As you may know, the National Association of Insurance Commissioners (NAIC) has been working to modernize its consumer privacy protection regulatory framework, which forms the foundation of all states’ insurance consumer protection regimes. The NAIC’s Privacy Protections Working Group (PPWG) is in the process of drafting a single new model, the Insurance Consumer Privacy Protection Model Law (MDL-674), to replace two of its existing models, both of which address consumer data privacy protection but are significantly outdated.

Background

The initial draft of the new model was exposed for a 60-day public comment period ending in early April. In response, PIA submitted a comment letter and draft markup reflecting our concerns and suggesting revisions. In June, the PPWG hosted an open, in-person interim drafting meeting in which PIA participated. After that, the PPWG exposed a partial second draft of four sections of the new model. PIA commented on two of the four exposed sections.

In July, the PPWG published a second complete draft, referred to as Version 1.2, of the new model. Because of its complexity, PIA and several other interested parties collaborated on a letter requesting additional time in which to comment on the new exposure. The PPWG denied our request but indicated it planned to consider comments received throughout the rest of the drafting process, regardless of when they were submitted.

Recent Activity

During a public PPWG call last month to discuss Version 1.2, regulators from Nebraska and South Dakota announced outright that Version 1.2, as drafted, was unpassable in their states. These signs of dissent within the PPWG presaged the events of its Seattle meeting, further described below, at which the PPWG announced its plan to seek additional time for the new model to complete the bureaucratic and extensive NAIC organizational approval process. For our part, PIA’s comments on Version 1.2 focused on the draft’s overbroad scope, its improper attempts to regulate disclosures around adverse underwriting decisions, and its questionable treatment of third-party service providers.

The Latest Developments

The PPWG recently held an open, in-person meeting in Seattle as part of the NAIC’s ongoing Summer National Meeting. There, the PPWG limited the MDL-674 discussion to the topics of marketing, consumer notice, and the concept of opt-in/opt-out. The discussion opened with Kansas adding its voice to prior regulatory expressions of opposition by describing Version 1.2 as “fundamentally flawed.” Nebraska and South Dakota reiterated their concerns as well, which they had previously expressed on the interim PPWG call last month, as noted above.

In Seattle, PIA and several other trade associations spoke in opposition to the model’s current draft. PIA took the opportunity to provide context around the way Version 1.2, if adopted as written, could impede the ability of independent agents to sell policies that provide adequate coverage in some lines of business, including flood insurance. PIA also noted that, despite its opposition to Version 1.2, NAIC continues to be the appropriate venue for consideration of these issues. We emphasized our interest in aiding the PPWG in the drafting of a workable model that effectively reflects current and emerging insurance industry business practices and trends.

Chair Katie Johnson (VA) expressed interest in scheduling a call after the Seattle meeting for the PPWG to speak further with PIA about its concerns regarding the potential unintended consequences of Version 1.2. PIA is looking forward to this additional chance to address agent-specific issues in greater detail before the PPWG.

Despite the PPWG’s circumscribed agenda, the Seattle meeting was also noteworthy because the group confirmed its intent to seek additional time to finalize MDL-674. Its modernization effort is not moving fast enough for the PPWG to finish its work while adhering to its existing timeline, which projected that the new model would successfully complete the NAIC’s organizational approval process by year-end.

The PPWG initially received permission to work on this ambitious project for 12 months, during which it could both repeal the existing models and promulgate their replacement. However, the group is now approaching the end of that period, and, apparently, it will need additional authority to continue beyond 2023.

Going Forward

The PPWG received voluminous feedback on Version 1.2, and it plans to further review those comments before it requests additional time to complete its work. In the meantime, within the next month or so, the PPWG plans to expose a third complete draft in which changes from Version 1.2 will be tracked.

PIA will continue to engage in additional constructive discussions with regulators and comment on the new draft once it is available. We look forward to continuing to collaborate with regulators to build a model that aspires to properly balance the need to protect consumer data with the need for independent agents to supply essential insurance coverage to consumers.