We have previously covered efforts by the National Association of Insurance Commissioners (NAIC) to modernize the existing consumer privacy regulatory framework that forms the basis for all 50 states’ insurance consumer data protection regimes. The NAIC’s Privacy Protections Working Group (PPWG) is in the process of replacing its Insurance Information and Privacy Protection Model Act (MDL-670) and Privacy of Consumer Financial and Health Information Regulation (MDL-672) with a single new model, the Insurance Consumer Privacy Protection Model Law (MDL-674).
The initial draft of MDL-674 was published on Feb. 1 and exposed for a 60-day public comment period, which ended in early April. That month, PIA met privately with first the PPWG chair and then the whole PPWG to comprehensively discuss the independent agent-specific challenges posed by the draft. PIA also submitted a comment letter and draft markup reflecting our comments and suggesting changes to the initial draft text.
Since that time, the PPWG has held several public and private calls with various industry and consumer representatives. In June, the PPWG held an in-person interim meeting in Kansas City, where interested parties and regulators engaged in two days’ worth of constructive dialogue about many of the most complex issues raised in the feedback generated by the initial draft.
The interim meeting covered, among other topics, the definition and treatment of third-party service providers; contracts between licensees and third-party service providers; the definition of “insurance transactions”; licensees’ practices of marketing products, insurance and otherwise, to consumers using their personal information; types of marketing agreements; the process of obtaining consumer consent to use their information for marketing purposes; and the appropriate content and delivery methods for consumer notices of privacy practices.
During the interim meeting, the chair reaffirmed the PPWG’s ambitious timeline for finalizing the model by the end of 2023. In the month since then, the PPWG has issued more than one update to its timeline, but each update has repeated its goal of finalizing the model by the end of this year. In its effort to keep to that schedule, the PPWG exposed a partial draft of four stand-alone provisions in late June for a period of two weeks; PIA provided comments on two of the four provisions.
Earlier this week, the PPWG issued a second draft of the entire model, including the four provisions released last month, for a comment period of just over two weeks, which would end on July 28. While the second draft is substantially shorter than the first, it retains many of the same concerning provisions as the original. Because of the complexity of the issues, and the degree to which interested parties, including PIA, typically seek out feedback from their member companies in constructing their responses, PIA and several other interested parties collaborated on a letter requesting additional time in which to comment on the full second draft.
PIA is proceeding as though the current deadline will remain in force so that, should our request for additional time be denied, we are prepared to submit comments by July 28. The PPWG plans to meet in person next month during the NAIC’s National Meeting in Seattle, and PIA looks forward to continuing our constructive discussions with regulators about how best to achieve a balance between the need for consumer data privacy and the protection of independent agents’ key role in the business of insurance.
If you are a PIA member and would like to provide feedback on the latest draft for possible inclusion in its comment letter, please contact Lauren Pachman, Counsel & Director of Regulatory Affairs, as soon as possible to share your thoughts.