provisions in the Insurance Information and Privacy Protection Act to prohibit an insurance institution, agent, or insurance-support organization from selling the personal information of an insured if the insurance institution, agent, or insurance-support organization has actual knowledge that the insured is less than 16 years of age, unless the insured, in the case of an insured between 13 and 16 years of age, or the insured's parent or guardian, in the case of an insured who is less than 13 years of age, has affirmatively authorized the sale of the insured's personal information. Under the bill, an insurance institution, agent, or insurance-support organization that willfully disregards an insured's age would be deemed to have had actual knowledge of the insured's age. (4) Existing law prohibits an insurance institution, agent, or insurance-support organization from disclosing any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is, among other things, with the written authorization of the individual, reasonably necessary to enable the person to perform a business, professional, or insurance function for the insurance institution, agent, or insurance-support organization or insured, or the disclosure is made for the purpose of conducting actuarial or research studies. This bill would define "research" for purposes of those provisions to mean scientific, systematic study and observation. The bill would prohibit an insurance institution, agent, or insurance-support organization from unfairly discriminating against an applicant or policyholder because that applicant or policyholder has opted out from the disclosure of nonpublic personal information or has not granted authorization for the disclosure of nonpublic personal medical record information.