HF 1493

as introduced - 82nd Legislature (2001 - 2002) Posted on 12/15/2009 12:00am

  1.1                          A bill for an act 
  1.2             relating to commerce; regulating the privacy of 
  1.3             consumer financial and health information; amending 
  1.4             Minnesota Statutes 2000, section 72A.501; proposing 
  1.5             coding for new law as Minnesota Statutes, chapter 60M; 
  1.6             repealing Minnesota Statutes 2000, sections 72A.494; 
  1.7             and 72A.502. 
  1.8   BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA: 
  1.9                              ARTICLE 1 
  1.10                         GENERAL PROVISIONS 
  1.11     Section 1.  [60M.01] [PURPOSE AND SCOPE.] 
  1.12     Subdivision 1.  [PURPOSE.] This chapter governs the 
  1.13  treatment of nonpublic personal health information and nonpublic 
  1.14  personal financial information about individuals by all 
  1.15  licensees.  This chapter: 
  1.16     (1) requires a licensee to provide notice to individuals 
  1.17  about its privacy policies and practices; 
  1.18     (2) describes the conditions under which a licensee may 
  1.19  disclose nonpublic personal health information and nonpublic 
  1.20  personal financial information about individuals to affiliates 
  1.21  and nonaffiliated third parties; and 
  1.22     (3) provides methods for individuals to prevent a licensee 
  1.23  from disclosing that information. 
  1.24     Subd. 2.  [SCOPE.] This chapter applies to: 
  1.25     (1) nonpublic personal financial information about 
  1.26  individuals who obtain or are claimants or beneficiaries of 
  2.1   products or services primarily for personal, family, or 
  2.2   household purposes from licensees.  This chapter does not apply 
  2.3   to information about companies or about individuals who obtain 
  2.4   products or services for business, commercial, or agricultural 
  2.5   purposes; and 
  2.6      (2) all nonpublic personal health information. 
  2.7      Subd. 3.  [COMPLIANCE.] A licensee domiciled in this state 
  2.8   that is in compliance with this chapter in a state that has not 
  2.9   enacted laws or regulations that meet the requirements of Title 
  2.10  V of the Gramm-Leach-Bliley Act, Public Law Number 102-106, may 
  2.11  nonetheless be deemed to be in compliance with Title V of the 
  2.12  Gramm-Leach-Bliley Act in that other state. 
  2.13     Sec. 2.  [60M.02] [DEFINITIONS.] 
  2.14     Subdivision 1.  [SCOPE.] For purposes of this chapter, the 
  2.15  terms in subdivisions 2 to 23 have the meanings given them, 
  2.16  unless the context requires otherwise. 
  2.17     Subd. 2.  [AFFILIATE.] "Affiliate" means any company that 
  2.18  controls, is controlled by, or is under common control with 
  2.19  another company. 
  2.20     Subd. 3.  [CLEAR AND CONSPICUOUS.] (a) "Clear and 
  2.21  conspicuous" means that a notice is reasonably understandable 
  2.22  and designed to call attention to the nature and significance of 
  2.23  the information in the notice.  
  2.24     (b) A licensee makes its notice reasonably understandable 
  2.25  if it: 
  2.26     (1) presents the information in the notice in clear, 
  2.27  concise sentences, paragraphs, and sections; 
  2.28     (2) uses short explanatory sentences or bullet lists 
  2.29  whenever possible; 
  2.30     (3) uses definite, concrete, everyday words, and active 
  2.31  voice whenever possible; 
  2.32     (4) avoids multiple negatives; 
  2.33     (5) avoids legal and highly technical business terminology 
  2.34  whenever possible; and 
  2.35     (6) avoids explanations that are imprecise and readily 
  2.36  subject to different interpretations. 
  3.1      (c) A licensee designs its notice to call attention to the 
  3.2   nature and significance of the information in it if the licensee:
  3.3      (1) uses a plain-language heading to call attention to the 
  3.4   notice; 
  3.5      (2) uses a typeface and type size that are easy to read; 
  3.6      (3) provides wide margins and ample line spacing; 
  3.7      (4) uses boldface or italics for key words; and 
  3.8      (5) in a form that combines the licensee's notice with 
  3.9   other information, uses distinctive type size, style, and 
  3.10  graphic devices, such as shading or sidebars. 
  3.11     (d) If a licensee provides a notice on a Web page, the 
  3.12  licensee designs its notice to call attention to the nature and 
  3.13  significance of the information in it if the licensee uses text 
  3.14  or visual cues to encourage scrolling down the page if necessary 
  3.15  to view the entire notice and ensure that other elements on the 
  3.16  Web site (such as text, graphics, hyperlinks, or sound) do not 
  3.17  distract attention from the notice, and the licensee either: 
  3.18     (1) places the notice on a screen that consumers frequently 
  3.19  access, such as a page on which transactions are conducted; or 
  3.20     (2) places a link on a screen that consumers frequently 
  3.21  access, such as a page on which transactions are conducted, that 
  3.22  connects directly to the notice and is labeled appropriately to 
  3.23  convey the importance, nature, and relevance of the notice. 
  3.24     Subd. 4.  [COLLECT.] "Collect" means to obtain information 
  3.25  that the licensee organizes or can retrieve by the name of an 
  3.26  individual or by identifying number, symbol, or other 
  3.27  identifying particular assigned to the individual, irrespective 
  3.28  of the source of the underlying information. 
  3.29     Subd. 5.  [COMMISSIONER.] "Commissioner" means the 
  3.30  commissioner of commerce. 
  3.31     Subd. 6.  [COMPANY.] "Company" means a corporation, limited 
  3.32  liability company, business trust, general or limited 
  3.33  partnership, association, sole proprietorship, or similar 
  3.34  organization.  
  3.35     Subd. 7.  [CONSUMER.] (a) "Consumer" means an individual 
  3.36  who seeks to obtain, obtains, or has obtained an insurance 
  4.1   product or service from a licensee that is to be used primarily 
  4.2   for personal, family, or household purposes, and about whom the 
  4.3   licensee has nonpublic personal information, or that 
  4.4   individual's legal representative. 
  4.5      (b) An individual who provides nonpublic personal 
  4.6   information to a licensee in connection with obtaining or 
  4.7   seeking to obtain financial, investment, or economic advisory 
  4.8   services relating to an insurance product or service is a 
  4.9   consumer regardless of whether the licensee establishes an 
  4.10  ongoing advisory relationship. 
  4.11     (c) An applicant for insurance before the inception of 
  4.12  insurance coverage is a licensee's consumer. 
  4.13     (d) An individual who is a consumer of another financial 
  4.14  institution is not a licensee's consumer solely because the 
  4.15  licensee is acting as agent for, or provides processing or other 
  4.16  services to, that financial institution. 
  4.17     (e) An individual is a licensee's consumer if: 
  4.18     (1)(i) the individual is a beneficiary of a life insurance 
  4.19  policy underwritten by the licensee; 
  4.20     (ii) the individual is a claimant under an insurance policy 
  4.21  issued by the licensee; 
  4.22     (iii) the individual is an insured or an annuitant under an 
  4.23  insurance policy or an annuity, respectively, issued by the 
  4.24  licensee; or 
  4.25     (iv) the individual is a mortgagor of a mortgage covered 
  4.26  under a mortgage insurance policy; and 
  4.27     (2) the license discloses nonpublic personal financial 
  4.28  information about the individual to a nonaffiliated third party 
  4.29  other than as permitted under sections 60M.12, 60M.13, and 
  4.30  60M.14. 
  4.31     (f) Provided that the licensee provides the initial, 
  4.32  annual, and revised notices under sections 60M.03, 60M.04, and 
  4.33  60M.05 to the plan sponsor, group, or blanket insurance 
  4.34  policyholder or group annuity contract holder, workers' 
  4.35  compensation plan participant, and further provided that the 
  4.36  licensee does not disclose to a nonaffiliated third party 
  5.1   nonpublic personal financial information about such an 
  5.2   individual other than as permitted under sections 60M.12, 60M.13 
  5.3   and 60M.14, an individual is not the consumer of the licensee 
  5.4   solely because the individual is: 
  5.5      (1) a participant or a beneficiary of an employee benefit 
  5.6   plan that the licensee administers or sponsors or for which the 
  5.7   licensee acts as a trustee, insurer, or fiduciary; 
  5.8      (2) covered under a group or blanket insurance policy or 
  5.9   group annuity contract issued by the licensee; or 
  5.10     (3) a beneficiary in a workers' compensation plan. 
  5.11     (g)(1) The individuals described in paragraph (f), clauses 
  5.12  (1) to (3), are consumers of a licensee if the licensee does not 
  5.13  meet all the conditions of paragraph (f). 
  5.14     (2) The individuals are not customers for purposes of this 
  5.15  chapter solely by virtue of the status described in paragraph 
  5.16  (f), clauses (1) to (3). 
  5.17     (h) An individual is not a licensee's consumer solely 
  5.18  because the individual is a beneficiary of a trust for which the 
  5.19  licensee is a trustee. 
  5.20     (i) An individual is not a licensee's consumer solely 
  5.21  because the individual has designated the licensee as trustee 
  5.22  for a trust. 
  5.23     Subd. 8.  [CONSUMER REPORTING AGENCY.] "Consumer reporting 
  5.24  agency" has the same meaning as in section 603(f) of the federal 
  5.25  Fair Credit Reporting Act, United States Code, title 15, section 
  5.26  1681a(f). 
  5.27     Subd. 9.  [CONTROL.] "Control" means: 
  5.28     (1) ownership, control, or power to vote 25 percent or more 
  5.29  of the outstanding shares of any class of voting security of the 
  5.30  company, directly or indirectly, or acting through one or more 
  5.31  other persons; 
  5.32     (2) control in any manner over the election of a majority 
  5.33  of the directors, trustees, or general partners, or individuals 
  5.34  exercising similar functions, of the company; or 
  5.35     (3) the power to exercise, directly or indirectly, a 
  5.36  controlling influence over the management or policies of the 
  6.1   company, as the commissioner determines. 
  6.2      Subd. 10.  [CUSTOMER.] (a) "Customer" means a consumer who 
  6.3   has a customer relationship with a licensee. 
  6.4      (b) "Customer relationship" means a continuing relationship 
  6.5   between a consumer and a licensee under which the licensee 
  6.6   provides one or more insurance products or services to the 
  6.7   consumer that are to be used primarily for personal, family, or 
  6.8   household purposes. 
  6.9      (1) A consumer has a continuing relationship with a 
  6.10  licensee if: 
  6.11     (i) the consumer is a current policyholder of an insurance 
  6.12  product issued by or through the licensee; or 
  6.13     (ii) the consumer obtains financial, investment, or 
  6.14  economic advisory services relating to an insurance product or 
  6.15  service from the licensee for a fee. 
  6.16     (2) A consumer does not have a continuing relationship with 
  6.17  a licensee if: 
  6.18     (i) the consumer applies for insurance but does not 
  6.19  purchase the insurance; 
  6.20     (ii) the licensee sells the consumer airline travel 
  6.21  insurance in an isolated transaction; 
  6.22     (iii) the individual is no longer a current policyholder of 
  6.23  an insurance product or no longer obtains insurance services 
  6.24  with or through the licensee; 
  6.25     (iv) the consumer is a beneficiary or claimant under a 
  6.26  policy and has submitted a claim under a policy choosing a 
  6.27  settlement option involving an ongoing relationship with the 
  6.28  licensee; 
  6.29     (v) the consumer is a beneficiary or a claimant under a 
  6.30  policy and has submitted a claim under that policy choosing a 
  6.31  lump sum settlement option; 
  6.32     (vi) the customer's policy is lapsed, expired, or otherwise 
  6.33  inactive or dormant under the licensee's business practices, and 
  6.34  the licensee has not communicated with the customer about the 
  6.35  relationship for a period of 12 consecutive months, other than 
  6.36  annual privacy notices, material required by law or regulation, 
  7.1   communication at the direction of a state or federal authority, 
  7.2   or promotional materials; 
  7.3      (vii) the individual is an insured or an annuitant under an 
  7.4   insurance policy or annuity, respectively, but is not the 
  7.5   policyholder or owner of the insurance policy or annuity; or 
  7.6      (viii) for the purposes of this chapter, the individual's 
  7.7   last known address according to the licensee's records is deemed 
  7.8   invalid.  An address of record is deemed invalid if mail sent to 
  7.9   that address by the licensee has been returned by the postal 
  7.10  authorities as undeliverable and if subsequent attempts by the 
  7.11  licensee to obtain a current valid address for the individual 
  7.12  have been unsuccessful. 
  7.13     Subd. 11.  [FINANCIAL INSTITUTION.] "Financial institution" 
  7.14  means any institution the business of which is engaging in 
  7.15  activities that are financial in nature or incidental to such 
  7.16  financial activities as described in section 4(k) of the Bank 
  7.17  Holding Company Act of 1956, United States Code, title 14, 
  7.18  section 1843(k). 
  7.19     Financial institution does not include: 
  7.20     (1) any person or entity with respect to any financial 
  7.21  activity that is subject to the jurisdiction of the Commodity 
  7.22  Futures Trading Commission under the Commodity Exchange Act, 
  7.23  United States Code, title 7, section 1 et seq.; 
  7.24     (2) the Federal Agricultural Mortgage Corporation or any 
  7.25  entity charged and operating under the Farm Credit Act of 1971, 
  7.26  United States Code, title 12, 2001 et seq.; or 
  7.27     (3) institutions chartered by Congress specifically to 
  7.28  engage in securitizations, secondary market sales, including 
  7.29  sales of servicing rights, or similar transactions related to a 
  7.30  transaction of a consumer, as long as the institutions do not 
  7.31  sell or transfer nonpublic personal information to a 
  7.32  nonaffiliated third party. 
  7.33     Subd. 12.  [FINANCIAL PRODUCT OR SERVICE.] (a) "Financial 
  7.34  product or service" means any product or service that a 
  7.35  financial holding company could offer by engaging in an activity 
  7.36  that is financial in nature or incidental to such a financial 
  8.1   activity under section 4(k) of the Bank Holding Company Act of 
  8.2   1956, United States Code, title 12, section 1843(k). 
  8.3      (b) Financial service includes a financial institution's 
  8.4   evaluation or brokerage of information that the financial 
  8.5   institution collects in connection with a request or an 
  8.6   application from a consumer for a financial product or service. 
  8.7      Subd. 13.  [HEALTH CARE.] "Health care" means: 
  8.8      (1) preventive, diagnostic, therapeutic, rehabilitative, 
  8.9   maintenance or palliative care, services, procedures, tests, or 
  8.10  counseling that: 
  8.11     (i) relates to the physical, mental, or behavioral 
  8.12  condition of an individual; or 
  8.13     (ii) affects the structure or function of the human body or 
  8.14  any part of the human body, including the banking of blood, 
  8.15  sperm, organs, or any other tissue; or 
  8.16     (2) prescribing, dispensing, or furnishing to an individual 
  8.17  drugs or biologicals, or medical devices or health care 
  8.18  equipment and supplies.  
  8.19     Subd. 14.  [HEALTH CARE PROVIDER.] "Health care provider" 
  8.20  means a physician or other health care practitioner licensed, 
  8.21  accredited, or certified to perform specified health services 
  8.22  consistent with state law, or a health care facility. 
  8.23     Subd. 15.  [HEALTH INFORMATION.] "Health information" means 
  8.24  any information or data except age or gender, whether oral or 
  8.25  recorded in any form or medium, created by or derived from a 
  8.26  health care provider or the consumer that relates to: 
  8.27     (1) the past, present, or future physical, mental, or 
  8.28  behavioral health or condition of an individual; 
  8.29     (2) the provision of health care to an individual; or 
  8.30     (3) payment for the provision of health care to an 
  8.31  individual. 
  8.32     Subd. 16.  [INSURANCE PRODUCT OR SERVICE.] (a) "Insurance 
  8.33  product or service" means any product or service that is offered 
  8.34  by a licensee pursuant to the insurance laws of this state. 
  8.35     (b) Insurance service includes a licensee's evaluation, 
  8.36  brokerage, or distribution of information that the licensee 
  9.1   collects in connection with a request or an application from a 
  9.2   consumer for an insurance product or service. 
  9.3      Subd. 17.  [LICENSEE.] (a) "Licensee" means all licensed 
  9.4   insurers, producers, and other persons licensed or required to 
  9.5   be licensed, or authorized or required to be authorized, or 
  9.6   registered or required to be registered, pursuant to the 
  9.7   insurance law of this state, and health maintenance 
  9.8   organizations holding a certificate of authority pursuant to 
  9.9   chapter 62D. 
  9.10     (b) A licensee is not subject to the notice and opt out 
  9.11  requirements for nonpublic personal financial information set 
  9.12  forth in sections 60M.01 to 60M.14 if the licensee is an 
  9.13  employee, agent, or other representative of another licensee who 
  9.14  is the principal licensee, and: 
  9.15     (1) the principal licensee otherwise complies with, and 
  9.16  provides the notices required by, the provisions of this 
  9.17  chapter; and 
  9.18     (2) the licensee does not disclose any nonpublic personal 
  9.19  information to any person other than the principal licensee or 
  9.20  its affiliates in a manner permitted by this chapter. 
  9.21     (c)(1) Subject to paragraph (b), "licensee" also includes 
  9.22  an unauthorized insurer that accepts business placed through a 
  9.23  licensed surplus lines broker in this state, but only in regard 
  9.24  to the surplus lines placements placed pursuant to section 
  9.25  62A.201 of this state's laws. 
  9.26     (2) A surplus lines broker or surplus lines insurer is 
  9.27  considered to be in compliance with the notice and opt out 
  9.28  requirements for nonpublic personal financial information set 
  9.29  forth in sections 60M.01 to 60M.14 provided: 
  9.30     (i) the broker or insurer does not disclose nonpublic 
  9.31  personal information of a consumer or a customer to 
  9.32  nonaffiliated third parties for any purpose, including joint 
  9.33  servicing or marketing under section 60M.12, except as permitted 
  9.34  by section 60M.13 or 60M.14; and 
  9.35     (ii) the broker or insurer delivers a notice to the 
  9.36  consumer at the time a customer relationship is established on 
 10.1   which the following is printed in 16-point type:  
 10.2                           PRIVACY NOTICE
 10.3                   "NEITHER THE U.S. BROKERS THAT
 10.4                   HANDLED THIS INSURANCE NOR THE
 10.5                         INSURERS THAT HAVE
 10.6                    UNDERWRITTEN THIS INSURANCE
 10.7                      WILL DISCLOSE NONPUBLIC
 10.8                        PERSONAL INFORMATION
 10.9                      CONCERNING THE BUYER TO
 10.10                   NONAFFILIATES OF THE BROKERS
 10.11                 OR INSURERS EXCEPT AS PERMITTED
 10.12                             BY LAW."
 10.13     Subd. 18.  [NONAFFILIATED THIRD PARTY.] (a) "Nonaffiliated 
 10.14  third party" means any person except: 
 10.15     (1) a licensee's affiliate; or 
 10.16     (2) a person employed jointly by a licensee and any company 
 10.17  that is not the licensee's affiliate (but nonaffiliated third 
 10.18  party includes the other company that jointly employs the 
 10.19  person). 
 10.20     (b) Nonaffiliated third party includes any company that is 
 10.21  an affiliate solely by virtue of the direct or indirect 
 10.22  ownership or control of the company by the licensee or its 
 10.23  affiliate in conducting merchant banking or investment banking 
 10.24  activities of the type described in section 4(k)(4)(H) or 
 10.25  insurance company investment activities of the type described in 
 10.26  section 4(k)(4)(I) of the federal Bank Holding Company Act, 
 10.27  United States Code, title 12, section 1843(k)(4)(H) and (I). 
 10.28     Subd. 19.  [NONPUBLIC PERSONAL INFORMATION.] "Nonpublic 
 10.29  personal information" means nonpublic personal financial 
 10.30  information and nonpublic personal health information. 
 10.31     Subd. 20.  [NONPUBLIC PERSONAL FINANCIAL INFORMATION.] (a) 
 10.32  "Nonpublic personal financial information" means: 
 10.33     (1) personally identifiable financial information; and 
 10.34     (2) any list, description, or other grouping of consumers, 
 10.35  and publicly available information pertaining to them, that is 
 10.36  derived using any personally identifiable financial information 
 11.1   that is not publicly available. 
 11.2      Nonpublic personal financial information includes any list 
 11.3   of individuals' names and street addresses that is derived in 
 11.4   whole or in part using personally identifiable financial 
 11.5   information that is not publicly available, such as account 
 11.6   numbers. 
 11.7      (b) Nonpublic personal financial information does not 
 11.8   include: 
 11.9      (1) health information; 
 11.10     (2) publicly available information, except as included on a 
 11.11  list described in subdivision 20, paragraph (a), clause (2); or 
 11.12     (3) any list, description, or other grouping or consumers, 
 11.13  and publicly available information pertaining to them, that is 
 11.14  derived without using any personally identifiable financial 
 11.15  information that is not publicly available. 
 11.16     Nonpublic personal financial information does not include 
 11.17  any list of individuals' names and addresses that contains only 
 11.18  publicly available information, is not derived in whole or in 
 11.19  part using personally identifiable financial information that is 
 11.20  not publicly available, and is not disclosed in a manner that 
 11.21  indicates that any of the individuals on the list is a consumer 
 11.22  of a financial institution. 
 11.23     Subd. 21.  [NONPUBLIC PERSONAL HEALTH 
 11.24  INFORMATION.] "Nonpublic personal health information" means 
 11.25  health information: 
 11.26     (1) that identifies an individual who is the subject of the 
 11.27  information; or 
 11.28     (2) with respect to which there is a reasonable basis to 
 11.29  believe that the information could be used to identify an 
 11.30  individual. 
 11.31     Subd. 22.  [PERSONALLY IDENTIFIABLE FINANCIAL 
 11.32  INFORMATION.] (a) "Personally identifiable financial 
 11.33  information" means any information: 
 11.34     (1) a consumer provides to a licensee to obtain an 
 11.35  insurance product or service from the licensee; 
 11.36     (2) about a consumer resulting from a transaction involving 
 12.1   an insurance product or service between a licensee and a 
 12.2   consumer; or 
 12.3      (3) the licensee otherwise obtains about a consumer in 
 12.4   connection with providing an insurance product or service to 
 12.5   that consumer. 
 12.6      (b) Personally identifiable financial information includes: 
 12.7      (1) information a consumer provides to a licensee on an 
 12.8   application to obtain an insurance product or service; 
 12.9      (2) account balance information and payment history; 
 12.10     (3) the fact that an individual is or has been one of the 
 12.11  licensee's customers or has obtained an insurance product or 
 12.12  service from the licensee; 
 12.13     (4) any information about the licensee's consumer if it is 
 12.14  disclosed in a manner that indicates that the individual is or 
 12.15  has been the licensee's consumer; 
 12.16     (5) any information that a consumer provides to a licensee 
 12.17  or that the licensee or its agent otherwise obtains in 
 12.18  connection with collecting on a loan or servicing a loan; 
 12.19     (6) any information the licensee collects through an 
 12.20  Internet cookie (an information-collecting device from a Web 
 12.21  server); and 
 12.22     (7) information from a consumer report. 
 12.23     (c) Personally identifiable financial information does not 
 12.24  include: 
 12.25     (1) health information; 
 12.26     (2) a list of names and addresses of customers of an entity 
 12.27  that is not a financial institution; and 
 12.28     (3) information that does not identify a consumer, such as 
 12.29  aggregate information or blind data that does not contain 
 12.30  personal identifiers such as account numbers, names, or 
 12.31  addresses. 
 12.32     Subd. 23.  [PUBLICLY AVAILABLE INFORMATION.] (a) "Publicly 
 12.33  available information" means any information that a licensee has 
 12.34  a reasonable basis to believe is lawfully made available to the 
 12.35  general public from: 
 12.36     (1) federal, state, or local government records; 
 13.1      (2) widely distributed media; or 
 13.2      (3) disclosures to the general public that are required to 
 13.3   be made by federal, state, or local law. 
 13.4      (b) A licensee has a reasonable basis to believe that 
 13.5   information is lawfully made available to the general public if 
 13.6   the licensee has taken steps to determine: 
 13.7      (1) that the information is of the type that is available 
 13.8   to the general public; and 
 13.9      (2) whether an individual can direct that the information 
 13.10  not be made available to the general public and, if so, that the 
 13.11  licensee's consumer has not done so. 
 13.12     A licensee has a reasonable basis to believe that mortgage 
 13.13  information is lawfully made available to the general public if 
 13.14  the licensee has determined that the information is of the type 
 13.15  included on the public record in the jurisdiction where the 
 13.16  mortgage would be recorded. 
 13.17     A licensee has a reasonable basis to believe that an 
 13.18  individual's telephone number is lawfully made available to the 
 13.19  general public if the licensee has located the telephone number 
 13.20  in the telephone book or the consumer has informed you that the 
 13.21  telephone number is not unlisted. 
 13.22     (c) Publicly available information in government records 
 13.23  includes information in government real estate records and 
 13.24  security interest filings. 
 13.25     (d) Publicly available information from widely distributed 
 13.26  media includes information from a telephone book, a television 
 13.27  or radio program, a newspaper, or a Web site that is available 
 13.28  to the general public on an unrestricted basis.  A Web site is 
 13.29  not restricted merely because an Internet service provider or a 
 13.30  site operator requires a fee or a password, so long as access is 
 13.31  available to the general public. 
 13.32                             ARTICLE 2
 13.33       PRIVACY AND OPT OUT NOTICES FOR FINANCIAL INFORMATION
 13.34     Section 1.  [60M.03] [INITIAL PRIVACY NOTICE TO CONSUMERS 
 13.35  REQUIRED.] 
 13.36     Subdivision 1.  [INITIAL NOTICE REQUIREMENT.] A licensee 
 14.1   shall provide a clear and conspicuous notice that accurately 
 14.2   reflects its privacy policies and practices to: 
 14.3      (1) an individual who becomes the licensee's customer, not 
 14.4   later than when the licensee establishes a customer 
 14.5   relationship, except as provided in subdivision 5; and 
 14.6      (2) a consumer, before the licensee discloses any nonpublic 
 14.7   personal financial information about the consumer to any 
 14.8   nonaffiliated third party, if the licensee makes a disclosure 
 14.9   other than as authorized by sections 60M.13 and 60M.14. 
 14.10     Subd. 2.  [WHEN INITIAL NOTICE TO A CONSUMER IS NOT 
 14.11  REQUIRED.] A licensee is not required to provide an initial 
 14.12  notice to a consumer under subdivision 1, clause (2), if: 
 14.13     (1) the licensee does not disclose any nonpublic personal 
 14.14  financial information about the consumer to any nonaffiliated 
 14.15  third party, other than as authorized by sections 60M.13 and 
 14.16  60M.14, and the licensee does not have a customer relationship 
 14.17  with the consumer; or 
 14.18     (2) a notice has been provided by an affiliated licensee, 
 14.19  as long as the notice clearly identifies all licensees to whom 
 14.20  the notice applies and is accurate with respect to the licensee 
 14.21  and the other institutions. 
 14.22     Subd. 3.  [WHEN LICENSEE ESTABLISHES A CUSTOMER 
 14.23  RELATIONSHIP.] (a) A licensee establishes a customer 
 14.24  relationship at the time the licensee and the consumer enter 
 14.25  into a continuing relationship. 
 14.26     (b) A licensee establishes a customer relationship when the 
 14.27  consumer: 
 14.28     (1) becomes a policyholder of a licensee that is an insurer 
 14.29  when the insurer delivers an insurance policy or contract to the 
 14.30  consumer, or in the case of a licensee that is an insurance 
 14.31  producer or insurance broker, obtains insurance through that 
 14.32  licensee; or 
 14.33     (2) agrees to obtain financial, economic, or investment 
 14.34  advisory services relating to insurance products or services for 
 14.35  a fee from the licensee. 
 14.36     Subd. 4.  [EXISTING CUSTOMERS.] When an existing customer 
 15.1   obtains a new insurance product or service from a licensee that 
 15.2   is to be used primarily for personal, family, or household 
 15.3   purposes, the licensee satisfies the initial notice requirements 
 15.4   of subdivision 1 as follows: 
 15.5      (1) the licensee may provide a revised privacy notice under 
 15.6   section 60M.08 that covers the customer's new insurance product 
 15.7   or service; or 
 15.8      (2) if the initial, revised, or annual notice that the 
 15.9   licensee most recently provided to that customer was accurate 
 15.10  with respect to the new insurance product or service, the 
 15.11  licensee does not need to provide a new privacy notice under 
 15.12  subdivision 1. 
 15.13     Subd. 5.  [EXCEPTIONS TO ALLOW SUBSEQUENT DELIVERY OF 
 15.14  NOTICE.] (a) A licensee may provide the initial notice required 
 15.15  by subdivision 1, clause (1), within a reasonable time after the 
 15.16  licensee establishes a customer relationship if: 
 15.17     (1) establishing the customer relationship is not at the 
 15.18  customer's election; or 
 15.19     (2) providing notice not later than when the licensee 
 15.20  establishes a customer relationship would substantially delay 
 15.21  the customer's transaction and the customer agrees to receive 
 15.22  the notice at a later time. 
 15.23     (b) Establishing a customer relationship is not at the 
 15.24  customer's election if a licensee acquires or is assigned a 
 15.25  customer's policy from another financial institution or residual 
 15.26  market mechanism and the customer does not have a choice about 
 15.27  the licensee's acquisition or assignment. 
 15.28     (c) Providing notice not later than when a licensee 
 15.29  establishes a customer relationship would substantially delay 
 15.30  the customer's transaction when the licensee and the individual 
 15.31  agree over the telephone to enter into a customer relationship 
 15.32  involving prompt delivery of the insurance product or service. 
 15.33     (d) Providing notice not later than when a licensee 
 15.34  establishes a customer relationship would not substantially 
 15.35  delay the customer's transaction when the relationship is 
 15.36  initiated in person at the licensee's office or through other 
 16.1   means by which the customer may view the notice, such as on a 
 16.2   Web site. 
 16.3      Subd. 6.  [DELIVERY.] When a licensee is required to 
 16.4   deliver an initial privacy notice by this section, the licensee 
 16.5   shall deliver it according to section 60M.12.  If the licensee 
 16.6   uses a short-form initial notice for noncustomers according to 
 16.7   section 60M.05, subdivision 4, the licensee may deliver its 
 16.8   privacy notice according to section 60M.05, subdivision 4, 
 16.9   paragraph (c). 
 16.10     Sec. 2.  [60M.04] [ANNUAL PRIVACY NOTICE TO CUSTOMERS 
 16.11  REQUIRED.] 
 16.12     Subdivision 1.  [GENERAL RULE.] A licensee shall provide a 
 16.13  clear and conspicuous notice to customers that accurately 
 16.14  reflects its privacy policies and practices not less than 
 16.15  annually during the continuation of the customer relationship.  
 16.16  Annually means at least once in any period of 12 consecutive 
 16.17  months during which that relationship exists.  A licensee may 
 16.18  define the 12-consecutive-month period, but the licensee shall 
 16.19  apply it to the customer on a consistent basis. 
 16.20     A licensee provides a notice annually if it defines the 
 16.21  12-consecutive-month period as a calendar year and provides the 
 16.22  annual notice to the customer once in each calendar year 
 16.23  following the calendar year in which the licensee provided the 
 16.24  initial notice.  For example, if a customer opens an account on 
 16.25  any day of year one, the licensee shall provide an annual notice 
 16.26  to that customer by December 31 of year two. 
 16.27     Subd. 2.  [TERMINATION OF CUSTOMER RELATIONSHIP.] (a) A 
 16.28  licensee is not required to provide an annual notice to a former 
 16.29  customer.  A former customer is an individual with whom a 
 16.30  licensee no longer has a continuing relationship. 
 16.31     (b) A licensee no longer has a continuing relationship with 
 16.32  an individual if the individual no longer is a current 
 16.33  policyholder of an insurance product or no longer obtains 
 16.34  insurance services with or through the licensee. 
 16.35     (c) A licensee no longer has a continuing relationship with 
 16.36  an individual if the individual's policy is lapsed, expired, or 
 17.1   otherwise inactive or dormant under the licensee's business 
 17.2   practices, and the licensee has not communicated with the 
 17.3   customer about the relationship for a period of 12 consecutive 
 17.4   months, other than to provide annual privacy notices, material 
 17.5   required by law or regulation, or promotional materials. 
 17.6      (d) For the purposes of this chapter, a licensee no longer 
 17.7   has a continuing relationship with an individual if the 
 17.8   individual's last known address according to the licensee's 
 17.9   records is deemed invalid.  An address of record is deemed 
 17.10  invalid if mail sent to that address by the licensee has been 
 17.11  returned by the postal authorities as undeliverable and if 
 17.12  subsequent attempts by the licensee to obtain a current valid 
 17.13  address for the individual have been unsuccessful. 
 17.14     (e) A licensee no longer has a continuing relationship with 
 17.15  a customer in the case of providing real estate settlement 
 17.16  services, at the time the customer completes execution of all 
 17.17  documents related to the real estate closing, payment for those 
 17.18  services has been received, or the licensee has completed all of 
 17.19  its responsibilities with respect to the settlement, including 
 17.20  filing documents on the public record, whichever is later. 
 17.21     Subd. 3.  [DELIVERY.] When a licensee is required by this 
 17.22  section to deliver an annual privacy notice, the licensee shall 
 17.23  deliver it according to section 60M.08. 
 17.24     Sec. 3.  [60M.05] [INFORMATION TO BE INCLUDED IN PRIVACY 
 17.25  NOTICES.] 
 17.26     Subdivision 1.  [GENERAL RULE.] The initial, annual, and 
 17.27  revised privacy notices that a licensee provides under sections 
 17.28  60M.03, 60M.04, and 60M.07 must include each of the following 
 17.29  items of information, in addition to any other information the 
 17.30  licensee wishes to provide, that applies to the licensee and to 
 17.31  the consumers to whom the licensee sends its privacy notice: 
 17.32     (1) the categories of nonpublic personal financial 
 17.33  information that the licensee collects; 
 17.34     (2) the categories of nonpublic personal financial 
 17.35  information that the licensee discloses; 
 17.36     (3) the categories of affiliates and nonaffiliated third 
 18.1   parties to whom the licensee discloses nonpublic personal 
 18.2   financial information, other than those parties to whom the 
 18.3   licensee discloses information under sections 60M.13 and 60M.14; 
 18.4      (4) the categories of nonpublic personal financial 
 18.5   information about the licensee's former customers that the 
 18.6   licensee discloses and the categories of affiliates and 
 18.7   nonaffiliated third parties to whom the licensee discloses 
 18.8   nonpublic personal financial information about the licensee's 
 18.9   former customers, other than those parties to whom the licensee 
 18.10  discloses information under sections 60M.13 and 60M.14; 
 18.11     (5) if a licensee discloses nonpublic personal financial 
 18.12  information to a nonaffiliated third party under section 60M.12 
 18.13  (and no other exception in sections 60M.13 and 60M.14, applies 
 18.14  to that disclosure), a separate description of the categories of 
 18.15  information the licensee discloses and the categories of third 
 18.16  parties with whom the licensee has contracted; 
 18.17     (6) an explanation of the consumer's right under section 
 18.18  60M.09, subdivision 1, to opt out of the disclosure of nonpublic 
 18.19  personal financial information to nonaffiliated third parties, 
 18.20  including the methods by which the consumer may exercise that 
 18.21  right at that time; 
 18.22     (7) any disclosures that the licensee makes under section 
 18.23  603(d)(2)(A)(iii) of the federal Fair Credit Reporting Act, 
 18.24  United States Code, title 15, section 1681a(d)(2)(A)(iii), that 
 18.25  is, notices regarding the ability to opt out of disclosures of 
 18.26  information among affiliates; 
 18.27     (8) the licensee's policies and practices with respect to 
 18.28  protecting the confidentiality and security of nonpublic 
 18.29  personal financial information; and 
 18.30     (9) any disclosure that the licensee makes under 
 18.31  subdivision 2. 
 18.32     Subd. 2.  [DESCRIPTION OF PARTIES SUBJECT TO 
 18.33  EXCEPTIONS.] If a licensee discloses nonpublic personal 
 18.34  financial information as authorized under sections 60M.13 and 
 18.35  60M.14, the licensee is not required to list those exceptions in 
 18.36  the initial or annual privacy notices required by sections 
 19.1   60M.03 and 60M.04.  When describing the categories of parties to 
 19.2   whom disclosure is made, the licensee is required to state only 
 19.3   that it makes disclosures to other affiliated or nonaffiliated 
 19.4   third parties, as applicable, as permitted by law. 
 19.5      Subd. 3.  [EXAMPLES.] (a) A licensee satisfies the 
 19.6   requirement to categorize the nonpublic personal financial 
 19.7   information it collects if the licensee categorizes it according 
 19.8   to the source of the information, as applicable: 
 19.9      (1) information from the consumer; 
 19.10     (2) information about the consumer's transactions with the 
 19.11  licensee or its affiliates; 
 19.12     (3) information about the consumer's transactions with 
 19.13  nonaffiliated third parties; and 
 19.14     (4) information from a consumer reporting agency. 
 19.15     (b)(1) A licensee satisfies the requirement to categorize 
 19.16  nonpublic personal financial information it discloses if the 
 19.17  licensee categorizes the information according to source, as 
 19.18  described in paragraph (a), as applicable, and provides a few 
 19.19  examples to illustrate the types of information in each 
 19.20  category.  These might include: 
 19.21     (i) information from the consumer, including application 
 19.22  information, such as assets and income and identifying 
 19.23  information, such as name, address, and social security number; 
 19.24     (ii) transaction information, such as information about 
 19.25  balances, payment history, and parties to the transaction; and 
 19.26     (iii) information from consumer reports, such as a 
 19.27  consumer's creditworthiness and credit history. 
 19.28     (2) A licensee does not adequately categorize the 
 19.29  information that it discloses if the licensee uses only general 
 19.30  terms, such as transaction information about the consumer. 
 19.31     (3) If a licensee reserves the right to disclose all of the 
 19.32  nonpublic personal financial information about consumers that it 
 19.33  collects, the licensee may simply state that fact without 
 19.34  describing the categories or examples of nonpublic personal 
 19.35  information that the licensee discloses. 
 19.36     (c)(1) A licensee satisfies the requirement to categorize 
 20.1   the affiliates and nonaffiliated third parties to which the 
 20.2   licensee discloses nonpublic personal financial information 
 20.3   about consumers if the licensee identifies the types of 
 20.4   businesses in which they engage. 
 20.5      (2) Types of businesses may be described by general terms 
 20.6   only if the licensee uses a few illustrative examples of 
 20.7   significant lines of business.  For example, a licensee may use 
 20.8   the term financial products or services if it includes 
 20.9   appropriate examples of significant lines of businesses, such as 
 20.10  life insurer, automobile insurer, consumer banking, or 
 20.11  securities brokerage. 
 20.12     (3) A licensee also may categorize the affiliates and 
 20.13  nonaffiliated third parties to which it discloses nonpublic 
 20.14  personal financial information about consumers using more 
 20.15  detailed categories. 
 20.16     (d) If a licensee discloses nonpublic personal financial 
 20.17  information under the exception in section 60M.12 to a 
 20.18  nonaffiliated third party to market products or services that it 
 20.19  offers alone or jointly with another financial institution, the 
 20.20  licensee satisfies the disclosure requirement of subdivision 1, 
 20.21  clause (5), if it: 
 20.22     (1) lists the categories of nonpublic personal financial 
 20.23  information it discloses, using the same categories and examples 
 20.24  the licensee used to meet the requirements of subdivision 1, 
 20.25  clause (2), as applicable; and 
 20.26     (2) states whether the third party is: 
 20.27     (i) a service provider that performs marketing services on 
 20.28  the licensee's behalf or on behalf of the licensee and another 
 20.29  financial institution; or 
 20.30     (ii) a financial institution with whom the licensee has a 
 20.31  joint marketing agreement. 
 20.32     (e) If a licensee does not disclose, and does not wish to 
 20.33  reserve the right to disclose, nonpublic personal financial 
 20.34  information about customers or former customers to affiliates or 
 20.35  nonaffiliated third parties except as authorized under sections 
 20.36  60M.13 and 60M.14, the licensee may simply state that fact, in 
 21.1   addition to the information it shall provide under subdivision 
 21.2   1, clauses (1), (8), and (9), and subdivision 2. 
 21.3      (f) A licensee describes its policies and practices with 
 21.4   respect to protecting the confidentiality and security of 
 21.5   nonpublic personal financial information if it does both of the 
 21.6   following: 
 21.7      (1) describes in general terms who is authorized to have 
 21.8   access to the information; and 
 21.9      (2) states whether the licensee has security practices and 
 21.10  procedures in place to ensure the confidentiality of the 
 21.11  information in accordance with the licensee's policy.  The 
 21.12  licensee is not required to describe technical information about 
 21.13  the safeguards it uses. 
 21.14     Subd. 4.  [SHORT-FORM INITIAL NOTICE WITH OPT OUT NOTICE 
 21.15  FOR NONCUSTOMERS.] (a) A licensee may satisfy the initial notice 
 21.16  requirements in sections 60M.03, subdivision 1, clause (2), and 
 21.17  60M.06, subdivision 3, for a consumer who is not a customer by 
 21.18  providing a short-form initial notice at the same time as the 
 21.19  licensee delivers an opt out notice as required in section 
 21.20  60M.03. 
 21.21     (b) A short-form initial notice must: 
 21.22     (1) be clear and conspicuous; 
 21.23     (2) state that the licensee's privacy notice is available 
 21.24  upon request; and 
 21.25     (3) explain a reasonable means by which the consumer may 
 21.26  obtain that notice. 
 21.27     (c) The licensee shall deliver its short-form initial 
 21.28  notice according to section 60M.08.  The licensee is not 
 21.29  required to deliver its privacy notice with its short-form 
 21.30  initial notice.  The licensee instead may simply provide the 
 21.31  consumer a reasonable means to obtain its privacy notice.  If a 
 21.32  consumer who receives the licensee's short-form notice requests 
 21.33  the licensee's privacy notice, the licensee shall deliver its 
 21.34  privacy notice according to section 60M.08. 
 21.35     (d) The licensee provides a reasonable means by which a 
 21.36  consumer may obtain a copy of its privacy notice if the licensee:
 22.1      (1) provides a toll-free telephone number that the consumer 
 22.2   may call to request the notice; or 
 22.3      (2) for a consumer who conducts business in person at the 
 22.4   licensee's office, maintains copies of the notice on hand that 
 22.5   the licensee provides to the consumer immediately upon request. 
 22.6      Subd. 5.  [FUTURE DISCLOSURES.] The licensee's notice may 
 22.7   include: 
 22.8      (1) categories of nonpublic personal financial information 
 22.9   that the licensee reserves the right to disclose in the future, 
 22.10  but does not currently disclose; and 
 22.11     (2) categories of affiliates or nonaffiliated third parties 
 22.12  to whom the licensee reserves the right in the future to 
 22.13  disclose, but to whom the licensee does not currently disclose, 
 22.14  nonpublic personal financial information. 
 22.15     Sec. 4.  [60M.06] [FORM OF OPT OUT NOTICE TO CONSUMERS AND 
 22.16  OPT OUT METHODS.] 
 22.17     Subdivision 1.  [FORM OF OPT OUT NOTICE.] (a) If a licensee 
 22.18  is required to provide an opt out notice under section 60M.09, 
 22.19  subdivision 1, it shall provide a clear and conspicuous notice 
 22.20  to each of its consumers that accurately explains the right to 
 22.21  opt out under that section.  The notice must state: 
 22.22     (1) that the licensee discloses or reserves the right to 
 22.23  disclose nonpublic personal financial information about its 
 22.24  consumer to a nonaffiliated third party; 
 22.25     (2) that the consumer has the right to opt out of that 
 22.26  disclosure; and 
 22.27     (3) a reasonable means by which the consumer may exercise 
 22.28  the opt out right. 
 22.29     (b)(1) A licensee provides adequate notice that the 
 22.30  consumer can opt out of the disclosure of nonpublic personal 
 22.31  financial information to a nonaffiliated third party if the 
 22.32  licensee: 
 22.33     (i) identifies all of the categories of nonpublic personal 
 22.34  financial information that it discloses or reserves the right to 
 22.35  disclose, and all of the categories of nonaffiliated third 
 22.36  parties to which the licensee discloses the information, as 
 23.1   described in section 60M.05, subdivision 1, clauses (2) and (3), 
 23.2   and states that the consumer can opt out of the disclosure of 
 23.3   that information; and 
 23.4      (ii) identifies the insurance products or services that the 
 23.5   consumer obtains from the licensee, either singly or jointly, to 
 23.6   which the opt out direction would apply. 
 23.7      (2) A licensee provides a reasonable means to exercise an 
 23.8   opt out right if it: 
 23.9      (i) designates checkoff boxes in a prominent position on 
 23.10  the relevant forms with the opt out notice; 
 23.11     (ii) includes a reply form together with the opt out 
 23.12  notice; 
 23.13     (iii) provides an electronic means to opt out, such as a 
 23.14  form that can be sent via electronic mail or a process at the 
 23.15  licensee's Web site, if the consumer agrees to the electronic 
 23.16  delivery of information; or 
 23.17     (iv) provides a toll-free telephone number that consumers 
 23.18  may call to opt out. 
 23.19     (3) A licensee does not provide a reasonable means of 
 23.20  opting out if: 
 23.21     (i) the only means of opting out is for the consumer to 
 23.22  write the consumer's own letter to exercise that opt out right; 
 23.23  or 
 23.24     (ii) the only means of opting out as described in any 
 23.25  notice subsequent to the initial notice is to use a checkoff box 
 23.26  that the licensee provided with the initial notice but did not 
 23.27  include with the subsequent notice. 
 23.28     (4) A licensee may require each consumer to opt out through 
 23.29  a specific means, as long as that means is reasonable for that 
 23.30  consumer. 
 23.31     Subd. 2.  [SAME FORM AS INITIAL NOTICE PERMITTED.] A 
 23.32  licensee may provide the opt out notice together with or on the 
 23.33  same written or electronic form as the initial notice the 
 23.34  licensee provides in accordance with section 60M.03. 
 23.35     Subd. 3.  [INITIAL NOTICE REQUIRED WHEN OPT OUT NOTICE 
 23.36  DELIVERED SUBSEQUENT TO INITIAL NOTICE.] If a licensee provides 
 24.1   the opt out notice later than required for the initial notice in 
 24.2   accordance with section 60M.03, the licensee shall also include 
 24.3   a copy of the initial notice with the opt out notice in writing 
 24.4   or, if the consumer agrees, electronically. 
 24.5      Subd. 4.  [JOINT RELATIONSHIPS.] (a) If two or more 
 24.6   consumers jointly obtain an insurance product or service from a 
 24.7   licensee, the licensee may provide a single opt out notice.  The 
 24.8   licensee's opt out notice must explain how the licensee will 
 24.9   treat an opt out direction by a joint consumer. 
 24.10     (b) Any of the joint consumers may exercise the right to 
 24.11  opt out.  The licensee may either: 
 24.12     (1) treat an opt out direction by a joint consumer as 
 24.13  applying to all of the associated joint consumers; or 
 24.14     (2) permit each joint consumer to opt out separately. 
 24.15     (c) If a licensee permits each joint consumer to opt out 
 24.16  separately, the licensee shall permit one of the joint consumers 
 24.17  to opt out on behalf of all of the joint consumers. 
 24.18     (d) A licensee may not require all joint consumers to opt 
 24.19  out before it implements any opt out direction. 
 24.20     (e) Example.  If John and Mary are both named policyholders 
 24.21  on a homeowner's insurance policy issued by a licensee and the 
 24.22  licensee sends policy statements to John's address, the licensee 
 24.23  may do any of the following, but it shall explain in its opt out 
 24.24  notice which opt out policy the licensee will follow: 
 24.25     (1) send a single opt out notice to John's address, but the 
 24.26  licensee shall accept an opt out direction from either John or 
 24.27  Mary; 
 24.28     (2) treat an opt out direction by either John or Mary as 
 24.29  applying to the entire policy.  If the licensee does so and John 
 24.30  opts out, the licensee may not require Mary to opt out as well 
 24.31  before implementing John's opt out direction; 
 24.32     (3) permit John and Mary to make different opt out 
 24.33  directions.  If the licensee does so: 
 24.34     (i) it shall permit John and Mary to opt out for each 
 24.35  other; 
 24.36     (ii) if both opt out, the licensee shall permit both of 
 25.1   them to notify it in a single response (such as on a form or 
 25.2   through a telephone call); and 
 25.3      (iii) if John opts out and Mary does not, the licensee may 
 25.4   only disclose nonpublic personal financial information about 
 25.5   Mary, but not about John and not about John and Mary jointly. 
 25.6      Subd. 5.  [TIME TO COMPLY WITH OPT OUT.] A licensee shall 
 25.7   comply with a consumer's opt out direction as soon as reasonably 
 25.8   practicable after the licensee receives it. 
 25.9      Subd. 6.  [CONTINUING RIGHT TO OPT OUT.] A consumer may 
 25.10  exercise the right to opt out at any time. 
 25.11     Subd. 7.  [DURATION OF CONSUMER'S OPT OUT DIRECTION.] (a) A 
 25.12  consumer's direction to opt out under this section is effective 
 25.13  until the consumer revokes it in writing or, if the consumer 
 25.14  agrees, electronically. 
 25.15     (b) When a customer relationship terminates, the customer's 
 25.16  opt out direction continues to apply to the nonpublic personal 
 25.17  financial information that the licensee collected during or 
 25.18  related to that relationship.  If the individual subsequently 
 25.19  establishes a new customer relationship with the licensee, the 
 25.20  opt out direction that applied to the former relationship does 
 25.21  not apply to the new relationship. 
 25.22     Subd. 8.  [DELIVERY.] When a licensee is required to 
 25.23  deliver an opt out notice by this section, the licensee shall 
 25.24  deliver it according to section 60M.08. 
 25.25     Sec. 5.  [60M.07] [REVISED PRIVACY NOTICES.] 
 25.26     Subdivision 1.  [GENERAL RULE.] Except as otherwise 
 25.27  authorized in this chapter, a licensee shall not, directly or 
 25.28  through an affiliate, disclose any nonpublic personal financial 
 25.29  information about a consumer to a nonaffiliated third party 
 25.30  other than as described in the initial notice that the licensee 
 25.31  provided to that consumer under section 60M.03, unless: 
 25.32     (1) the licensee has provided to the consumer a clear and 
 25.33  conspicuous revised notice that accurately describes its 
 25.34  policies and practices; 
 25.35     (2) the licensee has provided to the consumer a new opt out 
 25.36  notice; 
 26.1      (3) the licensee has given the consumer a reasonable 
 26.2   opportunity, before the licensee discloses the information to 
 26.3   the nonaffiliated third party, to opt out of the disclosure; and 
 26.4      (4) the consumer does not opt out. 
 26.5      Subd. 2.  [EXAMPLES.] (a) Except as otherwise permitted by 
 26.6   sections 60M.12, 60M.13, and 60M.14, a licensee shall provide a 
 26.7   revised notice before it discloses: 
 26.8      (1) a new category of nonpublic personal financial 
 26.9   information to any nonaffiliated third party; 
 26.10     (2) nonpublic personal financial information to a new 
 26.11  category of nonaffiliated third party; or 
 26.12     (3) nonpublic personal financial information about a former 
 26.13  customer to a nonaffiliated third party, if that former customer 
 26.14  has not had the opportunity to exercise an opt out right 
 26.15  regarding that disclosure. 
 26.16     (b) A revised notice is not required if the licensee 
 26.17  discloses nonpublic personal financial information to a new 
 26.18  nonaffiliated third party that the licensee adequately described 
 26.19  in its prior notice. 
 26.20     Subd. 3.  [DELIVERY.] When a licensee is required to 
 26.21  deliver a revised privacy notice by this section, the licensee 
 26.22  shall deliver it according to section 60M.08. 
 26.23     Sec. 6.  [60M.08] [DELIVERY.] 
 26.24     Subdivision 1.  [HOW TO PROVIDE NOTICES.] A licensee shall 
 26.25  provide any notices that this chapter requires so that each 
 26.26  consumer can reasonably be expected to receive actual notice in 
 26.27  writing or, if the consumer agrees, electronically. 
 26.28     Subd. 2.  [EXAMPLES OF REASONABLE EXPECTATION OF ACTUAL 
 26.29  NOTICE.] (a) A licensee may reasonably expect that a consumer 
 26.30  will receive actual notice if the licensee: 
 26.31     (1) hand-delivers a printed copy of the notice to the 
 26.32  consumer; 
 26.33     (2) mails a printed copy of the notice to the last known 
 26.34  address of the consumer separately, or in a policy, billing, or 
 26.35  other written communication; 
 26.36     (3) for a consumer who conducts transactions 
 27.1   electronically, posts the notice on the electronic site and 
 27.2   requires the consumer to acknowledge receipt of the notice as a 
 27.3   necessary step to obtaining a particular insurance product or 
 27.4   service; and 
 27.5      (4) for an isolated transaction with a consumer, such as 
 27.6   the licensee providing an insurance quote or selling the 
 27.7   consumer travel insurance, posts the notice and requires the 
 27.8   consumer to acknowledge receipt of the notice as a necessary 
 27.9   step to obtaining the particular insurance product or service. 
 27.10     (b) A licensee may not, however, reasonably expect that a 
 27.11  consumer will receive actual notice of its privacy policies and 
 27.12  practices if it: 
 27.13     (1) only posts a sign in its office or generally publishes 
 27.14  advertisements of its privacy policies and practices; or 
 27.15     (2) sends the notice via electronic mail to a consumer who 
 27.16  does not obtain an insurance product or service from the 
 27.17  licensee electronically. 
 27.18     Subd. 3.  [ANNUAL NOTICES ONLY.] A licensee may reasonably 
 27.19  expect that a customer will receive actual notice of the 
 27.20  licensee's annual privacy notice if: 
 27.21     (1) the customer uses the licensee's Web site to access 
 27.22  insurance products and services electronically and agrees to 
 27.23  receive notices at the Web site and the licensee posts its 
 27.24  current privacy notice continuously in a clear and conspicuous 
 27.25  manner on the Web site; or 
 27.26     (2) the customer has requested that the licensee refrain 
 27.27  from sending any information regarding the customer 
 27.28  relationship, and the licensee's current privacy notice remains 
 27.29  available to the customer upon request. 
 27.30     Subd. 4.  [ORAL DESCRIPTION OF NOTICE INSUFFICIENT.] A 
 27.31  licensee may not provide any notice required by this regulation 
 27.32  solely by orally explaining the notice, either in person or over 
 27.33  the telephone. 
 27.34     Subd. 5.  [RETENTION OR ACCESSIBILITY OF NOTICES FOR 
 27.35  CUSTOMERS.] (a) For customers only, a licensee shall provide the 
 27.36  initial notice required by section 60M.03, subdivision 1, clause 
 28.1   (1), the annual notice required by section 60M.04, subdivision 
 28.2   1, and the revised notice required by section 60M.07, so that 
 28.3   the customer can retain them or obtain them later in writing or, 
 28.4   if the customer agrees, electronically. 
 28.5      (b) A licensee provides a privacy notice to the customer so 
 28.6   that the customer can retain it or obtain it later if the 
 28.7   licensee: 
 28.8      (1) hand-delivers a printed copy of the notice to the 
 28.9   customer; 
 28.10     (2) mails a printed copy of the notice to the last known 
 28.11  address of the customer; or 
 28.12     (3) makes its current privacy notice available on a Web 
 28.13  site, or a link to another Web site, for the customer who 
 28.14  obtains an insurance product or service electronically and 
 28.15  agrees to receive the notice at the Web site. 
 28.16     Subd. 6.  [JOINT NOTICE WITH OTHER FINANCIAL INSTITUTIONS.] 
 28.17  A licensee may provide a joint notice from the licensee and one 
 28.18  or more of its affiliates or other financial institutions, as 
 28.19  identified in the notice, as long as the notice is accurate with 
 28.20  respect to the licensee and the other institutions.  A licensee 
 28.21  also may provide a notice on behalf of another financial 
 28.22  institution. 
 28.23     Subd. 7.  [JOINT RELATIONSHIPS.] If two or more consumers 
 28.24  jointly obtain an insurance product or service from a licensee, 
 28.25  the licensee may satisfy the initial, annual, and revised notice 
 28.26  requirements of sections 60M.03, subdivision 1; 60M.04, 
 28.27  subdivision 1; and 60M.07, subdivision 1, respectively, by 
 28.28  providing one notice to those consumers jointly. 
 28.29                             ARTICLE 3
 28.30           LIMITS ON DISCLOSURES OF FINANCIAL INFORMATION
 28.31     Section 1.  [60M.09] [LIMITS ON DISCLOSURE OF NONPUBLIC 
 28.32  PERSONAL FINANCIAL INFORMATION TO NONAFFILIATED THIRD PARTIES.] 
 28.33     Subdivision 1.  [CONDITIONS FOR DISCLOSURE.] (a) Except as 
 28.34  otherwise authorized in this chapter, a licensee may not, 
 28.35  directly or through any affiliate, disclose any nonpublic 
 28.36  personal financial information about a consumer to a 
 29.1   nonaffiliated third party unless: 
 29.2      (1) the licensee has provided to the consumer an initial 
 29.3   notice as required under section 60M.03; 
 29.4      (2) the licensee has provided to the consumer an opt out 
 29.5   notice as required in section 60M.06; 
 29.6      (3) the licensee has given the consumer a reasonable 
 29.7   opportunity, before it discloses the information to the 
 29.8   nonaffiliated third party, to opt out of the disclosure; and 
 29.9      (4) the consumer does not opt out. 
 29.10     (b) For purpose of this section, "opt out" means a 
 29.11  direction by the consumer that the licensee not disclose 
 29.12  nonpublic personal financial information about that consumer to 
 29.13  a nonaffiliated third party, other than as permitted by sections 
 29.14  60M.12, 60M.13, and 60M.14. 
 29.15     (c) A licensee provides a consumer with a reasonable 
 29.16  opportunity to opt out if: 
 29.17     (1) the licensee mails the notices required in paragraph (a)
 29.18  to the consumer and allows the consumer to opt out by mailing a 
 29.19  form, calling a toll-free telephone number, or any other 
 29.20  reasonable means within 30 days from the date the licensee 
 29.21  mailed the notices; 
 29.22     (2) a customer opens an on-line account with a licensee and 
 29.23  agrees to receive the notices required in paragraph (a) 
 29.24  electronically, and the licensee allows the customer to opt out 
 29.25  by any reasonable means within 30 days after the date that the 
 29.26  customer acknowledges receipt of the notices in conjunction with 
 29.27  opening the account; or 
 29.28     (3) for an isolated transaction such as providing the 
 29.29  consumer with an insurance quote, a licensee provides the 
 29.30  consumer with a reasonable opportunity to opt out if the 
 29.31  licensee provides the notices required in paragraph (a) at the 
 29.32  time of the transaction and requests that the consumer decide, 
 29.33  as a necessary part of the transaction, whether to opt out 
 29.34  before completing the transaction. 
 29.35     Subd. 2.  [APPLICATION OF OPT OUT TO ALL CONSUMERS AND ALL 
 29.36  NONPUBLIC PERSONAL FINANCIAL INFORMATION.] (a) A licensee shall 
 30.1   comply with this section, regardless of whether the licensee and 
 30.2   the consumer have established a customer relationship. 
 30.3      (b) Unless a licensee complies with this section, the 
 30.4   licensee may not, directly or through any affiliate, disclose 
 30.5   any nonpublic personal financial information about a consumer 
 30.6   that the licensee has collected, regardless of whether the 
 30.7   licensee collected it before or after receiving the direction to 
 30.8   opt out from the consumer. 
 30.9      Subd. 3.  [PARTIAL OPT OUT.] A licensee may allow a 
 30.10  consumer to select certain nonpublic personal financial 
 30.11  information or certain nonaffiliated third parties with respect 
 30.12  to which the consumer wishes to opt out. 
 30.13     Sec. 2.  [60M.10] [LIMITS ON REDISCLOSURE AND REUSE OF 
 30.14  NONPUBLIC PERSONAL FINANCIAL INFORMATION.] 
 30.15     Subdivision 1.  [INFORMATION THE LICENSEE RECEIVES UNDER AN 
 30.16  EXCEPTION.] (a) If a licensee receives nonpublic personal 
 30.17  financial information from a nonaffiliated financial institution 
 30.18  under an exception in section 60M.13 or 60M.14, the licensee's 
 30.19  disclosure and use of that information is limited as follows: 
 30.20     (1) the licensee may disclose the information to the 
 30.21  affiliates of the financial institution from which the licensee 
 30.22  received the information; 
 30.23     (2) the licensee may disclose the information to its 
 30.24  affiliates, but the licensee's affiliates may, in turn, disclose 
 30.25  and use the information only to the extent that the licensee may 
 30.26  disclose and use the information; and 
 30.27     (3) the licensee may disclose and use the information 
 30.28  pursuant to an exception in section 60M.13 or 60M.14, in the 
 30.29  ordinary course of business to carry out the activity covered by 
 30.30  the exception under which the licensee received the information. 
 30.31     (b) If a licensee receives information from a nonaffiliated 
 30.32  financial institution for claims settlement purposes, the 
 30.33  licensee may disclose the information for fraud prevention, or 
 30.34  in response to a properly authorized subpoena.  The licensee may 
 30.35  not disclose that information to a third party for marketing 
 30.36  purposes or use that information for its own marketing purposes. 
 31.1      Subd. 2.  [INFORMATION A LICENSEE RECEIVES OUTSIDE OF AN 
 31.2   EXCEPTION.] (a) If a licensee receives nonpublic personal 
 31.3   financial information from a nonaffiliated financial institution 
 31.4   other than under an exception in section 60M.13 or 60M.14, the 
 31.5   licensee may disclose the information only: 
 31.6      (1) to the affiliates of the financial institution from 
 31.7   which the licensee received the information; 
 31.8      (2) to its affiliates, but its affiliates may, in turn, 
 31.9   disclose the information only to the extent that the licensee 
 31.10  may disclose the information; and 
 31.11     (3) to any other person, if the disclosure would be lawful 
 31.12  if made directly to that person by the financial institution 
 31.13  from which the licensee received the information. 
 31.14     (b) If a licensee obtains a customer list from a 
 31.15  nonaffiliated financial institution outside of the exceptions in 
 31.16  section 60M.13 or 60M.14: 
 31.17     (1) the licensee may use that list for its own purposes; 
 31.18  and 
 31.19     (2) the licensee may disclose that list to another 
 31.20  nonaffiliated third party only if the financial institution from 
 31.21  which the licensee purchased the list could have lawfully 
 31.22  disclosed the list to that third party.  That is, the licensee 
 31.23  may disclose the list in accordance with the privacy policy of 
 31.24  the financial institution from which the licensee received the 
 31.25  list, as limited by the opt out direction of each consumer whose 
 31.26  nonpublic personal financial information the licensee intends to 
 31.27  disclose, and the licensee may disclose the list in accordance 
 31.28  with an exception in section 60M.13 or 60M.14, such as to the 
 31.29  licensee's attorneys or accountants. 
 31.30     Subd. 3.  [INFORMATION A LICENSEE DISCLOSES UNDER AN 
 31.31  EXCEPTION.] If a licensee discloses nonpublic personal financial 
 31.32  information to a nonaffiliated third party under an exception in 
 31.33  section 60M.13 or 60M.14, the third party may disclose and use 
 31.34  that information only as follows: 
 31.35     (1) the third party may disclose the information to the 
 31.36  licensee's affiliates; 
 32.1      (2) the third party may disclose the information to its 
 32.2   affiliates, but its affiliates may, in turn, disclose and use 
 32.3   the information only to the extent that the third party may 
 32.4   disclose and use the information; and 
 32.5      (3) the third party may disclose and use the information 
 32.6   pursuant to an exception in section 60M.13 or 60M.14, in the 
 32.7   ordinary course of business to carry out the activity covered by 
 32.8   the exception under which it received the information. 
 32.9      Subd. 4.  [INFORMATION A LICENSEE DISCLOSES OUTSIDE OF AN 
 32.10  EXCEPTION.] If a licensee discloses nonpublic personal financial 
 32.11  information to a nonaffiliated third party other than under an 
 32.12  exception in section 60M.13 or 60M.14, the third party may 
 32.13  disclose the information only: 
 32.14     (1) to the licensee's affiliates; 
 32.15     (2) to the third party's affiliates, but the third party's 
 32.16  affiliates, in turn, may disclose the information only to the 
 32.17  extent the third party can disclose the information; and 
 32.18     (3) to any other person, if the disclosure would be lawful 
 32.19  if the licensee made it directly to that person. 
 32.20     Sec. 3.  [60M.11] [LIMITS ON SHARING ACCOUNT NUMBER 
 32.21  INFORMATION FOR MARKETING PURPOSES.] 
 32.22     Subdivision 1.  [GENERAL PROHIBITION ON DISCLOSURE OF 
 32.23  ACCOUNT NUMBERS.] A licensee shall not, directly or through an 
 32.24  affiliate, disclose, other than to a consumer reporting agency, 
 32.25  a policy number or similar form of access number or access code 
 32.26  for a consumer's policy or transaction account to any 
 32.27  nonaffiliated third party for use in telemarketing, direct mail 
 32.28  marketing, or other marketing through electronic mail to the 
 32.29  consumer. 
 32.30     Subd. 2.  [EXCEPTIONS.] Subdivision 1 does not apply if a 
 32.31  licensee discloses a policy number or similar form of access 
 32.32  number or access code: 
 32.33     (1) to the licensee's service provider solely in order to 
 32.34  perform marketing for the licensee's own products or services, 
 32.35  as long as the service provider is not authorized to directly 
 32.36  initiate charges to the account; 
 33.1      (2) to a licensee who is a producer solely in order to 
 33.2   perform marketing for the licensee's own products or services; 
 33.3   or 
 33.4      (3) to a participant in an affinity or similar program 
 33.5   where the participants in the program are identified to the 
 33.6   customer when the customer enters into the program. 
 33.7      Subd. 3.  [EXAMPLES.] (a) A policy number, or similar form 
 33.8   of access number or access code, does not include a number or 
 33.9   code in an encrypted form, as long as the licensee does not 
 33.10  provide the recipient with a means to decode the number or code. 
 33.11     (b) For the purposes of this section, a policy or 
 33.12  transaction account is an account other than a deposit account 
 33.13  or a credit card account.  A policy or transaction account does 
 33.14  not include an account to which third parties cannot initiate 
 33.15  charges. 
 33.16                             ARTICLE 4
 33.17               EXCEPTIONS TO LIMITS ON DISCLOSURES OF
 33.18                       FINANCIAL INFORMATION
 33.19     Section 1.  [60M.12] [EXCEPTION TO OPT OUT REQUIREMENTS FOR 
 33.20  DISCLOSURE OF NONPUBLIC PERSONAL FINANCIAL INFORMATION FOR 
 33.21  SERVICE PROVIDERS AND JOINT MARKETING.] 
 33.22     Subdivision 1.  [GENERAL RULE.] (a) The opt out 
 33.23  requirements in sections 60M.06 and 60M.09 do not apply when a 
 33.24  licensee provides nonpublic personal financial information to a 
 33.25  nonaffiliated third party to perform services for the licensee 
 33.26  or functions on the licensee's behalf, if the licensee: 
 33.27     (1) provides the initial notice in accordance with section 
 33.28  60M.03; and 
 33.29     (2) enters into a contractual agreement with the third 
 33.30  party that prohibits the third party from disclosing or using 
 33.31  the information other than to carry out the purposes for which 
 33.32  the licensee disclosed the information, including use under an 
 33.33  exception in section 60M.13 or 60M.14 in the ordinary course of 
 33.34  business to carry out those purposes. 
 33.35     (b) If a licensee discloses nonpublic personal financial 
 33.36  information under this section to a financial institution with 
 34.1   which the licensee performs joint marketing, the licensee's 
 34.2   contractual agreement with that institution meets the 
 34.3   requirements of paragraph (a), clause (2), if it prohibits the 
 34.4   institution from disclosing or using the nonpublic personal 
 34.5   financial information except as necessary to carry out the joint 
 34.6   marketing or under an exception in section 60M.13 or 60M.14 in 
 34.7   the ordinary course of business to carry out that joint 
 34.8   marketing. 
 34.9      Subd. 2.  [SERVICE MAY INCLUDE JOINT MARKETING.] The 
 34.10  services a nonaffiliated third party performs for a licensee 
 34.11  under subsection A of this section may include marketing of the 
 34.12  licensee's own products or services or marketing of financial 
 34.13  products or services offered pursuant to joint agreements 
 34.14  between the licensee and one or more financial institutions. 
 34.15     Subd. 3.  [DEFINITION OF JOINT AGREEMENT.] For purposes of 
 34.16  this section, "joint agreement" means a written contract 
 34.17  pursuant to which a licensee and one or more financial 
 34.18  institutions jointly offer, endorse, or sponsor a financial 
 34.19  product or service. 
 34.20     Sec. 2.  [60M.13] [EXCEPTIONS TO NOTICE AND OPT OUT 
 34.21  REQUIREMENTS FOR DISCLOSURE OF NONPUBLIC PERSONAL FINANCIAL 
 34.22  INFORMATION FOR PROCESSING AND SERVICING TRANSACTIONS.] 
 34.23     Subdivision 1.  [EXCEPTIONS FOR PROCESSING TRANSACTIONS AT 
 34.24  CONSUMER'S REQUEST.] The requirements for initial notice in 
 34.25  section 60M.03, subdivision 1, paragraph (b), the opt out in 
 34.26  sections 60M.06 and 60M.09, and service providers and joint 
 34.27  marketing in section 60M.12 do not apply if the licensee 
 34.28  discloses nonpublic personal financial information as necessary 
 34.29  to effect, administer, or enforce a transaction that a consumer 
 34.30  requests or authorizes, or in connection with: 
 34.31     (1) servicing or processing an insurance product or service 
 34.32  that a consumer requests or authorizes; 
 34.33     (2) maintaining or servicing the consumer's account with a 
 34.34  licensee, or with another entity as part of a private label 
 34.35  credit card program or other extension of credit on behalf of 
 34.36  such entity; 
 35.1      (3) a proposed or actual securitization, secondary market 
 35.2   sale (including sales of servicing rights) or similar 
 35.3   transaction related to a transaction of the consumer; or 
 35.4      (4) reinsurance or stop loss or excess loss insurance. 
 35.5      Subd. 2.  [DEFINITION.] "Necessary to effect, administer, 
 35.6   or enforce a transaction" means that the disclosure is: 
 35.7      (a) required, or is one of the lawful or appropriate 
 35.8   methods, to enforce the licensee's rights or the rights of other 
 35.9   persons engaged in carrying out the financial transaction or 
 35.10  providing the product or service; or 
 35.11     (b) required, or is a usual, appropriate, or acceptable 
 35.12  method: 
 35.13     (1) to carry out the transaction or the product or service 
 35.14  business of which the transaction is a part, and record, 
 35.15  service, or maintain the consumer's account in the ordinary 
 35.16  course of providing the insurance product or service; 
 35.17     (2) to administer or service benefits or claims relating to 
 35.18  the transaction or the product or service business of which it 
 35.19  is a part; 
 35.20     (3) to provide a confirmation, statement, or other record 
 35.21  of the transaction, or information on the status or value of the 
 35.22  insurance product or service to the consumer or the consumer's 
 35.23  agent or broker; 
 35.24     (4) to accrue or recognize incentives or bonuses associated 
 35.25  with the transaction that are provided by a licensee or any 
 35.26  other party; 
 35.27     (5) to underwrite insurance at the consumer's request or 
 35.28  for any of the following purposes as they relate to a consumer's 
 35.29  insurance:  account administration, reporting, investigating or 
 35.30  preventing fraud or material misrepresentation, processing 
 35.31  premium payments, processing insurance claims, administering 
 35.32  insurance benefits (including utilization review activities), 
 35.33  participating in research projects or as otherwise required or 
 35.34  specifically permitted by federal or state law; or 
 35.35     (6) in connection with: 
 35.36     (i) the authorization, settlement, billing, processing, 
 36.1   clearing, transferring, reconciling or collection of amounts 
 36.2   charged, debited or otherwise paid using a debit, credit, or 
 36.3   other payment card, check or account number, or by other payment 
 36.4   means; 
 36.5      (ii) the transfer of receivables, accounts, or interests 
 36.6   therein; or 
 36.7      (iii) the audit of debit, credit, or other payment 
 36.8   information. 
 36.9      Sec. 3.  [60M.14] [OTHER EXCEPTIONS TO NOTICE AND OPT OUT 
 36.10  REQUIREMENTS FOR DISCLOSURE OF NONPUBLIC PERSONAL FINANCIAL 
 36.11  INFORMATION.] 
 36.12     Subdivision 1.  [EXCEPTIONS TO OPT OUT REQUIREMENTS.] The 
 36.13  requirements for initial notice to consumers in section 60M.03, 
 36.14  subdivision 1, clause (2), the opt out in sections 60M.06 and 
 36.15  60M.09, and service providers and joint marketing in section 
 36.16  60M.12 do not apply when a licensee discloses nonpublic personal 
 36.17  financial information: 
 36.18     (1) with the consent or at the direction of the consumer, 
 36.19  provided that the consumer has not revoked the consent or 
 36.20  direction; 
 36.21     (2)(i) to protect the confidentiality or security of a 
 36.22  licensee's records pertaining to the consumer, service, product, 
 36.23  or transaction; 
 36.24     (ii) to protect against or prevent actual or potential 
 36.25  fraud or unauthorized transactions; 
 36.26     (iii) for required institutional risk control or for 
 36.27  resolving consumer disputes or inquiries; 
 36.28     (iv) to persons holding a legal or beneficial interest 
 36.29  relating to the consumer; or 
 36.30     (v) to persons acting in a fiduciary or representative 
 36.31  capacity on behalf of the consumer; 
 36.32     (3) to provide information to insurance rate advisory 
 36.33  organizations, guaranty funds or agencies, agencies that are 
 36.34  rating a licensee, persons that are assessing the licensee's 
 36.35  compliance with industry standards, and the licensee's 
 36.36  attorneys, accountants, and auditors; 
 37.1      (4) to the extent specifically permitted or required under 
 37.2   other provisions of law and in accordance with the federal Right 
 37.3   to Financial Privacy Act of 1978, United States Code, title 12, 
 37.4   section 3401 et seq., to law enforcement agencies (including the 
 37.5   Federal Reserve Board, Office of the Comptroller of the 
 37.6   Currency, Federal Deposit Insurance Corporation, Office of 
 37.7   Thrift Supervision, National Credit Union Administration, the 
 37.8   Securities and Exchange Commission, the Secretary of the 
 37.9   Treasury, with respect to United States Code, title 31, chapter 
 37.10  53, subchapter II (Records and Reports on Monetary Instruments 
 37.11  and Transactions) and United States Code, title 12, chapter 21 
 37.12  (Financial Recordkeeping), a state insurance authority, and the 
 37.13  Federal Trade Commission), self-regulatory organizations, or for 
 37.14  an investigation on a matter related to public safety; 
 37.15     (5)(i) to a consumer reporting agency in accordance with 
 37.16  the federal Fair Credit Reporting Act, United States Code, title 
 37.17  15, section 1681 et seq.; or 
 37.18     (ii) from a consumer report reported by a consumer 
 37.19  reporting agency; 
 37.20     (6) in connection with a proposed or actual sale, merger, 
 37.21  transfer, or exchange of all or a portion of a business or 
 37.22  operating unit if the disclosure of nonpublic personal financial 
 37.23  information concerns solely consumers of the business or unit; 
 37.24     (7)(i) to comply with federal, state, or local laws, rules, 
 37.25  and other applicable legal requirements; 
 37.26     (ii) to comply with a properly authorized civil, criminal, 
 37.27  or regulatory investigation, or subpoena or summons by federal, 
 37.28  state, or local authorities; 
 37.29     (iii) to respond to judicial process or government 
 37.30  regulatory authorities having jurisdiction over a licensee for 
 37.31  examination, compliance, or other purposes as authorized by law; 
 37.32  or 
 37.33     (8) for purposes related to the replacement of a group 
 37.34  benefit plan, a group health plan, a group welfare plan, or a 
 37.35  workers' compensation plan. 
 37.36     Subd. 2.  [EXAMPLE OF REVOCATION OF CONSENT.] A consumer 
 38.1   may revoke consent by subsequently exercising the right to opt 
 38.2   out of future disclosures of nonpublic personal information as 
 38.3   permitted under section 60M.06, subdivision 6. 
 38.4                              ARTICLE 5
 38.5                          HEALTH INFORMATION 
 38.6      Section 1.  [60M.15] [DISCLOSURE OF NONPUBLIC PERSONAL 
 38.7   HEALTH INFORMATION.] 
 38.8      Subdivision 1.  [PROHIBITION.] A licensee shall not 
 38.9   disclose nonpublic personal health information about a consumer 
 38.10  or customer unless an authorization is obtained from the 
 38.11  consumer or customer whose nonpublic personal health information 
 38.12  is sought to be disclosed. 
 38.13     Subd. 2.  [NONAPPLICATION.] Nothing in this section 
 38.14  prohibits, restricts, or requires an authorization for the 
 38.15  disclosure of nonpublic personal health information by a 
 38.16  licensee for the performance of the following insurance 
 38.17  functions by or on behalf of the licensee:  claims 
 38.18  administration; claims adjustment and management; detection, 
 38.19  investigation or reporting of actual or potential fraud, 
 38.20  misrepresentation or criminal activity; underwriting; policy 
 38.21  placement or issuance; loss control; ratemaking and guaranty 
 38.22  fund functions; reinsurance and excess loss insurance; risk 
 38.23  management; case management; disease management; quality 
 38.24  assurance; quality improvement; performance evaluation; provider 
 38.25  credentialing verification; utilization review; peer review 
 38.26  activities; actuarial, scientific, medical, or public policy 
 38.27  research; grievance procedures; internal administration of 
 38.28  compliance, managerial, and information systems; policyholder 
 38.29  service functions; auditing; reporting; database security; 
 38.30  administration of consumer disputes and inquiries; external 
 38.31  accreditation standards; the replacement of a group benefit plan 
 38.32  or workers' compensation policy or program; activities in 
 38.33  connection with a sale, merger, transfer, or exchange of all or 
 38.34  part of a business or operating unit; any activity that permits 
 38.35  disclosure without authorization pursuant to the federal Health 
 38.36  Insurance Portability and Accountability Act privacy rules 
 39.1   promulgated by the United States Department of Health and Human 
 39.2   Services; disclosure that is required, or is one of the lawful 
 39.3   or appropriate methods, to enforce the licensee's rights or the 
 39.4   rights of other persons engaged in carrying out a transaction or 
 39.5   providing a product or service that a consumer requests or 
 39.6   authorizes; and any activity otherwise permitted by law, 
 39.7   required pursuant to governmental reporting authority, or to 
 39.8   comply with legal process.  Additional insurance functions may 
 39.9   be added with the approval of the commissioner to the extent 
 39.10  they are necessary for appropriate performance of insurance 
 39.11  functions and are fair and reasonable to the interest of 
 39.12  consumers. 
 39.13     Sec. 2.  [60M.16] [AUTHORIZATIONS.] 
 39.14     Subdivision 1.  [CONTENTS.] A valid authorization to 
 39.15  disclose nonpublic personal health information pursuant to 
 39.16  sections 60M.15 to 60M.19 must be in written or electronic form 
 39.17  and must contain all of the following: 
 39.18     (1) the identity of the consumer or customer who is the 
 39.19  subject of the nonpublic personal health information; 
 39.20     (2) a general description of the types of nonpublic 
 39.21  personal health information to be disclosed; 
 39.22     (3) general descriptions of the parties to whom the 
 39.23  licensee discloses nonpublic personal health information, the 
 39.24  purpose of the disclosure, and how the information will be used; 
 39.25     (4) the signature of the consumer or customer who is the 
 39.26  subject of the nonpublic personal health information or the 
 39.27  individual who is legally empowered to grant authority and the 
 39.28  date signed; and 
 39.29     (5) notice of the length of time for which the 
 39.30  authorization is valid and that the consumer or customer may 
 39.31  revoke the authorization at any time and the procedure for 
 39.32  making a revocation. 
 39.33     Subd. 2.  [VALIDITY; LENGTH OF TIME.] An authorization for 
 39.34  the purposes of sections 60M.15 to 60M.19 must specify a length 
 39.35  of time for which the authorization remains valid, which in no 
 39.36  event may be for more than 24 months. 
 40.1      Subd. 3.  [REVOCATION.] A consumer or customer who is the 
 40.2   subject of nonpublic personal health information may revoke an 
 40.3   authorization provided pursuant to sections 60M.15 to 60M.19 at 
 40.4   any time, subject to the rights of an individual who acted in 
 40.5   reliance on the authorization before notice of the revocation. 
 40.6      Subd. 4.  [RETENTION.] A licensee shall retain the 
 40.7   authorization or a copy thereof in the record of the individual 
 40.8   who is the subject of nonpublic personal health information. 
 40.9      Sec. 3.  [60M.17] [AUTHORIZATION REQUEST DELIVERY.] 
 40.10     A request for authorization and an authorization form may 
 40.11  be delivered to a consumer or a customer as part of an opt out 
 40.12  notice pursuant to section 60M.08, provided that the request and 
 40.13  the authorization form are clear and conspicuous.  An 
 40.14  authorization form is not required to be delivered to the 
 40.15  consumer or customer or included in any other notices unless the 
 40.16  licensee intends to disclose protected health information 
 40.17  pursuant to section 60M.15, subdivision 1. 
 40.18     Sec. 4.  [60M.18] [RELATIONSHIP TO FEDERAL RULES.] 
 40.19     Irrespective of whether a licensee is subject to the 
 40.20  federal Health Insurance Portability and Accountability Act 
 40.21  privacy rule as promulgated by the United States Department of 
 40.22  Health and Human Services at Federal Register, volume 65, pages 
 40.23  82461 to 82829 (2000) (the "federal rule"), if a licensee 
 40.24  complies with all requirements of the federal rule except for 
 40.25  its effective date provision, the licensee shall not be subject 
 40.26  to the provisions of sections 60M.15 to 60M.19. 
 40.27     Sec. 5.  [60M.19] [RELATIONSHIP TO OTHER LAWS.] 
 40.28     Nothing in sections 60M.15 to 60M.19 preempts or supersedes 
 40.29  existing state law related to medical records, health, or 
 40.30  insurance information privacy. 
 40.31                             ARTICLE 6
 40.32                       ADDITIONAL PROVISIONS
 40.33     Section 1.  [60M.20] [PROTECTION OF FAIR CREDIT REPORTING 
 40.34  ACT.] 
 40.35     Nothing in this chapter may be construed to modify, limit, 
 40.36  or supersede the operation of the federal Fair Credit Reporting 
 41.1   Act, United States Code, title 15, section 1681 et seq., and no 
 41.2   inference may be drawn on the basis of the provisions of this 
 41.3   chapter regarding whether information is transaction or 
 41.4   experience information under section 603 of that act. 
 41.5      Sec. 2.  [60M.21] [NONDISCRIMINATION.] 
 41.6      Subdivision 1.  [DUE TO OPT OUT.] A licensee shall not 
 41.7   unfairly discriminate against any consumer or customer because 
 41.8   that consumer or customer has opted out from the disclosure of 
 41.9   nonpublic personal financial information pursuant to the 
 41.10  provisions of this chapter. 
 41.11     Subd. 2.  [DUE TO REFUSAL TO AUTHORIZE.] A licensee shall 
 41.12  not unfairly discriminate against a consumer or customer because 
 41.13  that consumer or customer has not granted authorization for the 
 41.14  disclosure of nonpublic personal health information pursuant to 
 41.15  the provisions of this chapter. 
 41.16     Sec. 3.  [60M.22] [ENFORCEMENT.] 
 41.17     A violation of this chapter is considered an unfair or 
 41.18  deceptive act or practice in the business of insurance and is 
 41.19  subject to the penalties and remedies under sections 72A.17 to 
 41.20  72A.32.  
 41.21     Sec. 4.  Minnesota Statutes 2000, section 72A.501, is 
 41.22  amended to read: 
 41.23     72A.501 [DISCLOSURE AUTHORIZATION TO COLLECT INFORMATION.] 
 41.24     Subdivision 1.  [AUTHORIZATION REQUIRED.] An insurer, 
 41.25  insurance agent, or insurance-support organization must not 
 41.26  collect personal information about a policyholder or an 
 41.27  applicant not relating to a claim from sources other than public 
 41.28  records without a written authorization from the person. 
 41.29     Subd. 1a.  [REQUIREMENT; CONTENT.] An authorization used by 
 41.30  an insurer, insurance-support organization, or insurance agent 
 41.31  to disclose or collect personal or privileged information must 
 41.32  be in writing and must meet the following requirements: 
 41.33     (1) is written in plain language; 
 41.34     (2) is dated; 
 41.35     (3) specifies the types of persons authorized to disclose 
 41.36  provide information about the person; 
 42.1      (4) specifies the nature of the information authorized to 
 42.2   be disclosed collected; 
 42.3      (5) names the insurer or insurance agent and identifies by 
 42.4   generic reference representatives of the insurer to whom the 
 42.5   person is authorizing information to be disclosed provided; 
 42.6      (6) specifies the purposes for which the information is 
 42.7   collected; and 
 42.8      (7) specifies the length of time the authorization remains 
 42.9   valid. 
 42.10     Subd. 2.  [APPLICATION.] (a) If the authorization is signed 
 42.11  to collect information in connection with an application for a 
 42.12  property and casualty insurance policy, a policy reinstatement, 
 42.13  or a request for a change in benefits, the authorization must 
 42.14  not remain valid for longer than one year from the date the 
 42.15  authorization is signed or the date the insurer grants or denies 
 42.16  coverage, reinstatement, or change in benefits, whichever is 
 42.17  sooner. 
 42.18     (b) If the authorization is signed to collect information 
 42.19  in connection with an application for a life, disability, and 
 42.20  health insurance policy or contract, reinstatement, or request 
 42.21  for change in benefits, the authorization may not remain valid 
 42.22  for longer than 26 months from the date the authorization is 
 42.23  signed. 
 42.24     Subd. 3.  [CLAIMS.] If the authorization is signed to 
 42.25  collect information in connection with a claim for benefits 
 42.26  under an insurance policy, the authorization must not remain 
 42.27  valid for longer than: 
 42.28     (1) the term of coverage of the policy, if the claim is for 
 42.29  a health insurance benefit; or 
 42.30     (2) the duration of the claim, if the claim is for a claim 
 42.31  other than for a health insurance benefit. 
 42.32     Subd. 4.  [AUTHORIZATION; NONINSURERS.] If an authorization 
 42.33  is submitted to an insurer, insurance-support organization, or 
 42.34  insurance agent by a person other than an insurer, 
 42.35  insurance-support organization, or insurance agent, the 
 42.36  authorization must be dated, signed by the person, and obtained 
 43.1   one year or less before the date a disclosure is sought.  
 43.2      Sec. 5.  [REPEALER.] 
 43.3      Minnesota Statutes 2000, sections 72A.494; and 72A.502, are 
 43.4   repealed. 
 43.5      Sec. 6.  [EFFECTIVE DATE; APPLICATION.] 
 43.6      Subdivision 1.  [GENERAL EFFECTIVE DATE] This act is 
 43.7   effective July 1, 2001. 
 43.8      Subd. 2.  [NOTICE REQUIREMENT FOR CONSUMERS WHO ARE THE 
 43.9   LICENSEE'S CUSTOMERS ON THE COMPLIANCE DATE.] By July 1, 2001, a 
 43.10  licensee shall provide an initial notice, as required by article 
 43.11  1, section 3, to consumers who are the licensee's customers on 
 43.12  July 1, 2001. 
 43.13     A licensee provides an initial notice to consumers who are 
 43.14  its customers on July 1, 2001, if, by that date, the licensee 
 43.15  has established a system for providing an initial notice to all 
 43.16  new customers and has mailed the initial notice to all the 
 43.17  licensee's existing customers. 
 43.18     Subd. 3.  [TWO-YEAR GRANDFATHERING OF SERVICE 
 43.19  AGREEMENTS.] Until July 1, 2002, a contract that a licensee has 
 43.20  entered into with a nonaffiliated third party to perform 
 43.21  services for the licensee or functions on the licensee's behalf 
 43.22  satisfies the provisions of Minnesota Statutes, section 60M.12, 
 43.23  subdivision 1, paragraph (a), clause (2), even if the contract 
 43.24  does not include a requirement that the third party maintain the 
 43.25  confidentiality of nonpublic personal information, as long as 
 43.26  the licensee entered into the agreement on or before July 1, 
 43.27  2000.