ARC 2788C

ARC 2788C

INSURANCE DIVISION[191]

Notice of Intended Action

Twenty-five interested persons, a governmental subdivision, an agency or association of 25 or more persons may demand an oral presentation hereon as provided in Iowa Code section 17A.4(1)"b."

Notice is also given to the public that the Administrative Rules Review Committee may, on its own motion or on written request by any individual or group, review this proposed action under section 17A.8(6) at a regular or special meeting where the public or interested persons may be heard.

Pursuant to the authority of Iowa Code section 505.8, the Insurance Division (the Division) hereby gives Notice of Intended Action to amend Chapter 90, "Financial and Health Information Regulation," Iowa Administrative Code.

The purpose of this proposed amendment is to clarify the effect on Iowa administrative law of certain changes made in 2015 to the federal Gramm-Leach-Bliley Act (GLBA) (Pub.L. No.106-102, 113 Stat. 1338).

On December 4, 2015, the federal Fixing America's Surface Transportation (FAST) Act (Pub.L. No.114-94) was enacted into law and was effective immediately. The FAST Act included amendments to the GLBA to eliminate the GLBA requirement for financial institutions to provide annual privacy notices about the treatment of nonpublic personal information provided certain conditions are met. The amendments to the GLBA eliminated a duplicative and costly notification requirement. Financial institutions shall continue to provide initial privacy notices as required under the GLBA.

Proposed subrule 90.4(4) is intended to clarify that a licensee of the Division is not required to provide the annual privacy notice otherwise required under rule 191—90.4(505) if the licensee both (1) provides nonpublic personal information to nonaffiliated third parties except as in accordance with rules 191—90.12(505), 191—90.13(505) and 191—90.14(505), and (2) has not changed or amended the privacy policies and practices that the licensee disclosed to the consumer in the privacy notice that the licensee most recently delivered to the consumer in accordance with rule 191—90.3(505) or 191—90.4(505). If at any time a licensee fails to comply with (1) or (2), the licensee shall be required to provide the annual privacy notice. All licensees shall continue to provide initial privacy notices required under Chapter 90.

The Division intends that this amendment shall go into effect January 25, 2017.

Any interested person may make written suggestions or comments on this proposed amendment on or before November 16, 2016. Such written materials should be directed to Doug Ommen, Iowa Insurance Division, Market Regulation Bureau, Two Ruan Center, 601 Locust Street, Fourth Floor, Des Moines, Iowa 50319; fax (515)281-3059; e-mail doug.ommen@iid.iowa.gov.

Also, there will be a public hearing on November 16, 2016, at 10 a.m.at the offices of the Iowa Insurance Division, Two Ruan Center, 601 Locust Street, Fourth Floor, Des Moines, Iowa, at which time persons may present their views either orally or in writing. At the hearing, persons will be asked to give their names and addresses for the record and to confine their remarks to the subject of the amendment. Any persons who intend to attend the public hearing and have special requirements, such as those relating to hearing or mobility impairments, should contact the Division and advise of specific needs.

The Insurance Division's general waiver provisions of 191—Chapter 4 apply to these rules.

These rules will impose no fiscal impact on the State.

After analysis and review of this rule making, no impact on jobs has been found.

This amendment is intended to implement Iowa Code chapter 505.

The following amendment is proposed.

Rescind subrule 90.4(4) and adopt the following new subrule in lieu thereof:

90.4(4) A licensee is not required to provide an annual privacy notice if both of the following are true: the licensee has not changed the privacy policies and practices that the licensee disclosed to the consumer in the privacy notice that the licensee most recently delivered to the consumer in accordance with rule 191—90.3(505) or this rule; and the licensee does not disclose any nonpublic personal information about the consumer to any nonaffiliated third party except as authorized by rules 191—90.12(505), 191—90.13(505) and 191—90.14(505). If a licensee at any time fails to comply with the criteria of this subrule, the licensee shall immediately provide to the consumer the annual privacy notice required under this chapter.