AMENDED IN ASSEMBLY AUGUST 21, 2026

AMENDED IN ASSEMBLY AUGUST 13, 2026

AMENDED IN ASSEMBLY JUNE 26, 2026

AMENDED IN ASSEMBLY JUNE 11, 2026

AMENDED IN ASSEMBLY MAY 27, 2026

AMENDED IN ASSEMBLY APRIL 15, 2026

AMENDED IN SENATE MAY 23, 2025

AMENDED IN SENATE MAY 1, 2025

AMENDED IN SENATE APRIL 3, 2025

AMENDED IN SENATE MARCH 18, 2025

CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION

89

Introduced by Senator Limón

February 12, 2025

---

An act to add Section 791.30 to, and to repeal and add Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of, the Insurance Code, relating to insurance.

Vote: majority   Appropriation: no   Fiscal committee: yes   Local program: yes

LEGISLATIVE COUNSEL’S DIGEST

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information that is collected by a business, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. Existing law, the Insurance Information and Privacy Protection Act, establishes privacy standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents, and insurance-support organizations. The Insurance Information and Privacy Protection Act imposes various monetary penalties for violations of the act and makes a person who knowingly and willfully obtains information about an individual from an insurance institution, agent, or insurance-support organization under false pretenses guilty of a misdemeanor.

On and after July 1, 2028, this bill would revise the Insurance Information and Privacy Protection Act to establish new standards for the collection, processing, retaining, or processing and sharing of consumers’ personal information by insurance licensees, surplus line insurers, reinsurers, and third-party service providers. The bill would authorize processing or sharing of a consumer’s personal information for specified purposes, including sharing in connection with an insurance transaction. The bill would require a licensee, surplus line insurer, reinsurer, or third-party service provider to provide a clear and conspicuous privacy notice presented as a stand-alone document that includes specified information to a consumer within a specified period of time, and would prohibit the sharing of a consumer’s personal information unless it is reasonably necessary and proportionate to achieve specified purposes related to an insurance transaction or another purpose that is fully disclosed to the consumer and to which the consumer has consented. The bill would also require a licensee to provide a privacy rights notice, as specified, to each consumer with whom the licensee has an ongoing business relationship. The bill would require a licensee, surplus line insurer, reinsurer, or third-party service provider to obtain a consumer’s consent to take specified actions, and would set forth the means by which consent is obtained. The bill would authorize a licensee, surplus line insurer, or reinsurer to retain personal information, as specified, and would require a licensee, surplus line insurer, or reinsurer to develop a written records retention policy and schedule. The bill would require a licensee, surplus line insurer, or reinsurer to provide specified information to a consumer if it makes an adverse underwriting decision, and would provide a process by which a consumer may access, correct, amend, or delete any personal information about the consumer in the possession of the licensee, surplus line insurer, reinsurer, or its third-party service providers. The bill would require a contract between a licensee, surplus line insurer, or reinsurer and a third-party service provider to govern the processing and sharing of personal information performed on behalf of the licensee, surplus line insurer, or reinsurer. The bill would prohibit retaliation against a consumer because the consumer exercised or attempted to exercise their rights under the act. The bill would prohibit public disclosure of specified systems, processes, policies, procedures, and plans that are disclosed to the Insurance Commissioner. The bill would also make technical and conforming changes.

This bill would authorize a penalty of at least $5,000, not to exceed $1,000,000 in the aggregate for multiple violations of the act. The bill would increase the fine if a cease and desist order is violated to at least $15,000 for each violation, and would increase a fine to at least $50,000 for each violation if the commissioner finds the violations to be a general business practice. Under the bill, a person who knowingly and willfully obtains information about a consumer from a licensee, surplus line insurer, reinsurer, or third-party service provider under false pretenses would be guilty of a misdemeanor, punishable by a fine of up to $50,000, imprisonment in a county jail for up to 6 months, or both, thus expanding the applicability of a crime and imposing a state-mandated local program.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

This bill would incorporate additional changes to Sections 791.07, 791.11, and 791.12 of the Insurance Code proposed by AB 1798 to be operative only if this bill and AB 1798 are enacted and this bill is enacted last.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

The people of the State of California do enact as follows:

SECTION 1.

(a) The Legislature finds and declares all of the following:

(1) In 1972, California voters amended the California Constitution to include the right of privacy among the “inalienable” rights of all people. Voters acted in response to the accelerating encroachment on personal freedom and security caused by increased data collection and usage in contemporary society. The amendment established a legal and enforceable constitutional right of privacy for every Californian. Fundamental to this right of privacy is the ability of individuals to control the use, including the sale, of their personal information.

(2) A major milestone in consumer privacy occurred in 2018, when more than 629,000 California voters signed petitions to qualify the California Consumer Privacy Act of 2018 (CCPA) for the ballot. In response to the measure’s qualification, the Legislature enacted the CCPA into law. The CCPA gives California consumers the right to learn what information a business has collected about them, to delete their personal information, to stop businesses from selling their personal information, including using it to target them with advertisements that follow them as they browse the internet from one internet website to another, and to hold businesses accountable if they do not take reasonable steps to safeguard their personal information.

(3) Even before the CCPA took effect, the Legislature considered many bills in 2019 to amend the law, some of which would have significantly weakened it. In response, the proponents of the CCPA qualified for the ballot Proposition 24, the California Privacy Rights Act of 2020, which expanded upon the rights granted under the CCPA, and expressly extended the application of the act to licensees. In November 2020, voters approved Proposition 24 by a significant margin, with nearly 9,400,000 votes cast in support.

(4) Despite the mention of insurance business in Proposition 24, California’s insurance privacy laws, last adopted in 1980 and 2002, continue to be decades out of date and lag behind the broadly applicable privacy laws. These legacy laws are not suited to protect insurance consumers, given the data-intensive nature of the insurance business, and the increasingly complex manner in which insurance businesses collect and use information about consumers.

(5) Privacy is vitally important in the context of the insurance business. More than almost any other industry, insurers require significant amounts of personal information from consumers to properly manage risks. Increasingly, insurance licensees are using sophisticated technologies to collect and process consumers’ personal information, which has increased the volume and sensitivity of personal information that licensees collect about consumers. Developments in insurance business structures have led to increasingly complex contracting arrangements between licensees and service providers, with the attendant risk in supply chain data breaches. However, California’s outdated insurance privacy laws have not kept pace with the changing insurance marketplace. There is a significant lack of oversight into how much data licensees collect, what purposes it can be used for, who it can be shared with, and how long it can be retained.

(6) The absence of effective oversight leaves consumers vulnerable. Currently, consumers are presented with privacy notices that are confusing and uninformative, and may also be subject to the overcollection of their personal information, proliferation of that information to recipients not contemplated by the consumer, unwanted marketing contacts, fraud arising from data breaches, underwriting based on data that is stale or unrepresentative, or retaliation for exercising privacy rights, among other risks.

(b) It is the intent of the Legislature that this act addresses the gaps in consumer protections and gives the Insurance Commissioner and the Department of Insurance powerful tools to protect consumer privacy, as follows:

(1) Data minimization: ensures that licensees are only collecting personal information related to the insurance transaction requested by reasonable and proportionate to the purposes disclosed to the consumer.

(2) Record retention and destruction: ensures that licensees securely destroy personal information that is no longer needed.

(3) Oversight of third-party service provider arrangements: ensures that contractual arrangements between licensees and vendors provide for the security of consumers’ personal information, and that the information will only be used for the service provided by the licensee.

(4) Opt in: ensures that consumers’ personal information will primarily be used to provide the insurance product requested by the consumer, and will not be used for other purposes without the express consent of in ways that are reasonable and proportionate to the purposes disclosed to the consumer.

(5) Limitation on sensitive personal information: ensures that consumers’ sensitive personal information will only be used to provide the insurance product requested by the consumer.

(6) Notices to consumers: includes reasonable notice requirements to provide consumers with meaningful information about what information is collected, how it is used, to whom it is disclosed, and what rights the consumer has under the law.

(7) Transparency: ensures that consumers understand how their personal information will be used and have the opportunity to control the use processing and sharing of their personal information for purposes other than the an insurance transaction.

(8) Governance processes and procedures on data use: ensures that licensees establish and follow protocols to protect consumers’ personal information and provide data breach notifications.

(9) Access and nonretaliation: ensures that consumers have reasonable access to their privacy rights and are not penalized for exercising those rights.

(c) By enacting this act, the Legislature intends to provide consumers with reasonable privacy protections that address the demands of an information-intensive insurance business climate.

(d) The Legislature finds and declares that this act furthers the purpose and intent of the California Privacy Rights Act of 2020.

SEC. 2.

Article 6.6 (commencing with Section 791) is added to Chapter 1 of Part 2 of Division 1 of the Insurance Code, to read:

Article 6.6. Insurance Information and Privacy Protection Act

791.

The purpose of this article is to establish standards for the collection, processing, retaining, or sharing, use, storage, disclosure, analysis, deletion, retention, or modification of personal information, collectively known as “processing,” “processing” and “sharing” of consumers’ personal information by licensees, surplus line insurers, reinsurers, and their third-party service providers to maintain a balance between the need for information by those conducting the business of insurance and consumers’ need for fairness and protection in the processing or sharing of consumers’ personal information. These standards address the need to do all of the following:

(a) Protect consumers’ personal information processed or shared by licensees, surplus line insurers, reinsurers, or their third-party service providers.

(b) Inform consumers of the categories of personal information that are processed. processed or shared.

(c) Inform consumers of the categories of sources from which consumers’ personal information is collected, and identify recipients when that information is shared.

(d) Permit consumers to choose whether or not to opt in to the sharing of their personal information by licensees, surplus line insurers, or reinsurers for purposes other than insurance transactions in certain circumstances.

(e) Permit individual consumers to request access to their personal information to verify or dispute the accuracy of the information.

(f) Inform consumers of the reasons for adverse underwriting decisions.

(g) Require data minimization practices for all licensees, surplus line insurers, reinsurers, and their third-party service providers in the processing of consumers’ personal information.

(h) Provide accountability for the improper processing or sharing of consumers’ personal information by licensees, surplus line insurers, reinsurers, and their third-party service providers in violation of this article.

791.01.

(a) (1) The obligations imposed by this article shall apply to a licensee, surplus line insurer, or reinsurer.

(2) The obligations imposed by this article shall apply to a licensee’s, surplus line insurer’s, or reinsurer’s third-party service providers to the extent they do either of the following:

(A) Process or share consumers’ personal information in connection with the business of insurance.

(B) Engage in insurance transactions with consumers.

(b) The rights and protections granted by this article shall extend to a consumer who meets any of the following criteria:

(1) One whose personal information is processed or shared in connection with insurance transactions.

(2) One who has previously engaged in insurance transactions with a licensee, surplus line insurer, reinsurer, or third-party service provider involving the consumer’s personal information.

(3) One whose personal information is processed or shared for purposes other than insurance transactions by licensees, surplus line insurers, reinsurers, third-party service providers, or any of the foregoing.

(c) For purposes of this article, a person shall be considered a resident of this state if the person’s last known residential mailing address, as shown in the records of the licensee, surplus line insurer, or reinsurer, or the licensee’s, surplus line insurer’s, or reinsurer’s third-party service provider, is located in this state.

(d) The obligations imposed by this article shall not apply to Securities and Exchange Commission-regulated brokers, dealers, investment companies, or registered investment advisors, or depository institutions or affiliates of depository institutions that are subject to the Gramm-Leach-Bliley Act (Public Law 106-102), unless the Securities and Exchange Commission-regulated broker, dealer, investment company, or registered investment advisor, or depository institution or affiliate is also licensed by the department for purposes of this article. If a Securities and Exchange Commission-regulated broker, dealer, investment company, registered investment advisor, or depository institution or affiliate is also licensed by the department, this article shall only apply to the processing or sharing of personal information in the business of insurance by the Securities and Exchange Commission-regulated broker, dealer, investment company, registered investment advisor, or depository institution or affiliate. affiliate, except that it shall not apply when that information is collected in connection with making, modifying, or servicing a loan or line of credit, provided that the insurer issuing coverage complies with this article on behalf of the depository institution or affiliate.

(e) (1) The obligations imposed by this article shall not apply to a provider of health care governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) or a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191).

(2) A “third-party service provider” does not include a provider of health care governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) or a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191).

(3) For purposes of this subdivision, “medical information” and “provider of health care” have the same meanings as defined in Section 56.05 of the Civil Code, and “business associate,” “covered entity,” and “protected health information” have the same meanings as defined in Section 160.103 of Title 45 of the Code of Federal Regulations.

(4) Notwithstanding paragraphs (1) and (2), this article applies to a disability insurer licensed to transact health insurance, as defined in Section 106 that is not regulated as a health care service plan pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).

(f) This article shall not apply to any person or entity engaged in the business of title insurance, as defined in Section 12340.3.

(g) The obligations imposed by this article shall only apply to the processing or sharing by a licensee, surplus line insurer, or reinsurer of personal information in connection with insurance for personal, family, or household purposes. Personal information processed or shared in connection with insurance for business or professional purposes shall not be processed or shared in connection with insurance for personal, family, or household purposes, provided that this limitation shall not prevent cross-marketing consistent with the requirements of subparagraph (B) of paragraph (3) of subdivision (a) of Section 791.13.

(h) (1) The obligations imposed by this article shall not apply to the processing of personal information by a surplus lines advisory organization designated by the commissioner for purposes consistent with the mandates of the advisory organization pursuant to Chapter 6.1 (commencing with Section 1780.50).

(2) Notwithstanding paragraph (1), a surplus lines advisory organization shall be required to comply with subdivision (i) of Section 791.13, Section 791.24, Section 791.32, and Section 791.33, and, with respect to those provisions, shall be subject to the powers of the commissioner set forth in Sections 791.14 to 791.19, inclusive.

(i) (1) The obligations imposed by Sections 791.06, 791.08, 791.09, and 791.099 do not apply to a producer that processes or shares a consumer’s personal information in response to a consumer’s request to solicit, obtain, or place insurance coverage on behalf of the consumer, or on behalf of another licensee transacting insurance on behalf of the consumer, or for purposes of renewal, replacement, remarketing, servicing, coverage recommendations, or administration of insurance coverage, provided that all of the following are true:

(A) The producer does not process or share personal information for purposes unrelated to those identified in paragraph (1) or an insurance transaction or transactions.

(B) The producer discloses personal information only to a licensee for purposes of soliciting, obtaining, or placing the insurance coverage requested by the consumer or for any of the purposes identified in paragraph (1) as it pertains to the consumer’s insurance needs.

(C) Upon the consumer’s request, within a reasonable time not more than 21 days, the producer discloses to the consumer the identity of all licensees with which the producer has shared personal information.

(D) The producer does not process, share, or retain the consumer’s personal information after issuing the coverage requested by the consumer, except as reasonably necessary for purposes of servicing the policy or consumer’s account, regulatory compliance, defense of legal claims, record retention required by law, or purposes stated in paragraph (1).

(E) The producer provides clear and conspicuous notice within a reasonable time not more than 21 days, after the consumer first contacts the producer about soliciting, obtaining, or placing insurance coverage or for any of the purposes in paragraph (1) as it pertains to their insurance needs. The notice shall do all of the following:

(i) Confirm that the consumer has requested the producer to undertake the actions and services necessary to fulfill the consumer’s request for assistance in obtaining insurance coverage.

(ii) Confirm that the consumer has provided personal information for the purpose of enabling the producer to fulfill the consumer’s request for assistance in obtaining insurance coverage.

(iii) Disclose that the insurance producer may share the consumer’s personal information with other licensees or third-party service providers to the extent necessary to fulfill the assistance requested by the consumer or service the consumer’s account.

(iv) Provide that the producer will not disclose or share the personal information provided by the consumer for any purpose not previously authorized by the consumer.

(v) Provide that, except as required by law or regulation, the producer shall maintain the minimum personal information necessary to service the consumer’s account and to provide billing, claims management, or other administrative services necessary to serve the consumer’s insurance needs.

(vi) Provide that the privacy notice will remain in effect for as long as there is a business relationship between the producer and the consumer, or until the producer’s privacy practices change, in which case the producer shall provide the consumer with an updated notice.

(vii) Disclose to the consumer the right to access and correct personal information that the insurance producer collects about the consumer.

(F) The insurer with which the producer has placed the consumer’s insurance complies with the requirements of Sections 791.08 and 791.09, limited to the information provided by the producer and information collected or obtained by the insurer, on the producer’s behalf, including complying with provisions related to substitute performance in subdivision (f) of Section 791.099 and the producer complies with Sections 791.08 and 791.09 to the extent that it collects or retains personal information other than the information provided to the insurer.

(G) To the extent the producer engages in any processing or sharing of personal information described in subparagraph (B) of paragraph (3) of subdivision (a) or subdivision (b) of Section 791.13, or engages in any sharing subject to the rights described in Section 6802(b)(1) of Title 15 of the United States Code, the producer provides consumers a reasonable means to indicate their election to opt out of that processing or sharing.

(2) The obligations imposed by Sections 791.04, 791.045, and 791.046 are satisfied with respect to a producer if the insurer with whom the producer places the consumer’s insurance complies with Sections 791.04, 791.045, and 791.046, and subdivision (f) of Section 791.099. A producer may reasonably rely upon the insurer’s representation of compliance with these sections and an insurer’s failure to comply shall not constitute a violation by the producer, unless the producer knowingly prevents or interferes with the insurer’s compliance with this article.

(3) A licensee’s failure to comply with Section 791.04, 791.045, 791.046, 791.08, or 791.09, shall not constitute a violation by the licensee to the extent that failure is caused by the producer’s inaccurate, incomplete, or untimely transmission of consumer information or consumer requests to the licensee, or by the producer’s failure to maintain personal information in a manner reasonably accessible to the licensee.

(j) A wholesale intermediary:

(1) May satisfy Sections 791.08 and 791.09 provided that the insurer with which the wholesale intermediary has placed the consumer’s insurance complies with the requirements of Sections 791.08 and 791.09, and complies with provisions related to substitute performance in subdivision (f) of Section 791.099.

(2) To the extent the wholesale intermediary engages in any processing or sharing of personal information described in subparagraph (B) of paragraph (3) of subdivision (a) or subdivision (b) of Section 791.13, or engages in any sharing subject to the rights described in Section 6802(b)(1) of Title 15 of the United States Code, the wholesale intermediary provides consumers a reasonable means to indicate their election to opt out of that processing or sharing.

(3) Shall comply with subdivision (i) of Section 791.13 and Sections 791.24, 791.32, and 791.33.

(4) Shall, with respect to this subdivision, be subject to the powers of the commissioner set forth in Sections 791.14 to 791.19, inclusive.

(h)

(k) No later than January 1, 2029, the commissioner shall adopt regulations applying the provisions of Sections 791.13 791.04, 791.045, 791.046, 791.13, 791.19, and 791.24 to producers. Producers shall not be subject to the requirements of these sections prior to the adoption of regulations by the commissioner, provided, however, that no producer shall disclose personal information in violation of Section 791.13. Producers shall fully comply with the provisions of Sections 791.13 and 791.24 on or before July 1, 2029, or upon the adoption of regulations pursuant to this subdivision, whichever is first. The regulations shall include the development of sample notices, forms, and compliance documents, consistent with the requirements of subdivision (c) of Section 791.40. In regard to Sections 791.04, 791.045, 791.24, and 791.046, when substitute performance in subdivision (f) of Section 791.099 is not applicable, the commissioner shall consider, in addition to other factors, the scale and complexity of the licensee’s operations.

791.02.

As used in this article:

(a) “Address of record” means either of the following:

(1) A consumer’s last known United States Postal Service (USPS) residential mailing address as shown in the licensee’s, surplus line insurer’s, reinsurer’s, or third-party service provider’s records.

(2) A consumer’s last known email address as shown in the licensee’s, surplus line insurer’s, reinsurer’s, or third-party service provider’s records, if the consumer has consented to conducting business electronically pursuant to Title 2.5 (commencing with Section 1633.1) of Part 2 of Division 3 of the Civil Code.

(b) (1) “Adverse underwriting decision” means any of the following actions with respect to insurance transactions involving insurance coverage that is individually underwritten:

(A) A declination of insurance coverage.

(B) A termination of insurance coverage.

(C) Failure of a producer to apply for insurance coverage with a specific insurer that the producer represents and that is requested by a consumer.

(D) In the case of a property or casualty insurance coverage, either of the following:

(i) Placement by a licensee, surplus line insurer, or reinsurer of a risk with a residual market mechanism, with a surplus line insurer or with an insurer that provides insurance to other than preferred or standard risks, if in fact the placement is at other than a preferred or standard rate. An adverse underwriting decision, in case of placement with an insurer that provides insurance to other than preferred or standard risks, shall not include placement if the consumer did not specify or apply for placement as a preferred or standard risk or placement with a particular company insuring preferred or standard risks.

(ii) The charging of a higher rate on the basis of information that differs from that which the consumer furnished.

(E) In the case of life, health, or disability insurance coverage, an offer to insure at higher than standard rates.

(2) Notwithstanding paragraph (1), none of the following actions shall be considered adverse underwriting decisions, but the licensee, surplus line insurer, or reinsurer responsible for their occurrence shall nevertheless provide the consumer with the specific reason or reasons for their occurrence:

(A) The termination of an individual policy form on a class or statewide basis.

(B) A declination of insurance coverage solely because coverage is not available on a class or statewide basis.

(C) The rescission of a policy.

(c) “Affiliate” or “affiliated” has the same meaning as defined in subdivision (a) of Section 1215. “Control” as used in that definition has the same meaning as defined in subdivision (d) of Section 1215.

(d) “Aggregated consumer information” means information that relates to a group or category of consumers, that is deidentified, and that is not linked or reasonably linkable to a consumer, household, or specific electronic device.

(e) “Applicant” means any consumer who seeks to contract for insurance coverage primarily for personal, family, or household purposes, other than a person seeking group insurance that is not individually underwritten.

(f) “Biometric information” means an individual’s physiological, biological, or behavioral characteristics that can be used, singly or in combination with other identifying information, to establish a consumer’s identity. Biometric information may include an iris or retina scan, fingerprint, face, hand, palm, ear, or vein pattern, or voiceprint, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, or any other means to identify an individual.

(g) “Clear and conspicuous notice” means a notice that is reasonably understandable and designed to call attention to the nature and significance of its contents.

(h) “Collect” or “collecting” means buying, renting, licensing, gathering, obtaining, receiving, or accessing a consumer’s personal information.

(i) “Commissioner” means the Insurance Commissioner.

(j) “Consent” means a freely given, specific, informed, and unambiguous indication of the consumer’s wishes by which the consumer, or the consumer’s legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing or sharing of personal information relating to the consumer for a narrowly defined particular purpose.

(k) “Consumer” means an individual who is a resident of California whose personal information is processed or shared or has been processed or shared in the business of insurance, including a current or former applicant, claimant, beneficiary, policyholder, insured, participant, annuitant, employee, or certificate holder. “Consumer” includes an individual’s legal representative.

(1) A consumer is in an ongoing business relationship with a licensee, surplus line insurer, or reinsurer if there is a continuing relationship between the consumer and the licensee, surplus line insurer, or reinsurer based on one or more insurance transactions provided by the licensee, surplus line insurer, or reinsurer.

(2) A consumer is a resident of this state if the consumer’s last known residential mailing address, as shown in the records of the licensee, surplus line insurer, or reinsurer, is in this state unless the last known address of record is deemed invalid pursuant to subdivision (h) of Section 791.046.

(3) “Consumer” does not include an individual in the course of the individual acting as a job applicant to, or an employee, director, officer, or independent contractor of, a licensee, surplus line insurer, reinsurer, or third-party service provider, to the extent that the individual’s personal information is processed or shared by the licensee, surplus line insurer, reinsurer, or third-party service provider solely within the context of the individual’s role or former role as a job applicant to, or an employee, director, officer, or an independent contractor of, that licensee, surplus line insurer, reinsurer, or third-party service provider.

(l) “Consumer report” has the same meaning as defined in Section 603(d) of the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681a(d)).

(m) “Consumer reporting agency” has the same meaning as defined in Section 603(f) of the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681a(f)).

(n) “Cross marketing” means marketing of insurance or financial products or services by or on behalf of a licensee, to a consumer with which the licensee has an ongoing business relationship. “Cross marketing” includes an insurance or financial product or service, whether offered by the licensee or by a third party.

(o) “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice.

(p) “Declination of insurance coverage” means a denial, in whole or in part, by a licensee, surplus line insurer, or reinsurer of requested insurance coverage.

(q) (1) “Deidentified information” means information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, provided that a licensee, surplus line insurer, or reinsurer that processes or shares deidentified information meets all the following criteria:

(A) Has implemented reasonable technical safeguards and policies designed to prohibit reidentification of the consumer to whom the information may pertain.

(B) Has implemented reasonable business policies that specifically prohibit reidentification of the information.

(C) Has implemented business processes designed to prevent inadvertent release of deidentified information.

(D) Makes no attempt to reidentify the information.

(E) Does not retain any sensitive personal information.

(F) Other requirements pertaining to deidentification that the commissioner specifies in regulation.

(2) Deidentified information is not personal information.

(r) “Delete” and “deleted” means to remove or destroy personal information by permanently erasing the personal information on existing systems so that it is not maintained in human or machine-readable form and cannot be retrieved or utilized in that form.

(s) “Digital application” means an application that a consumer accesses and manipulates using a specialized electronic device, computer, mobile device, tablet, or other device with a display screen, including any add-ons or additional content for that application.

(t) “Financial product or service” means a product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to that financial activity pursuant to Section 4(k) of the federal Bank Holding Company Act of 1956 (12 U.S.C. Sec. 1843(k)). “Financial service” includes a financial institution’s evaluation or brokerage of information that the financial institution collects in connection with a request or an application from a consumer for a financial product or service.

(u) (1) Subject to paragraphs (2) and (3), “genetic information” means information about any of the following:

(A) An individual’s genetic tests.

(B) The genetic tests of family members of an individual.

(C) The manifestation of a disease or disorder in family members of an individual.

(D) A request for, or receipt of, genetic services, or participation in clinical research that includes genetic services, by an individual or a family member of the individual.

(2) “Genetic information” concerning an individual or family member of an individual includes the genetic information of both of the following:

(A) A fetus carried by the individual or family member who is pregnant.

(B) An embryo legally held by an individual or family member utilizing an assisted reproductive technology.

(3) “Genetic information” does not include information about the sex or age of any individual.

(v) “Health care” means both of the following:

(1) Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, services, procedures, tests, or counseling that does either of the following:

(A) Relates to the physical, mental, or behavioral condition of an individual.

(B) Affects the structure or function of the human body or any part of the human body, including the banking of blood, sperm, organs, or any other tissue.

(2) Prescribing, dispensing, or furnishing drugs or biologicals, medical devices, or health care equipment and supplies to an individual.

(w) “Health care provider” means a health care provider, as defined by Section 160.103 of Title 45 of the Code of Federal Regulations, who meets the licensing, certification, or other accreditation required by state law to provide health care.

(x) “Health information” means a consumer’s information or data, except age or gender, created by or derived from a health care provider or the consumer that relates to any of the following:

(1) The past, present, or future physical, mental, or behavioral health or condition of an individual.

(2) The genetic information of an individual.

(3) The provision of health care to an individual.

(4) Payment for the provision of health care to an individual.

(y) (1) “Insurance support organization” means a person who regularly engages in the processing or sharing of a consumer’s information for the primary purpose of providing licensees, surplus line insurers, reinsurers, or third-party service providers with information in connection with the business of insurance, including any of the following actions:

(A) The furnishing of consumer reports or investigative consumer reports to a licensee, surplus line insurer, reinsurer, or third-party service provider, or other insurance support organization for use in connection with an insurance transaction.

(B) The processing or sharing of personal information from licensees, surplus line insurers, reinsurers, third-party service providers, or other insurance support organizations for the purpose of detecting or preventing fraud, material misrepresentation, or material nondisclosure in connection with the business of insurance.

(C) The processing or sharing of personal information in connection with an insurance transaction that may have an application in transactions or activities other than insurance transactions.

(2) Notwithstanding paragraph (1), “insurance support organization” does not include producers, government institutions, insurers, health care providers, reinsurers, third-party service providers, or businesses subject to Section 1798.99.82 or 1798.99.86 of the Civil Code. However, “insurance support organizations” shall otherwise be subject to the requirements and exceptions pertaining to third-party service providers pursuant to this article, including provisions related to substitute performance.

(z) (1) “Insurance transaction” means any transaction or service by or on behalf of a licensee, surplus line insurer, reinsurer, or their affiliates related to any of the following:

(A) The underwriting or the determination of a consumer’s eligibility for or the amount of insurance coverage, rate, benefit, payment, or claim settlement, and the placing, issuance, renewal, reinstatement, cancellation, or nonrenewal of a policy.

(B) Licensees, surplus line insurers, reinsurers, or third-party service providers performing services, including maintaining or servicing accounts, providing customer service, processing requests or transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or any similar services.

(C) Provision of “value-added services or benefits” relating to financial products or services.

(D) An actuarial study related to any of the following:

(i) Rating or risk management.

(ii) Modeling based on claims data.

(iii) Use of geocoded and structure information in connection with catastrophe-modeling activities.

(iv) Academic uses subject to a research university internal review board or privacy board approval that requires use of a process that follows confidentiality best practices and if a contract agreeing to that protection has been executed.

(v) Pricing model development.

(vi) Customer lifetime value modeling.

(vii) Underwriting algorithm testing.

(viii) Product development.

(E) Compliance with legal, regulatory, accounting, tax, audit, reporting, data call, solvency, market conduct, complaint handling, producer oversight, reinsurance, or records retention obligations.

(F) Claims intake, investigation, adjustment, administration, payment, subrogation, salvage, litigation management, dispute resolution, and recovery activities.

(G) Detection or prevention of insurance fraud, crime related to insurance claims, material misrepresentation, or material nondisclosure, including reasonable maintenance of records for those purposes.

(H) Providing personal information to statistical agents, reinsurers, or insurance support organizations, provided that the personal information is only processed or shared for the purposes for which it is disclosed.

(I) Providing absence management and workplace accommodation services, including, among other similar services, employer leave policy administration, federal Family and Medical Leave Act of 1993 (29 U.S.C. Sec. 2601 et seq.) advising, and federal Americans with Disabilities Act of 1990 (42 U.S.C. Sec. 12101 et seq.) guidance.

(J) Information protection and cybersecurity.

(K) The short-term transient collection of personal information through consumer interaction with the licensee’s, surplus line insurer’s, or reinsurer’s internet website, online platform, or digital application, provided that the consumer’s personal information is only processed or shared for analytics relating to functionality of the licensee’s, surplus line insurer’s, or reinsurer’s internet website, online platform, or digital application.

(L) Disclosure to an insurance support organization or third-party service provider for the purposes of actuarial experience studies, industry benchmarking, loss modeling, market research, or other insurance industry research, if all of the following conditions are met:

(i) The receiving organization implements technical and contractual controls to aggregate and deidentify individual records before publication or disclosure to another party.

(ii) The deidentified aggregate results are used solely for insurance industry research purposes.

(iii) A consumer is not identified in a report or information published or disclosed by the receiving organization.

(iv) Individual consumer records are not retained by the receiving organization beyond the period necessary to produce the deidentified aggregate outputs and are not further disclosed by the receiving organization.

(2) “Insurance transaction” does not include processing or sharing related to marketing or research activities.

(aa) (1) “Insurer” means any of the following:

(A) A corporation, association, or partnership required to be licensed by the commissioner to assume risk or otherwise authorized to assume risk, including a reciprocal exchange, interinsurer, fraternal benefit society, or multiple-employer welfare arrangement.

(B) A self-funded plan subject to regulation by the commissioner.

(C) A preferred provider organization administrator.

(2) “Insurer” does not include producers, insurance support organizations, foreign-domiciled risk retention groups, reinsurers, or surplus line insurers.

(ab) “Investigative consumer report” means a consumer report or portion thereof in which information about a natural person’s character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with the person’s neighbors, friends, associates, acquaintances, or others who may have knowledge concerning those items of information. However, that information does not include specific factual information on a consumer’s credit record obtained directly from a creditor of the consumer or from a consumer reporting agency when the information was obtained directly from a creditor of the consumer or from the consumer.

(ac) “Joint marketing” means marketing by or on behalf of a licensee of cobranded financial products or services offered by a licensee and a financial institution.

(ad) (1) “Licensee” means a person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to this code, including both of the following:

(A) An insurer.

(B) A producer.

(2) “Licensee” does not include a purchasing group or a risk retention group chartered and licensed in a state other than this state or a licensee that is acting as an assuming insurer that is domiciled in another state or jurisdiction, and does not include a surplus line insurer domiciled in a state other than this state or another country.

(ae) “Neural data” means information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.

(af) “Nonadmitted insurer” means an insurer that has not been granted a certificate of authority or is not otherwise authorized by the commissioner to transact the business of insurance in this state.

(ag) “Person” means an individual, corporation, association, partnership, limited liability company, or other legal entity. “Person” does not include a governmental entity.

(ah) “Personal information” means information processed or shared in the business of insurance that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

(1) “Personal information” includes any of the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:

(A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

(B) Personal information described in subdivision (e) of Section 1798.80 of the Civil Code.

(C) Characteristics of protected classifications pursuant to state or federal law.

(D) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

(E) Biometric information.

(F) Internet or other electronic network activity information, including browsing history, search history, and information regarding a consumer’s interaction with an internet website, online platform, digital application, or advertisement.

(G) Geolocation data.

(H) Auditory, electronic, visual, thermal, olfactory, or other sensory information.

(I) Professional or employment-related information.

(J) Education information that is not publicly available, personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g) and related regulations (Part 99 (commencing with Section 99.1) of Title 34 of the Code of Federal Regulations).

(K) Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, character, habits, avocations, finances, occupation, general reputation, credit, health, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

(L) Sensitive personal information.

(2) “Personal information” does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.

(3) “Personal information” can exist in various formats, including all of the following:

(A) Physical formats, including paper documents, printed images, phonographic records, or magnetic tapes.

(B) Digital formats, including text, image, audio, or video files.

(C) Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.

(4) “Personal information” does not include aggregated consumer information, deidentified information, or publicly available information.

(ai) “Pretext interview” means an interview whereby a person, in an attempt to obtain information about a natural person, performs one or more of the following acts:

(1) Pretends to be someone they are not.

(2) Pretends to represent a person they are not in fact representing.

(3) Misrepresents the true purpose of the interview.

(4) Refuses to identify who they are upon request.

(aj) “Privileged information” means personal information that is processed or shared in connection with or in reasonable anticipation of a claim for insurance benefits or civil or criminal proceeding involving a consumer, until the claim or proceeding is finalized. However, information otherwise meeting the requirements of this article shall nevertheless be considered “personal information” under this article if it is disclosed in violation of this article.

(ak) To “process,” “processing,” or a “process” means any operation or set of operations performed by a licensee, reinsurer, surplus line insurer, or third-party service provider, by manual or automated means, on the personal information or sets of personal information of a consumer, including the collection, use, sharing, storage, disclosure, analysis, deletion, retention, or modification of personal information. As used in this article, “process” does not include “share.”

(al) “Producer” means a person licensed pursuant to Chapter 5 (commencing with Section 1621), Chapter 5A (commencing with Section 1759), Chapter 6 (commencing with Section 1760), Chapter 7 (commencing with Section 1800), or Chapter 8 (commencing with Section 1831).

(am) (1) “Publicly available” means information about a consumer that a licensee, surplus line insurer, reinsurer, insurance support organization, or third-party service provider has a reasonable basis to believe is lawfully made available from any of the following:

(A) Federal, state, or local government records.

(B) Widely distributed media.

(C) Disclosures to the general public that are required to be made pursuant to federal, state, or local law.

(2) “Publicly available” does not mean biometric information collected about a consumer without the consumer’s knowledge.

(an) “Reinsurer” means a legal entity primarily engaged in assuming all or part of the risk associated with existing insurance policies originally underwritten by insurers, or a legal entity known as a retrocessionaire that accepts all or part of one or more reinsurance policies issued by a reinsurer.

(ao) “Research activities” means systemic investigation, including development, testing, and evaluation, designed to develop or contribute to generalizable knowledge if there is sharing of personal information with nonaffiliated third parties.

(ap) “Residual market mechanism” means the California FAIR Plan Association established pursuant to Chapter 9 (commencing with Section 10090) of Part 1 of Division 2 and the assigned risk plan established pursuant to Article 4 (commencing with Section 11620) of Chapter 1 of Part 3 of Division 2.

(aq) “Retain,” “retention,” or “retaining” means storing or archiving personal information that is in the continuous possession, use, or control of a licensee, surplus line insurer, reinsurer, or third-party service provider.

(ar) “Sale,” “sell,” or “selling” means the exchange of personal information to a third party for monetary or other valuable consideration. “Sale” of personal information does not include any of the following sharing of personal information:

(1) Disclosing information to a third-party service provider for the purpose of or in support of providing an insurance or financial product or service requested by the consumer.

(2) Sharing with or receiving information from an insurance support organization, statistical agent, or reinsurer in connection with an insurance transaction.

(3) Providing or disclosing information to an affiliate or in connection with a joint marketing activity as permitted by this article.

(4) Transferring personal information to a third party as an asset pursuant to a merger, acquisition, bankruptcy, or other transaction, or a proposed merger, acquisition, bankruptcy, or other transaction in which the party assumes control of all or part of the licensee’s, surplus line insurer’s, or reinsurer’s assets.

(5) Disclosure pursuant to a consumer’s direction to the licensee, surplus line insurer, reinsurer, or third-party service provider to disclose personal information to, or interact with, one or more third parties.

(as) (1) “Sensitive personal information” means personal information that reveals any of the following information about a consumer:

(A) Social security, driver’s license, state identification card, or passport number.

(B) Account login, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.

(C) Precise geolocation.

(D) Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.

(E) Content of personal mail, personal email, personal text messages, or personal voice or video communications, unless the person in possession is the intended recipient of the communication.

(F) Genetic or neural data.

(G) Information about the consumer’s sex life or sexual orientation.

(H) Health information.

(I) Biometric information.

(J) Additional items specified by the commissioner in regulation.

(2) Sensitive personal information that is publicly available shall not be considered sensitive personal information or personal information.

(at) (1) “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by a licensee, surplus line insurer, reinsurer, or third-party service provider to a third party.

(2) A licensee, surplus line insurer, reinsurer, or third-party service provider does not share personal information when any of the following occurs:

(A) Disclosure pursuant to a consumer’s direction to the licensee, surplus line insurer, reinsurer, or third-party service provider to disclose personal information to, or interact with, one or more third parties, including a request by a consumer to disclose the consumer’s records to an attorney or health care provider. A licensee, surplus line insurer, reinsurer, or third-party service provider shall not utilize this subparagraph to process or disclose personal information in a manner otherwise prohibited by this article, or to circumvent a requirement to obtain a consumer’s consent for processing or sharing of personal information.

(B) The licensee, surplus line insurer, reinsurer, or third-party service provider uses or shares an identifier for a consumer who has exercised an opt-out right pursuant to this article for the purpose of alerting persons that the consumer has exercised that right.

(C) The licensee, surplus line insurer, reinsurer, or third-party service provider transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, if that information is processed or shared consistently with this article. If a third party materially alters how it processes or shares the personal information of a consumer in a manner that is materially inconsistent with the notice provided at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their consent consistently with this article. This subparagraph does not authorize a person to make material, retroactive privacy policy changes or make other changes to a privacy policy in a manner that would violate any provision of this code or the Unfair Practices Act (Chapter 4 (commencing with Section 17000) of Part 2 of Division 7 of the Business and Professions Code).

(au) “Statistical agent” means an entity that has been designated by the commissioner to collect statistics from licensees, surplus line insurers, or reinsurers, and provide reports developed from those statistics to the commissioner for the purpose of fulfilling the statistical reporting obligations of those licensees, surplus line insurers, or reinsurers.

(av) “Surplus line insurer” means a nonadmitted insurer that accepts business placed through a licensed surplus line broker pursuant to Chapter 6 (commencing with Section 1760).

(aw) “Termination of insurance coverage” or “termination of an insurance policy” means either a cancellation or nonrenewal of an insurance policy, in whole or in part, for any reason other than the failure to pay a premium as required by the policy.

(ax) “Third-party service provider” means a person, including directors, officers, employees, and agents thereof, that contracts with a licensee, surplus line insurer, or reinsurer to provide services to the licensee, surplus line insurer, or reinsurer, to the extent that it processes, shares, or otherwise is permitted access to personal information through its provision of services to the licensee, surplus line insurer, or reinsurer. “Third-party service provider” includes insurance support organizations and a person with whom a licensee, surplus line insurer, or reinsurer does not have a continuing business relationship and does not have a contract, but may have to share personal or publicly available information in connection with an insurance transaction pursuant to subdivision (c) of Section 791.24. “Third-party service provider” does not include governmental entities, licensees, affiliates of licensees, surplus line insurers, reinsurers, businesses subject to Section 1798.99.82 or 1798.99.86 of the Civil Code, or providers of information technology infrastructure or software services that process and share personal information at the direction of a licensee, surplus line insurer, reinsurer, or third-party service provider.

(ay) “Value-added service or benefit” means a product or service that meets both of the following criteria:

(1) Relates to insurance coverage applied for or purchased by a consumer.

(2) Is primarily designed to satisfy one or more of the following:

(A) Provide loss mitigation or loss control services or products designed to mitigate risks related to the insurance requested by or offered to a consumer.

(B) Reduce claim costs or claim settlement costs.

(C) Provide education about liability risks or risk of loss to persons or property.

(D) Monitor or assess risk, identify sources of risk, or develop strategies for eliminating or reducing risk.

(E) Enhance the health of the consumer, including care coordination.

(F) Enhance financial wellness of the consumer through education or financial planning services.

(G) Provide post-loss services.

(H) Incentivize behavioral changes to improve the health or reduce the risk of death or disability of a policyholder, potential policyholder, certificate holder, potential certificate holder, insured, potential insured, or applicant.

(I) Assist in the administration of employee or retiree benefit insurance coverage.

(az) “Verifiable request” means a request that the licensee, surplus line insurer, reinsurer, or third-party service provider can reasonably verify, using commercially reasonable methods, made by the consumer whose personal information is the subject of the request or by a person authorized by the consumer to act on the consumer’s behalf.

(ba) “Wholesale intermediary” means a producer that accepts insurance business to be placed with an insurer or a nonadmitted insurer from other licensees, but does not interact directly with or originate insurance business with consumers.

(ba)

(bb) “Written” or “in writing” includes a writing, including electronic communications subject to the Uniform Electronic Transactions Act (Title 2.5 (commencing with Section 1633.1) of Part 2 of Division 3 of the Civil Code) or the requirements of Section 38.6.

791.03.

A licensee, surplus line insurer, reinsurer, third-party service provider, or insurance support organization shall not use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction. However, a pretext interview may be undertaken to obtain information from a person or institution that does not have a generally or statutorily recognized privileged relationship with the person to whom the information relates for the purpose of investigating a claim for which there is a reasonable basis for suspecting criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with a claim.

791.04.

(a) (1) A licensee, surplus line insurer, reinsurer, or third-party service provider shall provide a clear and conspicuous privacy notice to a consumer presented as a stand-alone document within a reasonable time not to exceed 21 calendar days after the licensee, directly or through a third-party service provider, first collects, processes, or shares the consumer’s personal information, except that a privacy notice shall not unreasonably be delayed if establishing the consumer relationship is not at the consumer’s election or upon agreement of the consumer in order to expedite the insurance transaction.

(2) Notwithstanding paragraph (1), a privacy notice shall not be required in any of the following circumstances:

(A) From a reinsurer, in connection with the provision of reinsurance, a third-party service provider, or a surplus line insurer, if the reinsurer, third-party service provider, or surplus line insurer has posted a privacy notice on its internet website.

(B) To individual plan participants of an employee benefit plan, if a privacy notice has been provided to the employer.

(C) To a third-party natural person, including a beneficiary, family or household member, or emergency contact, whose personal information is collected directly from a consumer in connection with an insurance transaction, if the licensee does not process or share the third-party natural person’s personal information for any purpose unrelated to the insurance transaction.

(D) By an employee, representative, or appointee of a licensee, surplus line insurer, or reinsurer, who is also a licensee, to the extent that the processing or sharing of personal information is consistent with the privacy practices of the employer, represented, or appointing licensee, surplus line insurer, or reinsurer and that licensee, surplus line insurer, or reinsurer provides the privacy notice required pursuant to this section.

(E) By an insurer or surplus line insurer, with respect to personal information received from a producer in connection with an application for insurance, provided that both of the following requirements are met:

(i) The application does not result in the issuance of a policy or establishment of an ongoing business relationship.

(ii) The insurer or surplus line insurer does not process, retain, or disclose the personal information for any further purpose.

(F) By a wholesale intermediary that accepts insurance business from an originating licensee and does not interact directly with the consumer, provided that the following requirements are met:

(i) The privacy notice required pursuant to this section is provided by the insurer when the consumer insurance is placed.

(ii) The wholesale intermediary has posted a clear and conspicuous privacy notice on its internet website.

(3) A privacy notice meeting the requirements of this article shall be provided to a consumer with whom a licensee has an ongoing business relationship and whose personal or publicly available information has been processed or shared before the effective date of this article upon renewal or reinstatement of the consumer’s policy, or upon the processing or sharing of the consumer’s information for any other purpose, if the consumer has not already been provided a privacy notice meeting the requirements of this article.

(4) A licensee, surplus line insurer, or reinsurer shall provide an updated privacy notice to each consumer with whom the licensee, surplus line insurer, or reinsurer has an ongoing business relationship when the privacy practices of the licensee, surplus line insurer, or reinsurer materially change, or the substantive content of the preceding privacy notice is no longer materially accurate. The licensee, surplus line insurer, or reinsurer shall do both of the following:

(A) Conspicuously identify in its updated privacy notice any changes in its privacy practices.

(B) Provide a third-party claimant or beneficiary an updated privacy notice if there are changes in the licensee’s, surplus line insurer’s, or reinsurer’s privacy practices during a claim involving the claimant or beneficiary.

(5) Each version of a licensee’s, surplus line insurer’s, or reinsurer’s privacy notice shall contain a revision date that shall remain on the privacy notice until the licensee, surplus line insurer, or reinsurer revises the privacy notice pursuant to paragraph (4). The updated privacy notice shall specify the date the privacy notice was revised.

(6) If the licensee’s, surplus line insurer’s, or reinsurer’s privacy practices change, the licensee, surplus line insurer, or reinsurer remains bound by the terms of the most recent privacy notice it has given a consumer, until a revised privacy notice has been given.

(b) The notice required by subdivision (a) shall be in writing and shall state all of the following:

(1) If personal information has been or may be collected from sources other than the consumer, and if that information is collected by the licensee, surplus line insurer, or reinsurer or by third-party service providers.

(2) The categories of the consumer’s personal information that the licensee, surplus line insurer, or reinsurer or their third-party service providers have or may process, process or share, including examples of the information in each category.

(3) The sources that have been used or may be used by the licensee, surplus line insurer, or reinsurer or their third-party service providers to collect the consumer’s personal information.

(4) The purposes for which the licensee, surplus line insurer, or reinsurer or their third-party service providers process or share the consumer’s personal information.

(5) That the licensee, surplus line insurer, or reinsurer and their third-party service providers have not and will not sell the consumer’s personal information as that term is defined in this article. However, the licensee, surplus line insurer, or reinsurer and their third-party service providers may share the consumer’s personal information for purposes of the insurance transaction, or with the consent of the consumer. if the consumer has provided consent or has not opted out of sharing consistent with this article.

(6) The categories of persons with whom the licensee, surplus line insurer, or reinsurer or their third-party service providers have shared, or may share, the consumer’s personal information.

(7) If personal information has been, or may routinely be, shared with a person residing in a country outside of the United States and its territories, a list of those countries.

(8) That the consumer has the right to opt out of sharing for any of the purposes stated in paragraph (3) of subdivision (a) of Section 791.13, along with a description of the categories of each of those purposes, and that a licensee, surplus line insurer, or reinsurer may share the consumer’s personal information in connection with these activities, unless the consumer has opted out of that sharing.

(9) That the consumer’s prior, opt-in consent is required for the licensee, surplus line insurer, or reinsurer or their third-party service providers to share the consumer’s personal information for most purposes unrelated to the insurance transaction, including processing or sharing for any of the purposes stated in paragraph (2) of subdivision (a) of Section 791.13, along with a description of the categories of each of those purposes.

(10) A description of the rights of the consumer to access, correct, amend, or delete personal information about the consumer established under Sections 791.08 and 791.09 and the instructions for exercising those rights, including information about accessing the consumer’s right pursuant to Section 791.099.

(11) A statement of the rights of the consumer to receive notice regarding an adverse underwriting decision, including the reasons for the adverse underwriting decision, the specific items of information underlying the adverse underwriting decision, and the sources of that information.

(12) A statement of the rights of nonretaliation established pursuant to Section 791.35.

(13) Additional items that the commissioner specifies in regulation.

(c) If the licensee, surplus line insurer, reinsurer, or third-party service provider shares a consumer’s personal information for purposes unrelated to the insurance transaction, in addition to the information required by subdivision (b), all of the following information shall be included in the privacy notice:

(1) A statement that the consumer may, but is not required to, provide consent to the sharing of the consumer’s personal information for purposes unrelated to the insurance transaction. information, consistent with the consumer’s rights pursuant to Section 791.13.

(2) A description of the reasonable means by which consumers may indicate consent for any one or more of those purposes.

(3) That once the consumer consents to the sharing, the consumer may revoke the consent at any time and that the licensee, surplus line insurer, or reinsurer will no longer share the consumer’s personal information for those purposes.

(d) The obligations imposed by this section upon a licensee, surplus line insurer, reinsurer, or third-party service provider may be satisfied by another licensee, surplus line insurer, reinsurer, or third-party service provider, consistent with the requirements of subdivision (f) of Section 791.099.

791.045.

(a) (1) In addition to the notice required by Section 791.04, a licensee shall provide a clear and conspicuous notice to a consumer that accurately reflects its privacy policies and practices not less than annually during the continuation of an ongoing business relationship. For purposes of this section, “annually” means at least once in any period of 12 consecutive months during which an ongoing business relationship exists. A licensee may define the period of 12 consecutive months, but shall apply it to the consumer on a consistent basis.

(2) A notice required pursuant to this section shall comply with the requirements of Section 791.04.

(b) (1) The notices required pursuant to Section 791.04 and this section may be combined into a single notice or provided as separate notices, as long as the requirements of Section 791.04 and this section are met.

(2) If the licensee uses a separate, standard privacy notice in addition to the notices required pursuant to Section 791.04 and this section, the notices required pursuant to Section 791.04 and this section shall clearly state that any rights a consumer may have as described in these notices are not limited by the standard privacy notice that the licensee also uses.

(c) A licensee shall be deemed to be in compliance with this section if all of the following conditions are met:

(1) The licensee does not share health information or personal, sensitive, or privileged information pursuant to paragraphs (2) and (3) of subdivision (a) of Section 791.13.

(2) The licensee additionally provides, as part of a notice pursuant to this section, all of the following:

(A) The internet website address of the licensee’s complete privacy notice that complies with subdivision (a).

(B) All of the following statements:

(i) Personal information may be collected from persons other than the consumer or consumers proposed for coverage.

(ii) The personal information described in clause (i) as well as any other personal or privileged information subsequently collected by the licensee may, in certain circumstances, be disclosed to third parties without authorization from the consumer.

(iii) The notice prescribed in Section 791.04 will be furnished to the consumer upon request.

(C) A description of each of the following rights in a clear and conspicuous manner:

(i) The right to submit a written request to access, correct, amend, or delete the consumer’s personal information and the manner in which the right may be exercised, including the contact information and the mailing address, internet website address, or both, where the consumer may submit a request.

(ii) The right to receive a response within 30 business days of the consumer submitting a request to access, correct, amend, or delete their personal information.

(iii) If the licensee refuses the consumer’s request, the right to file a statement regarding what the consumer believes to be accurate and fair information and why the consumer disagrees with the licensee’s refusal.

(iv) The consumer’s right to opt out of the sharing of personal information pursuant to paragraph (3) of subdivision (a) of Section 791.13.

(v) The consumer’s right to provide prior, opt-in consent, before a licensee may share personal information pursuant to paragraph (2) of subdivision (a) of Section 791.13.

(vi) That the consumer, after having provided prior opt-in consent, may revoke that consent or, having opted out, may revoke the opt-out election.

(3) The licensee’s policies and practices about disclosing personal or privileged information have not changed from the previous notice provided pursuant to subdivision (a).

(d) A licensee is not required to provide a notice pursuant to subdivision (a) to a consumer with whom it no longer has an ongoing business relationship.

(e) The obligations imposed upon a licensee by this section may be satisfied by another licensee or third-party service provider, consistent with the requirements of subdivision (f) of Section 791.099.

(f) The notice required by subdivision (a) shall not be required to be provided to a third-party natural person, including a beneficiary, claimant, family or household member, or emergency contact, or to an individual plan participant of an employee benefit plan for whom notice has been provided to the employer, consistent with the exemptions available under paragraph (2) of subdivision (a) of Section 791.04.

791.046.

(a) A licensee, surplus line insurer, or reinsurer shall provide the notices required pursuant to this article so that the licensee, surplus line insurer, or reinsurer reasonably expects a consumer to receive actual notice in writing.

(b) A licensee, surplus line insurer, or reinsurer may reasonably expect that a consumer shall receive actual notice if the licensee, surplus line insurer, or reinsurer does one of the following:

(1) Hand delivers a printed copy of the notice to the consumer.

(2) Mails a printed copy of the notice to the address of record of the consumer separately, or in a policy, billing, or other written communication.

(3) With respect to a consumer who has agreed to conduct business electronically pursuant to the Uniform Electronic Transactions Act (Title 2.5 (commencing with Section 1633.1) of Part 2 of Division 3 of the Civil Code) and to use the licensee’s internet website, online platform, or digital application to access insurance products and services, either of the following, provided that the licensee, surplus line insurer, or reinsurer has complied with the requirements of Section 38.6:

(A) Emails the notice to the consumer’s email address of record.

(B) With respect to the privacy notice required pursuant to Section 791.04, emails an initial copy to the consumer’s email address of record, and posts on its internet website in a clear and conspicuous manner its current notices required pursuant to Sections 791.04 and 791.045. If the licensee, surplus line insurer, or reinsurer conducts business through an online platform or digital application, the current notices required pursuant to Sections 791.04 and 791.045 shall be easily accessible through the online platform or digital application.

(4) With respect to a consumer who interacts with a licensee’s, surplus line insurer’s, or reinsurer’s internet website, online platform, or digital application, but is not in an ongoing business relationship with the licensee, surplus line insurer, or reinsurer, provides the notice in compliance with the requirements of subdivision (f).

(c) A licensee, surplus line insurer, or reinsurer shall not reasonably expect that a consumer shall receive actual notice of its privacy practices if it does any of the following:

(1) Only posts a sign in its office or generally publishes advertisements of its privacy practices.

(2) Provides the notice electronically to a consumer who has not agreed to conduct business electronically with the licensee, other than as permitted by paragraph (4) of subdivision (b).

(3) Provides a notice solely by oral means, either in person, or over the telephone or other electronic device.

(4) Provides a notice that does not include all required elements of the notice content, or that requires the consumer to click a link, scan a code, or use any other secondary means to access any or all of the required notice content.

(5) Does not provide the notices required pursuant to this article so that the consumer is able to retain them or obtain them later in writing, either electronically or on paper.

(d) A licensee, surplus line insurer, or reinsurer, or third-party service provider of a licensee, surplus line insurer, or reinsurer, may provide a joint notice from the licensee, surplus line insurer, or reinsurer and one or more of its affiliates or third-party service providers, if the notice clearly identifies all parties covered by the notice and accurately reflects the licensee’s, surplus line insurer’s, or reinsurer’s, and each affiliate’s or third-party service provider’s, privacy practices with respect to the consumer.

(e) If two or more consumers jointly obtain a product or service in connection with an insurance transaction from a licensee, surplus line insurer, or reinsurer, the licensee, surplus line insurer, or reinsurer may satisfy the initial and updated notice requirements of Sections 791.04 and 791.045 by providing one notice to those consumers jointly.

(f) In addition to providing individual notices to consumers, a licensee, surplus line insurer, or reinsurer shall prominently post and make available the notices required pursuant to this article on its internet website home page, online platform, or digital application, if the licensee, surplus line insurer, or reinsurer maintains an internet website, online platform, or digital application. The licensee, surplus line insurer, or reinsurer shall design its internet website home page, online platform, or digital application so that all of the following are true:

(1) The notices are clearly and conspicuously available.

(2) The text or visual cues encourage scrolling down the page, if necessary, to view the entire notice and ensure that other elements on the internet website home page, online platform, or digital application, such as text, graphics, hyperlinks, or sound, do not distract attention from the notice.

(3) The notice is either of the following:

(A) Placed on a portion of the internet website home page, online platform, or digital application that consumers frequently access.

(B) Accessible using a clear and conspicuous link in an area that consumers frequently access, such as a page on which transactions are conducted, that connects directly to the notice and is labeled appropriately to convey the importance, nature, and relevance of the notice.

(g) Notices and communications to consumers shall be easy to read, understandable to consumers, and avoid technical or legal jargon.

(1) Notices required pursuant to this article shall meet all of the following criteria:

(A) Use a format that makes the notices readable, including on smaller screens, if applicable.

(B) Be available in the languages in which the licensee, surplus line insurer, or reinsurer in its ordinary course of business provides contracts, disclaimers, sale announcements, and other information to consumers.

(C) Be accessible to consumers with disabilities. For notices provided online, the licensee, surplus line insurer, or reinsurer shall follow current generally recognized industry standards, such as the Web Content Accessibility Guidelines, version 2.1, from the World Wide Web Consortium, or the most recent version. Licensees shall take reasonable steps to ensure that consumers with disabilities may access the notices in an alternative format.

(2) For digital applications, licensees, surplus line insurers, or reinsurers shall include their notices in a clear and conspicuous manner on the digital application’s platform page or download page. The notices may also be accessible through a link within the application, such as through the application’s settings menu.

(h) An address of record is invalid for purposes of this article if either of the following is true:

(1) United States Postal Service mail sent to that address by the licensee, surplus line insurer, or reinsurer has been returned as undeliverable and later attempts by the licensee, surplus line insurer, or reinsurer to obtain a current valid address for the consumer have been unsuccessful.

(2) Email addressed to the consumer’s email address in the licensee’s records is returned as undeliverable and later attempts by the licensee, surplus line insurer, or reinsurer to obtain a current valid email address for the consumer have been unsuccessful.

(i) The obligations imposed upon a licensee, surplus line insurer, or reinsurer by this section may be satisfied by another licensee, surplus line insurer, reinsurer, or third-party service provider, consistent with the requirements of subdivision (f) of Section 791.099.

791.05.

A licensee, surplus line insurer, or reinsurer shall clearly specify those questions designed to obtain information solely for marketing or research purposes from a consumer in connection with an insurance transaction.

791.06.

(a) A licensee, surplus line insurer, reinsurer, or third-party service provider shall not process or share a consumer’s personal information in a manner inconsistent with the consent provided by the consumer. consumer if consent is implicated pursuant to Section 791.13.

(1) To comply with the consent requirements of this article, a licensee, surplus line insurer, reinsurer, or third-party service provider shall use a method of capturing a consumer’s consent that is capable of being recorded or maintained for as long as the licensee, surplus line insurer, reinsurer, or third-party service provider has an ongoing business relationship with a consumer, or that the licensee, surplus line insurer, reinsurer, or third-party service provider is required to maintain the information pursuant to this article.

(2) For purposes of this article, consent is not established by any of the following means:

(A) Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing or sharing along with other, unrelated information.

(B) Hovering over, muting, pausing, or closing a given piece of content.

(C) Agreement obtained through use of dark patterns.

(b) Before processing or sharing a consumer’s personal information for a purpose for which the consumer’s prior, opt-in consent is required, or for which the consumer is entitled to opt out, a licensee, surplus line insurer, reinsurer, or third-party service provider shall provide a reasonable means for a consumer to provide prior, opt-in consent or opt out and maintain a written record of that prior, opt-in consent or opt-out election.

(1) A licensee, surplus line insurer, reinsurer, or third-party service provider shall provide the consumer with a means to separately indicate the consumer’s prior, opt-in consent or opt-out election, as applicable, with respect to sharing of personal information for any of the following reasons:

(A) Each purpose for which a consumer’s prior, opt-in consent is required pursuant to the requirements of paragraph (2) of subdivision (a) of Section 791.13.

(B) Each purpose for which a consumer is permitted to opt out pursuant to the requirements of paragraph (3) of subdivision (a) of Section 791.13.

(2) If two or more consumers jointly obtain an insurance or financial product or service from a licensee, surplus line insurer, reinsurer, or third-party service provider, the licensee, surplus line insurer, reinsurer, or third-party service provider may provide a single consent notice. Each of the joint consumers may indicate their own consent.

(3) If a consumer has a choice to provide prior consent pursuant to this article, the form used to obtain the consumer’s consent shall meet all of the following requirements:

(A) Is written in plain language.

(B) Is dated and, if the authorization related to the collection of personal information of a consumer with whom the licensee, surplus line insurer, or reinsurer has no ongoing business relationship, contains a termination date for the consent.

(C) Specifies the categories of persons with whom the consumer’s personal or privileged information will be shared consistent with the provisions of this article.

(D) Specifies the types of personal information the consumer is authorizing to be shared.

(E) Names the licensee, surplus line insurer, or reinsurer to whom the consumer is authorizing information to be disclosed. that the consumer is authorizing to collect personal information.

(F) Specifies the purposes for which the consumer is authorizing the processing or sharing of the consumer’s personal information.

(G) Advises the consumer that the consumer is entitled to receive a copy of the form containing the consumer’s consent.

(H) Explains that, pursuant to this article, the consumer will be protected from retaliation, discrimination, or disparate treatment, based on the consumer’s decision to provide or withhold consent.

(I) Includes additional information or elements specified by the commissioner in regulation.

(J) With respect to a consumer who has agreed to conduct business electronically pursuant to the Uniform Electronic Transactions Act (Title 2.5 (commencing with Section 1633.1) of Part 2 of Division 3 of the Civil Code), provided the licensee, surplus line insurer, reinsurer, or third-party service provider shall provide the form in compliance with the requirements of Section 38.6.

(c) A consumer does not have the ability to opt out of processing or sharing of personal information that is reasonably necessary for the execution of an insurance transaction or when the processing or sharing is legally required by this article or by any other law or regulation.

(d) A As applicable, a licensee’s, surplus line insurer’s, reinsurer’s, or third-party service provider’s processing or sharing of personal information shall comply with the consumer’s consent or opt-out election as soon as reasonably practicable after the licensee, surplus line insurer, or reinsurer is notified of the consumer’s consent or opt-out election or a change to the consumer’s consent. consent or opt-out election.

(e) A consumer who has consented to processing or sharing of personal information pursuant to this section may revoke that consent. A consumer shall be able to revoke consent in any manner by which the consumer is able to indicate consent. A licensee, surplus line insurer, reinsurer, or third-party service provider shall maintain a written record of the revocation.

(f) The consumer’s most recent consent shall take precedence over any prior consent.

(g) A consumer’s consent pursuant to this article is effective until it is revoked by the consumer, but consent provided by a consumer with whom a licensee, surplus line insurer, or reinsurer has no ongoing business relationship shall only be valid for the duration specified on the consent document.

(h) If a consumer later establishes a new relationship with the licensee, any consent that applied to the former relationship shall not apply to the new relationship. A new relationship occurs when the consumer who previously ended all business relationships with the licensee, surplus line insurer, or reinsurer reestablishes a business relationship more than 30 days after the previous business relationship ended.

(i) The obligations imposed upon a licensee, surplus line insurer, or reinsurer by this section may be satisfied by another licensee, surplus line insurer, reinsurer, or third-party service provider, consistent with the requirements of subdivision (f) of Section 791.099.

791.065.

(a) Notwithstanding any other law, a licensee, surplus line insurer, reinsurer, or third-party service provider shall not utilize as its disclosure authorization form in connection with insurance transactions a form or statement that authorizes the disclosure of personal or privileged information about an individual to the licensee, surplus line insurer, reinsurer, or third-party service provider unless the form or statement meets all of the following criteria:

(1) Is written in plain language.

(2) Is dated.

(3) Specifies the types of persons authorized to disclose information about the individual.

(4) Specifies the nature of the information authorized to be disclosed.

(5) Names the licensee, surplus line insurer, reinsurer, or third-party service provider and identifies by generic reference representatives of the insurance institution to whom the individual is authorizing information to be disclosed.

(6) Specifies the purposes for which the information is collected.

(7) Specifies the length of time the authorization shall remain valid, which shall be no longer than:

(A) One of the following for authorizations signed for the purpose of collecting information in connection with an application for an insurance policy, a policy reinstatement or a request for change in policy benefits:

(i) Thirty months from the date the authorization is signed if the application or request involves life, health, or disability insurance.

(ii) One year from the date the authorization is signed if the application or request involves property or casualty insurance.

(B) One of the following for authorizations signed for the purpose of collecting information in connection with a claim for benefits under an insurance policy:

(i) The term of coverage of the policy if the claim is for a health insurance benefit.

(ii) The duration of the claim if the claim is not for a health insurance benefit.

(iii) The duration of all claims processing activity performed in connection with all claims for benefits made by any person entitled to benefits under a nonprofit hospital service contract.

(8) Advises the individual or a person authorized to act on behalf of the individual that the individual or the individual’s authorized representative is entitled to receive a copy of the authorization form.

(b) For purposes of this section, a “disclosure authorization form” means a form used by licensee or third-party service provider to obtain personal information about an individual from a person other than the individual.

(c) This section does not require any authorization for the receipt of personal or privileged information about an individual.

791.07.

(a) A licensee, surplus line insurer, reinsurer, or third-party service provider shall not prepare or request an investigative consumer report about a consumer in connection with an insurance transaction involving an application for insurance, a policy renewal, a policy reinstatement, or a change in insurance benefits unless the licensee, surplus line insurer, reinsurer, or third-party service provider informs the consumer of both of the following in writing before the report preparation:

(1) That the consumer may request to be interviewed in connection with the preparation of the investigative consumer report, and the licensee, surplus line insurer, reinsurer, or third-party service provider shall conduct the interview.

(2) That upon a request pursuant to Section 791.08, the consumer is entitled to receive a copy of the investigative consumer report.

(b) If an investigative consumer report is to be prepared by a licensee, surplus line insurer, or reinsurer, the licensee, surplus line insurer, or reinsurer shall institute reasonable procedures to conduct a personal interview requested by a consumer.

(c) If an investigative consumer report is to be prepared by a third-party service provider, the licensee, surplus line insurer, or reinsurer shall notify the third-party service provider in writing if a personal interview has been requested by the consumer. The third-party service provider shall conduct the interview requested.

(d) If a licensee, surplus line insurer, or reinsurer uses a third-party service provider to obtain or prepare an investigative consumer report, the written contract between the licensee, surplus line insurer, or reinsurer and the third-party service provider shall require the third-party service provider to do both of the following:

(1) Comply with the requirements of this section.

(2) Not process or share personal information provided to the third-party service provider by the licensee, surplus line insurer, or reinsurer or obtained by the third-party service provider in its investigation of the consumer other than to fulfill the purpose of the contract with the licensee, surplus line insurer, or reinsurer.

(e) A licensee, surplus line insurer, or reinsurer reinsurer, or third-party service provider that prepares or requests an investigative consumer report in connection with an insurance claim shall notify the consumer that the consumer may request to be interviewed in connection with the preparation of the investigative consumer report. The licensee, surplus line insurer, reinsurer, or third-party service provider is not required to provide a copy of an investigative report prepared in connection with an insurance claim, and that contains privileged information, unless compelled to do so by a state or federal court.

791.08.

(a) A consumer may submit a verifiable request to a licensee, surplus line insurer, or reinsurer for access to the consumer’s personal and publicly available information in the possession of the licensee, surplus line insurer, reinsurer, or insurance support organization, or its third-party service providers. Upon receiving a verifiable request, the licensee, surplus line insurer, reinsurer, insurance support organization, or its third-party service provider shall do both of the following:

(1) Acknowledge the request within five business days from the date the request is received.

(2) Do all of the following within 30 business days from the date the request is received:

(A) Provide the consumer with a copy of any items of personal information relating to the consumer.

(B) If the consumer is not the source of an item of personal information provided to the consumer pursuant to this subdivision, identify the source of the item of personal information.

(C) Disclose to the consumer the identity of those persons to whom the licensee, surplus line insurer, reinsurer, or third-party service provider has disclosed an item of the consumer’s personal information within the current year and, at a minimum, the three calendar years before the date the consumer’s request is received.

(D) Provide the consumer with a summary of the procedures by which the consumer may request correction, amendment, or deletion of recorded personal information.

(b) Health information in the possession of a licensee, surplus line insurer, or reinsurer and requested pursuant to subdivision (a), together with the identity of the source of the information, shall be supplied either directly to the consumer or to a health care provider designated by the consumer. If the consumer elects for the licensee, surplus line insurer, or reinsurer to disclose the information to a health care provider designated by the consumer, the licensee, surplus line insurer, or reinsurer shall notify the consumer, at the time of the disclosure, that it has provided the information to the designated health care provider.

(c) The obligations imposed by this section upon a licensee, surplus line insurer, or reinsurer may be satisfied by another licensee, surplus line insurer, reinsurer, or third-party service provider, consistent with the requirements of subdivision (f) of Section 791.099.

(d) The rights granted to a consumer pursuant to this section:

(1) Shall extend to all natural persons to the extent that personal or publicly available information about them is possessed by a licensee, surplus line insurer, or reinsurer or third-party service provider.

(2) Shall not extend to privileged information or personal information about the consumer that is processed or shared in connection with, or is in reasonable anticipation of, a claim or civil or criminal proceeding involving the consumer, until the claim or proceeding is finalized.

(3) Shall not be construed to require disclosure of information pertaining to an anticipated or active fraud investigation or the detection or prevention of fraud, or information shared in accordance with the reporting of suspected insurance fraud under Chapter 12 (commencing with Section 1871).

(4) Shall not extend to a third-party natural person, including a beneficiary, family or household member, or emergency contact, whose personal information is collected directly from a consumer in connection with an insurance transaction, provided that the licensee, surplus line insurer, or reinsurer does not process or share the third-party natural person’s personal information for any purpose unrelated to the insurance transaction.

(e) A licensee, surplus line insurer, or reinsurer shall provide reasonable means for a consumer to exercise their rights pursuant to this section. A licensee, surplus line insurer, or reinsurer does not provide reasonable means if they are unduly burdensome or require the consumer to incur expenses.

(f) For purposes of this section, “insurance support organization” does not include a consumer reporting agency.

791.09.

(a) A consumer may submit a verifiable request to a licensee, surplus line insurer, or reinsurer to correct, amend, or delete any personal information about the consumer in the possession of the licensee, surplus line insurer, reinsurer, or its third-party service providers.

(b) Within 30 business days from the date of receipt of a written request from a consumer to correct, amend, or delete any recorded personal information about the consumer within its possession, a licensee, surplus line insurer, reinsurer, or third-party service provider shall do the following, as appropriate:

(1) Correct, amend, or delete the portion of the personal information in dispute.

(2) Refuse to make the correction, amendment, or deletion if there is no specific factual or legal basis for correcting, amending, or deleting the personal information in question, and provide all of the following information to the consumer:

(A) Written notice of the refusal to make the correction, amendment, or deletion.

(B) The reasons for the refusal.

(C) The contact information for filing a complaint with the commissioner.

(D) The consumer’s right to file a statement as provided in subdivision (d).

(3) Refuse to make the correction, amendment, or deletion if it is not permitted by law, and provide all of the following information to the consumer:

(A) Written notice of the refusal to make the deletion.

(B) The reasons for the refusal.

(C) The contact information for filing a complaint with the commissioner.

(D) The consumer’s right to file a statement pursuant to subdivision (d).

(4) If the consumer obtains a correction, amendment, or deletion to a government record that was incorrect, make the correction in its systems within a reasonable time and provide the correction to any third-party service provider with whom the licensee, surplus line insurer, reinsurer, or third-party service provider shared the information.

(c) (1) A licensee, surplus line insurer, reinsurer, or third-party service provider shall not refuse to correct, amend, or delete a consumer’s personal information without good cause, which shall be demonstrated to the commissioner upon request.

(2) If the licensee, surplus line insurer, reinsurer, or third-party service provider corrects, amends, or deletes recorded personal information in accordance with paragraph (1) of subdivision (b), the licensee, surplus line insurer, reinsurer, or third-party service provider shall notify the consumer in writing and furnish the correction, amendment, or deletion to:

(A) A person specifically designated by the consumer who may have, within the preceding two years, received the personal information.

(B) An insurance support organization whose primary source of personal information is insurers, if the insurance support organization has systematically received personal information from the insurer, surplus line insurer, or reinsurer within the preceding five years. The correction, amendment, or deletion need not be furnished if the insurance support organization no longer maintains recorded personal information about the consumer.

(C) A third-party service provider or insurance support organization that furnished the personal information.

(d) If a consumer disagrees with a licensee’s, surplus line insurer’s, reinsurer’s, or third-party service provider’s refusal to correct, amend, or delete personal information, the consumer may file with the licensee, surplus line insurer, reinsurer, or third-party service provider a statement setting forth either of the following:

(1) The relevant and factual information demonstrating the errors in the information held by the licensee, surplus line insurer, reinsurer, or third-party service provider.

(2) The reasons why the consumer disagrees with the licensee’s, surplus line insurer’s, reinsurer’s, or third-party service provider’s refusal to correct, amend, or delete personal information.

(e) If a consumer files a statement as described in subdivision (d), the licensee, surplus line insurer, reinsurer, or third-party service provider shall do both of the following:

(1) Include the statement with the disputed personal information and provide a copy of the consumer’s statement to anyone reviewing the disputed personal information in the licensee’s records.

(2) In a later disclosure of the personal information that is the subject of disagreement, clearly identify the matter or matters in dispute and include the consumer’s statement along with the personal information being disclosed.

(f) The rights granted to a consumer by this section shall not extend to personal information about them that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving them.

(g) The rights granted to a consumer by this section shall not extend to a third-party natural person, including a beneficiary, family or household member, or emergency contact, whose personal information is collected directly from a consumer in connection with an insurance transaction, provided that the licensee, surplus line insurer, or reinsurer does not process or share the third-party natural person’s personal information for any purposes unrelated to the insurance transaction.

(h) The rights granted to a consumer pursuant to this section shall not be construed to require deletion of information pertaining to an anticipated or active fraud investigation or information shared in accordance with the reporting of suspected insurance fraud under Chapter 12 (commencing with Section 1871).

(i) For purposes of this section, “insurance support organization” does not include a consumer reporting agency.

(j) The obligations imposed upon a licensee, surplus line insurer, or reinsurer by this section may be satisfied by another licensee, surplus line insurer, reinsurer, or third-party service provider, consistent with the requirements of subdivision (f) of Section 791.099.

791.099.

(a) A licensee, surplus line insurer, reinsurer, or third-party service provider shall provide easily accessible means for consumers to exercise their rights pursuant to this article, including the following:

(1) A mailing address, email address, internet website, online platform, digital application, or toll-free telephone number through which consumers may submit a request.

(2) A portion of the licensee’s, surplus line insurer’s, or reinsurer’s internet website, online platform, or digital application that permits consumers to exercise their rights pursuant to this article, if the licensee, surplus line insurer, or reinsurer maintains an internet website, online platform, or digital application.

(b) A consumer shall be able to access their rights pursuant to this article in any manner in which the consumer interacts with the licensee, surplus line insurer, or reinsurer. The requirements of this section are met if the licensee, surplus line insurer, or reinsurer provides means for exercising consumer rights that are easy to locate, access, and understand.

(c) A licensee, surplus line insurer, or reinsurer shall not require a consumer to take unreasonable steps to exercise the consumer’s rights pursuant to this article and shall not require a consumer to pay fees or incur costs to exercise those rights.

(d) A licensee, surplus line insurer, or reinsurer shall not use dark patterns or other means designed to prevent a consumer from exercising the consumer’s rights pursuant to this article. A licensee, surplus line insurer, reinsurer, or third-party service provider shall not use dark patterns with respect to a consumer’s exercise of the rights provided by this article.

(e) With respect to a consumer who has agreed to conduct business electronically pursuant to the Uniform Electronic Transactions Act (Title 2.5 (commencing with Section 1633.1) of Part 2 of Division 3 of the Civil Code), the licensee, surplus line insurer, or reinsurer shall provide means for consumers to exercise their rights, in compliance with the requirements of Section 38.6.

(f) An obligation imposed upon a licensee, surplus line insurer, reinsurer, or third-party service provider by this article may be satisfied through substitute performance by another licensee, surplus line insurer, reinsurer, or third-party service provider authorized to act on behalf of the former licensee, surplus line insurer, or reinsurer, provided that all of the following requirements are satisfied:

(1) With respect to notices required to be provided pursuant to Sections 791.04 and 791.045, a notice shall identify all licensees, surplus line insurers, or reinsurers whose privacy practices are stated in the notice, except to the extent allowed by subparagraph (D) of paragraph (2) of subdivision (a) of Section 791.04.

(2) With respect to consent obtained pursuant to Section 791.06, a consent document shall identify all licensees, surplus line insurers, or reinsurers seeking to obtain consent.

(3) With respect to the rights provided pursuant to Section 791.08, 791.09, or 791.10, a response to the consumer shall clearly identify all licensees, surplus line insurers, or reinsurers on whose behalf the response is being provided.

(4) With respect to the rights provided pursuant to Section 791.10, a response to the consumer shall clearly identify the licensee, surplus line insurer, or reinsurer responsible for making the adverse underwriting decision pursuant to subdivision (a) of Section 791.10, or action pursuant to subdivision (e) of Section 791.10, to which the consumer is subject.

(5) The licensee, surplus line insurer, reinsurer, or third-party service provider providing substitute performance on behalf of another licensee, surplus line insurer, or reinsurer otherwise satisfies all of the requirements pertaining to the obligation for which the licensee, surplus line insurer, reinsurer, or third-party service provider is providing substitute performance.

(g) The commissioner may develop regulations as necessary to implement and enforce this section, including regulations regarding legal representatives for purposes of this article.

(h) This article shall not require a licensee, surplus line insurer, or reinsurer to disclose personal information in response to a consumer access request, correct personal information in response to a consumer correction request, or delete personal information in response to a consumer deletion request, to the extent such disclosure, correction, or deletion would violate the confidentiality requirements of Part 2 of Title 42 of the Code of Federal Regulations or, following any amendment to those provisions, any successor federal regulation governing the confidentiality of substance use disorder treatment information. A licensee, surplus line insurer, or reinsurer may provide a consumer with a notice that responsive information exists but is subject to federal confidentiality protections that limit its disclosure, in lieu of providing the restricted information itself, and shall refer the consumer to the treating program as the appropriate source of access to such records consistent with federal requirements.

791.10.

(a) In the event of an adverse underwriting decision the licensee, surplus line insurer, or reinsurer responsible for the decision shall:

(1) Either provide the consumer with the specific reason or reasons for the adverse underwriting decision in writing or, except as provided in subdivision (e), advise the consumer that upon written request the consumer may receive the specific reason or reasons in writing.

(2) Provide the consumer with a summary of the rights established under subdivision (b) and Sections 791.08 and 791.09.

(b) Upon receipt of a written request within 90 business days from the date of the mailing of notice or other communication of an adverse underwriting decision to a consumer, the licensee, surplus line insurer, or reinsurer shall furnish to such person within 21 business days from the date of receipt of such written request:

(1) The specific reason or reasons for the adverse underwriting decision, in writing, if such information was not initially furnished in writing pursuant to paragraph (1) of subdivision (a).

(2) The specific items of personal and privileged information that support those reasons, however:

(A) The licensee, surplus line insurer, or reinsurer shall not be required to furnish specific items of privileged information if it has a reasonable suspicion, based upon specific information available for review by the commissioner, that the consumer proposed for coverage has engaged in criminal activity, fraud, material misrepresentation, or material nondisclosure.

(B) Specific items of health information supplied by a health care provider shall be disclosed either directly to the individual about whom the information relates or to a health care provider designated by the individual and licensed to provide health care with respect to the condition to which the information relates, whichever the individual prefers.

Health information shall be supplied directly to the individual, pursuant to this subdivision, only with the approval of the qualified professional person with treatment responsibility for the condition to which the information relates.

(3) The names and addresses of the institutional sources that supplied the specific items of information given pursuant to paragraph (2) of subdivision (b), provided, however, that the identity of any health care provider shall be disclosed either directly to the individual or to the designated health care provider, whichever the individual prefers.

(c) The obligations imposed by this section upon a licensee, surplus line insurer, or reinsurer may be satisfied by another licensee, surplus line insurer, reinsurer, or third-party service provider authorized to act on its behalf.

(d) When an adverse underwriting decision results solely from an oral request or inquiry, the explanation of reasons and summary of rights required by subdivision (a) or (e) may be given orally to the extent that such information is available.

(e) Except as provided in subdivision (d), with respect to a declination, cancellation, or nonrenewal of a property insurance policy covered by Section 675 or an automobile insurance policy covered by Section 660, or an individual life, health, or disability insurance policy, the licensee, surplus line insurer, or reinsurer responsible for the decision shall provide the specific reason or reasons in writing at the time of the decision. The communication of health information for a life or health insurance policy shall be subject to the disclosure requirements of subparagraph (B) of paragraph (2) of subdivision (a).

791.11.

A licensee, surplus line insurer, reinsurer, or insurance-support organization shall not seek information in connection with an insurance transaction concerning either of the following:

(a) A previous adverse underwriting decision experienced by a consumer. an individual unless the inquiry also requests the reasons for the previous adverse underwriting decision.

(b) The previous Any insurance coverage obtained by a consumer through a residual market mechanism, unless the inquiry also requests the reasons for a previous adverse underwriting decision or the reasons why insurance coverage was previously obtained through a residual market mechanism.

791.12.

A licensee, third-party service provider, surplus line insurer, or reinsurer shall not base an adverse underwriting decision in whole or in part on the following:

(a) On the fact of a previous adverse underwriting decision or on the fact that a consumer an individual previously obtained insurance coverage through a residual market mechanism, provided, however, a licensee, third-party service provider, surplus line insurer, or reinsurer may base an adverse underwriting decision on further information obtained from a licensee, third-party service provider, surplus line insurer, or reinsurer responsible for a previous adverse underwriting decision. The further information, when requested, shall create a conclusive presumption that the information is necessary to perform the requesting insurer’s function in connection with an insurance transaction involving the consumer individual and, when reasonably available, shall be furnished the requesting insurer and the consumer, individual, if applicable.

(b) On personal information received from an insurance-support organization whose primary source of information is licensees, provided, however, licensees. However, a licensee, third-party service provider, surplus line insurer, or reinsurer may base an adverse underwriting decision on further personal information obtained as the result of information received from an insurance-support organization.

(c) On the fact that a consumer an individual has previously inquired and received information about the scope or nature of coverage under a residential fire or property insurance policy, if the information is received from an insurance-support organization whose primary source of information is licensees and the inquiry did not result in the filing of a claim.

(d) On the fact that an accident involving a peace officer, member of the Department of the California Highway Patrol, or firefighter has been reported and the insurer retains no does not retain liability pursuant to Section 488.5 and subdivision (b) of Section 557.5.

791.13.

(a) Consistent with this article, a licensee, surplus line insurer, reinsurer, or third-party service provider may share a consumer’s personal information according to the following:

(1) As is reasonably necessary and proportionate for each of the following purposes:

(A) In connection with an insurance transaction, or provision of “value-added services or benefits” in connection with an insurance transaction.

(B) For compliance with either of the following:

(i) A request or directive from a law enforcement or insurance regulatory authority or an administrative, criminal, or civil legal process, arbitration, or any other legal requirement or order that is binding upon the licensee, surplus line insurer, or reinsurer, so long as that law does not interfere with state law, including the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).

(ii) A legal obligation related to an insurance transaction involving a consumer’s personal information to which the licensee, surplus line insurer, or reinsurer is subject, including state, federal, or international statute of limitation or records retention periods applicable to the licensee, surplus line insurer, or reinsurer in connection with a consumer’s personal information.

(C) When otherwise specifically required by state or federal law.

(D) For a lienholder, mortgagee, assignee, lessor, or other person shown on the records of a licensee, surplus line insurer, or reinsurer as having a legal or beneficial interest in an insurance policy, to protect that interest, if both of the following are true:

(i) Health information is not shared, unless the sharing would otherwise be permitted by this section.

(ii) The information shared is limited to that which is reasonably necessary to protect the requestor’s legal interests in the policy.

(E) To permit a party or a representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the licensee, surplus line insurer, or reinsurer to review the information necessary for the transaction, if both of the following are true:

(i) Before the consummation of the sale, transfer, merger, or consolidation information is only shared as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or consolidation.

(ii) The recipient agrees not to share the acquired personal information for purposes other than the sale, transfer, merger, or consolidation.

(F) To permit a group policyholder to report claims experience or conduct an audit of the operations or services of a licensee, surplus line insurer, or reinsurer, if the information shared is reasonably necessary for the group policyholder to make the report or conduct the audit and is not otherwise shared.

(G) To permit a governmental authority to determine the consumer’s eligibility for health care benefits for which the governmental authority may be liable, so long as any disclosure does not interfere with state law, including the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).

(2) Upon obtaining prior, opt-in consent from the consumer, as is reasonably necessary and proportionate for each of the following purposes:

(A) In connection with the a specific marketing activity of a product or service, after receiving affirmative consent from the consumer to share the consumer’s information in connection with specific marketing activity to which the consumer has consented. service not otherwise permitted under this article.

(B) In connection with a specific research activity, after receiving affirmative consent from the consumer to share the consumer’s information in connection with specific research activity to which the consumer has consented. information.

(C) For another purpose not enumerated in this section, provided that the purpose has been clearly and fully disclosed to the consumer and sharing is limited to the specific activity which has been disclosed and to which the consumer has consented.

(3) On an opt-out basis as is reasonably necessary and proportionate for each of the following purposes, provided that the consumer has been provided with notice of the sharing and the consumer’s ability to opt out of the sharing, a reasonable opportunity for the consumer to opt out of the sharing, and the consumer has not done so:

(A) In connection with the joint marketing of cobranded financial products or services between a licensee and a financial institution, joint marketing, provided that all of the following are true:

(i) Personal information is only shared pursuant to a contract complying with the requirements of subdivision (b) of Section 791.24.

(ii) Only the following elements of personal information are shared for purposes of the joint marketing activity, including providing notice and the opportunity to opt out:

(I) Name.

(II) Address or email address.

(III) Financial institution affiliation and account type.

(IV) Age.

(B) In connection with cross-marketing of insurance or financial products or services, provided by either the licensee or a third party, to a consumer with which the licensee has an ongoing business relationship. The provisions of this paragraph shall govern the referral of insurance or financial products and services by an independent producer to a consumer with whom the producer has an ongoing business relationship.

(C) In connection with the sharing of personal information necessary to effectuate marketing related to the licensee’s own products, goods, or services directly to individuals.

(D) In connection with the sharing of personal information, other than a consumer report, with an affiliate of the licensee for any purpose not specified in paragraph (1), provided that the consumer is given notice and the ability to opt out of the affiliate-sharing activity and has not done so.

(E) In connection with FAIR Plan clearinghouse activities, consistent with subdivisions (i) and (j) of Section 10095, provided that the consumer is given notice and the ability to opt out of the clearinghouse activity pursuant to subdivision (k) of Section 10095 and has not done so.

(4) Additional purposes, as well as the consent requirements pertaining to each purpose, specified by the commissioner in regulation.

(b) A licensee, surplus line insurer, reinsurer, or third-party service provider shall not process or share a consumer’s sensitive personal information, other than in connection with the purposes in subparagraphs (A) to (G), inclusive, of paragraph (1) of subdivision (a) or for other disclosed purposes if the consumer is provided an opportunity to opt out of those other disclosed purposes.

(c) (1) A licensee’s processing or sharing of a consumer’s personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, for another disclosed purpose for which the personal information was collected and not further processed or shared in a manner that is incompatible with those purposes, or for one of the following purposes:

(A) In connection with an insurance transaction, or provision of “value-added services or benefits” in connection with an insurance transaction.

(B) For compliance with either of the following:

(i) A request or directive from a law enforcement or insurance regulatory authority or an administrative, criminal, or civil legal process, arbitration, or any other legal requirement or order that is binding upon the licensee, as long as that law does not interfere with state law, including the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).

(ii) A legal obligation related to an insurance transaction involving a consumer’s personal information to which the licensee is subject, including state, federal, or international statute of limitation or records retention periods applicable to the licensee in connection with a consumer’s personal information.

(C) When otherwise specifically required by state or federal law.

(D) In connection with any of the following activities, in accordance with Proposition 103, approved by the electors on November 8, 1988, actuarially sound principles, and laws prohibiting unfair discrimination, as applicable:

(i) Pricing model development.

(ii) Customer lifetime value modeling.

(iii) Underwriting algorithm testing.

(iv) Product development.

(v) Research activities.

(vi) Collection or development of a consumer profile by or on behalf of a licensee, as described in subparagraph (K) of paragraph (1) of subdivision (ah) of Section 791.02.

(2) A third-party service provider shall process or share personal information in connection with its relationship with a licensee only in accordance with the terms of its contract with the licensee, and only as is reasonably necessary and proportionate for the purposes specified in that contract, which shall be consistent with the purposes enumerated in this section. This section does not restrict a third-party service provider from processing or sharing personal information connected to nonlicensees or to make a third-party service provider’s business operations generally subject to this section.

(d) A licensee, surplus line insurer, reinsurer, or third-party service provider may process or share consumers’ deidentified information.

(e) Processing or sharing of a consumer’s personal information by a licensee, surplus line insurer, reinsurer, or third-party service provider that requires or permits the consumer’s consent shall, at all times, be consistent with the consent obtained from the consumer pursuant to Section 791.06.

(f) Notwithstanding any other law, a licensee, surplus line insurer, reinsurer, or third-party service provider shall not sell a consumer’s personal information for any type of monetary or other valuable consideration.

(g) (1) An affiliate that processes or shares personal information received from, or on behalf of, a licensee, surplus line insurer, reinsurer, or third-party service provider shall, with respect to that information, be subject to the same requirements under this article as are applicable to the licensee, surplus line insurer, reinsurer, or third-party service provider.

(2) Notwithstanding paragraph (1), this subdivision does not apply to an affiliate that is not otherwise subject to this article and that processes personal information of a consumer with whom the affiliate has a direct relationship, for a purpose which has been disclosed to the consumer and that does not constitute processing in the business of insurance.

(h) This section does not prohibit the sharing of a consumer’s personal information with a licensee’s affiliates to the extent preempted by Section 1681t(b)(1)(H) or Section 1681t(b)(2) of Title 15 of the United States Code.

(i) (1) A licensee’s, surplus line insurer’s, or reinsurer’s retention of a consumer’s personal information shall be reasonably necessary and proportionate in connection with the purposes specified under subdivisions (a) to (c), inclusive.

(2) A licensee, surplus line insurer, or reinsurer shall develop a written records retention policy and records retention schedule and shall make it available to the commissioner upon request. A licensee’s, surplus line insurer’s, or reinsurer’s policy and schedule developed pursuant to this subdivision shall be confidential and not subject to requests made pursuant to the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code).

(3) A licensee shall comply with all of the following on and after January 1, 2032:

(A) Not less than once every three years, a licensee, surplus line insurer, or reinsurer shall review and update its records retention policy and records retention schedule to ensure compliance with this article.

(B) Not less than once every three years, a licensee, surplus line insurer, or reinsurer shall review its records containing personal information to determine whether any of the purposes specified in subdivision (a) permit the continuing retention of any consumer’s personal information.

(C) Once a licensee, surplus line insurer, or reinsurer has determined that a consumer’s personal information, or a specific element of a consumer’s personal information, is no longer needed pursuant to subdivisions (a) to (c), inclusive, the licensee, surplus line insurer, or reinsurer shall take reasonable steps to securely destroy, delete, or deidentify the consumer’s personal information in a timely manner in accordance with its records retention schedule.

(4) This section does not require the deletion of information related to tracking or detection of fraud or information related to a consumer’s claims history.

(5) This section does not permit or require the deletion of a record that is required to be retained by law or regulation.

(6) (A) This section does not require a licensee, surplus line insurer, or reinsurer to delete personal information if targeted disposal is not reasonably feasible due to the manner in which the personal information is maintained.

(B) On or after January 1, 2027, July 1, 2028, a licensee, surplus line insurer, or reinsurer shall not implement any new system covered by the exception described in subparagraph (A).

(C) Subparagraph (A) shall not apply to any personal information maintained by a licensee, surplus line insurer, or reinsurer more than seven years after January 1, 2027, July 1, 2028, unless the information is maintained on a system that is physically isolated from any internet-connected network infrastructure.

(j) A licensee that is a producer, when processing or sharing personal information received from another licensee for use in that other licensee’s marketing or servicing program, shall be subject to the same use-limitation, confidentiality, and incident-reporting obligations applicable to a third-party service provider under Section 791.24 with respect to that personal information. The licensee providing information to a producer pursuant to this subdivision shall satisfy the requirements of Section 791.24 with respect to the recipient producer.

791.14.

(a) The commissioner may examine and investigate into the affairs of a licensee doing business in this state to determine if the licensee has been or is engaged in any conduct in violation of this article.

(b) The commissioner may examine and investigate into the affairs of a surplus line insurer, reinsurer, or third-party service provider acting on behalf of a licensee, surplus line insurer, or reinsurer that either transacts business in this state or transacts business outside this state that has an effect on a consumer residing in this state in order to determine if the third-party service provider has been or is engaged in any conduct in violation of this article.

791.15.

(a) Whenever the commissioner has reason to believe that a licensee, surplus line insurer, reinsurer, or third-party service provider has been or is engaged in conduct in this state that violates this article, in this state or outside this state that has an effect on a consumer residing in this state, the commissioner shall issue and serve upon the licensee, surplus line insurer, reinsurer, or third-party service provider a statement of charges and notice of hearing to be held at a time and place fixed in the notice. The date for the hearing shall be not less than 30 days after the date of service.

(b) At the time and place fixed for the hearing, the licensee, surplus line insurer, reinsurer, or third-party service provider charged shall have an opportunity to answer the charges against it and present evidence on its behalf. Upon good cause shown, the commissioner shall permit any adversely affected person to intervene, appear, and be heard at the hearing by counsel or in person.

(c) At a hearing conducted pursuant to this section, the commissioner may administer oaths, examine and cross-examine witnesses, and receive oral and documentary evidence. The commissioner may subpoena witnesses, compel their attendance, and require the production of books, papers, records, correspondence, and other documents that are relevant to the hearing. A stenographic record of the hearing shall be made upon the request of a party or at the discretion of the commissioner. If a stenographic record is not made and if judicial review is sought, the commissioner shall prepare a statement of the evidence for use on review. Hearings conducted under this section shall be governed by the same rules of evidence and procedure applicable to administrative proceedings conducted under the laws of this state.

(d) Statements of charges, notice, orders, and other processes of the commissioner under this article may be served by anyone duly authorized to act on behalf of the commissioner. Service of process may be completed in the manner provided by law for service of process in civil actions or by registered mail or by a mailing service offered by a third-party mailing service with tracking capability. A copy of the statement of charges, notice, order, or other process shall be provided to the person or persons whose rights under this article have been allegedly violated. A verified return setting forth the manner of service, the return postcard receipt in the case of registered mail, or signed receipt documentation, shall be sufficient proof of service.

791.16.

For the purpose of this article, a surplus line insurer, reinsurer, or third-party service provider transacting business outside this state that has an effect on a consumer residing in this state shall be deemed to have appointed the commissioner to accept service of process on its behalf, provided the commissioner causes a copy of the service to be mailed immediately by registered mail, or by a mailing service offered by a third-party mailing service with tracking capability, to the third-party service provider at its last known principal place of business. The return postcard receipt or signed receipt documentation for the mailing shall be sufficient proof that the same was properly mailed by the commissioner.

791.17.

(a) If, after a hearing pursuant to Section 791.15, the commissioner determines that the licensee, surplus line insurer, reinsurer, or third-party service provider charged has engaged in conduct or practices in violation of this article, the commissioner shall reduce the commissioner’s findings to writing and shall issue and cause to be served upon the licensee, surplus line insurer, reinsurer, or third-party service provider a copy of the findings and an order requiring the licensee, surplus line insurer, reinsurer, or third-party service provider to cease and desist from the conduct or practices constituting a violation of this article.

(b) If, after a hearing pursuant to Section 791.15, the commissioner determines that the licensee, surplus line insurer, reinsurer, or third-party service provider charged has not engaged in conduct or practices in violation of this article, the commissioner shall prepare a written report that sets forth findings of fact and conclusions of law. The report shall be served upon the licensee, surplus line insurer, reinsurer, or third-party service provider charged and upon the person or persons, if any, whose rights under this article were allegedly violated.

(c) Until the expiration of the time allowed under Section 791.18 for filing a petition for review or until the petition is actually filed, whichever occurs first, the commissioner may modify or set aside any order or report issued under this section. After the expiration of the time allowed under Section 791.18 for filing a petition for review, if a petition has not been duly filed, the commissioner may, after notice and opportunity for hearing, alter, modify, or set aside, in whole or in part, any order or report issued under this section whenever conditions of fact or law warrant that action or if the public interest so requires.

791.18.

(a) Any person subject to an order of the commissioner under Section 791.17 or 791.20 or any person whose rights under this article were allegedly violated may obtain a review of any order or report of the commissioner by filing in a court of competent jurisdiction, within 30 days from the date of the service of such order or report, pursuant to Section 1094.5 of the Code of Civil Procedure. The court shall have jurisdiction to make and enter a decree modifying, affirming, or reversing any order or report of the commissioner, in whole or in part.

(b) An order or report issued by the commissioner under Section 791.17 shall become final upon either of the following:

(1) The expiration of the time allowed for the filing of a petition for review, if a petition has not been duly filed, except that the commissioner may modify or set aside an order or report to the extent provided in subdivision (c) of Section 791.17.

(2) A final decision of the court if the court directs that the order or report of the commissioner be affirmed or the petition for review dismissed.

(c) An order or report of the commissioner under this article or order of a court to enforce the same shall not relieve or absolve any person affected by the order or report from any liability under any law of this state.

791.19.

(a) (1) If a hearing pursuant to Section 791.15 results in the finding that a licensee, surplus line insurer, reinsurer, or third-party service provider knowingly violated this article, or should have known that their conduct would violate this article, the commissioner may, in addition to the issuance of a cease and desist order pursuant to Section 791.17, order payment of a penalty of at least five thousand dollars ($5,000) for each violation, not to exceed a penalty of up to one million dollars ($1,000,000) in the aggregate for multiple violations.

(2) As applied to producers, the commissioner shall consider, in addition to other factors, the proportionate nature of the violation or violations and the scale and complexity of the licensee’s operations.

(b) A person who violates a cease and desist order of the commissioner issued pursuant to Section 791.17 may, after notice and hearing and upon order of the commissioner, be subject to one or more of the following penalties, at the discretion of the commissioner:

(1) A monetary fine of at least fifteen thousand dollars ($15,000) per violation.

(2) A monetary fine of at least fifty thousand dollars ($50,000) for each violation, if the commissioner finds that violations have occurred with such frequency as to constitute a general business practice.

(3) Suspension or revocation of the licensee’s license if the licensee knew or reasonably should have known it was in violation of this article.

791.20.

(a) If a licensee, surplus line insurer, reinsurer, or third-party service provider fails to comply with Section 791.08, 791.09, or 791.10, with respect to the rights granted under those sections, any person whose rights are violated may apply to any court of competent jurisdiction for appropriate equitable relief.

(b) A licensee, surplus line insurer, reinsurer, or third-party service provider that discloses information in violation of Section 791.13 shall be liable for damages sustained by the consumer about whom the information relates. A consumer is not entitled to a monetary award that exceeds the actual damages sustained by the consumer as a result of a violation of Section 791.13.

(c) In an action brought pursuant to this section, the court may award the cost of the action and reasonable attorney’s fees to the prevailing party.

(d) An action under this section shall be brought within two years from the date the alleged violation is or should have been discovered.

(e) Except as specifically provided in this section, there shall not be a remedy or recovery available to consumers, in law or in equity, for occurrences constituting a violation of this article.

791.21.

A cause of action in the nature of defamation, invasion of privacy, or negligence shall not arise against any person for disclosing personal or privileged information in accordance with this chapter, or against any person for furnishing personal or privileged information to a licensee, surplus line insurer, reinsurer, or third-party service provider. This section does not provide immunity for disclosing or furnishing false information with malice or willful intent to injure any person.

791.22.

Any person who knowingly and willfully obtains information about a consumer from a licensee, surplus line insurer, reinsurer, or third-party service provider under false pretenses shall be fined not more than fifty thousand dollars ($50,000), imprisoned in a county jail for not more than six months, or both.

791.24.

(a) A licensee, surplus line insurer, or reinsurer shall exercise due diligence in selecting and overseeing its third-party service providers. A licensee, surplus line insurer, or reinsurer shall develop written procedures for the selection and oversight of third-party service providers and shall make them available to the commissioner upon request. A licensee’s, surplus line insurer’s, or reinsurer’s procedures developed pursuant to this section shall be confidential and not subject to public disclosure requests made pursuant to the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code).

(b) A contract between a licensee, surplus line insurer, or reinsurer and a third-party service provider shall govern the processing or sharing of personal information performed on behalf of the licensee, surplus line insurer, or reinsurer. The contract shall contain clear instructions for processing or sharing personal information, the nature and purpose of processing, processing or sharing, the types of personal information subject to processing, processing or sharing, the duration of processing, processing or sharing, and the rights and obligations of all parties. The contract shall also include requirements that the third-party service provider shall do all of the following:

(1) Ensure that each person processing or sharing personal information is subject to a duty of confidentiality with respect to the personal information, and only processes or shares the personal information for legitimate duties as assigned.

(2) Develop and maintain a program of administrative, technical, and physical safeguards to ensure the confidentiality, integrity, and availability of personal information provided by the licensee, surplus line insurer, or reinsurer.

(3) Promptly report to the licensee, surplus line insurer, or reinsurer and the commissioner any incident affecting the confidentiality, integrity, or availability of personal information, including an event constituting a breach pursuant to subdivision (g) of Section 1798.82 of the Civil Code.

(4) Unless retention of the personal information is otherwise required by law, delete the personal information as of the date specified in the contract between the licensee, surplus line insurer, or reinsurer and third-party service provider, or upon the conclusion of the provision of services, unless the licensee, surplus line insurer, or reinsurer specifies an earlier destruction date.

(5) Upon the reasonable request of the licensee, surplus line insurer, or reinsurer, make available to the licensee, surplus line insurer, or reinsurer all information in its possession necessary to demonstrate the third-party service provider’s compliance with this article.

(6) Provide reasonable assistance to the licensee, surplus line insurer, or reinsurer with respect to a consumer request pursuant to this article.

(7) Engage a subcontractor only pursuant to a written contract that requires the subcontractor to comply with substantially similar obligations as the third-party service provider with respect to the personal information.

(8) Not further process or disclose the personal information obtained from or on behalf of the licensee, surplus line insurer, or reinsurer other than as stated in the contract.

(9) Promptly notify the licensee, surplus line insurer, or reinsurer if the third-party service provider is no longer able to comply with its obligations under the contract, in which case the licensee, surplus line insurer, or reinsurer has the right to terminate the contract.

(c) Notwithstanding subdivision (b), in connection with an insurance transaction, a licensee, surplus line insurer, or reinsurer may share a consumer’s personal information with a third-party service provider with whom the licensee, surplus line insurer, or reinsurer has no ongoing business relationship and with whom the licensee, surplus line insurer, or reinsurer has no written contract with the consent of the consumer and only to the extent necessary to provide the temporary service requested by the licensee, surplus line insurer, or reinsurer on behalf of the consumer.

(d) The section applies to a contract between a licensee, surplus line insurer, or reinsurer and a third-party service provider that is executed, amended, or renewed after January 1, 2027. July 1, 2028.

(e) This article applies to a third-party service provider only to the extent that the third-party service provider processes or shares personal information on behalf of a licensee, surplus line insurer, or reinsurer, or in the business of insurance.

(f) (1) With respect to a producer, the obligations under this section shall apply only to a third-party service provider with which the producer has a direct contractual relationship and over which whom the producer exercises control with respect to the possession of personal information. A producer may rely in good faith on the third-party service provider’s representation, certification, or contractual commitment regarding the subjects of paragraphs (1) to (9), inclusive, of subdivision (b). If the producer has taken commercially reasonable measures to ensure compliance by its third-party service provider, then the third-party service provider shall be directly liable for any violation of the article, and the producer shall not be held liable for that violation.

(2) This subdivision does not apply to a producer, to the extent that the producer has received information from another licensee pursuant to subdivision (j) of Section 791.13.

791.27.

(a) A disability insurer that provides coverage for hospital, medical, or surgical expenses shall not release any information to an employer that would directly or indirectly indicate to the employer that an employee is receiving or has received services from a health care provider covered by the plan unless authorized to do so by the employee. An insurer that has, pursuant to an agreement, assumed the responsibility to pay compensation pursuant to Article 3 (commencing with Section 3750) of Chapter 4 of Part 1 of Division 4 of the Labor Code, shall not be considered an employer for the purposes of this section.

(b) This section does not prohibit a disability insurer from releasing relevant information described in this section for the purposes set forth in Chapter 12 (commencing with Section 1871) of Part 2 of Division 1.

(c) This section does not prohibit a disability insurer from releasing relevant information described in this section for the purposes set forth in Section 10181.10.

791.28.

An insurer under a personal lines residential property insurance policy, if it reports the claims history or loss experience of insureds under those policies to an insurance-support organization, shall provide the insured with the following additional disclosure at the time that it provides the disclosure required pursuant to paragraph (1) of subdivision (b) of Section 790.034:

“This insurer reports claim information to one or more claims information databases. The claim information is used to furnish loss history reports to insurers. If you are interested in obtaining a report from a claims information database, you may do so by contacting:

(Insert the name, toll-free telephone number, and, if applicable, internet website address of each claims information database to which the insurer reports the information covered by this section)”

791.29.

Notwithstanding any other law, and to the extent permitted by federal law, a health insurer shall take the following steps to protect the confidentiality of an insured’s medical information:

(a) (1) A health insurer shall not require a protected individual to obtain the policyholder’s authorization to receive sensitive services or to submit a claim for sensitive services if the protected individual has the right to consent to care.

(2) A health insurer shall recognize the right of a protected individual to exclusively exercise rights granted under this section regarding medical information related to sensitive services that the protected individual has received.

(3) A health insurer shall direct all communications regarding a protected individual’s receipt of sensitive health care services directly to the protected individual receiving care as follows:

(A) If the protected individual has designated an alternative mailing address, email address, or telephone number pursuant to subdivision (b), the health insurer shall send or make all communications related to the protected individual’s receipt of sensitive services to the alternative mailing address, email address, or telephone number designated.

(B) If the protected individual has not designated an alternative mailing address, email address, or telephone number pursuant to subdivision (b), the health insurer shall send or make all communications related to the protected individual’s receipt of sensitive services in the name of the protected individual at the address or telephone number on file.

(C) Communications subject to this paragraph shall include the following written, verbal, or electronic communications:

(i) Bills and attempts to collect payment.

(ii) A notice of adverse benefits determinations.

(iii) An explanation of benefits notice.

(iv) A health insurer’s request for additional information regarding a claim.

(v) A notice of a contested claim.

(vi) The name and address of a provider, description of services provided, and other information related to a visit.

(vii) Any written, oral, or electronic communication from a health insurer that contains protected health information.

(4) A health insurer shall not disclose medical information related to sensitive health care services provided to a protected individual to the policyholder or any insureds other than the protected individual receiving care, absent an express written authorization of the protected individual receiving care.

(b) (1) A health insurer shall permit an insured to request, and shall accommodate requests for, confidential communication in the form and format requested by the insured, if it is readily producible in the requested form and format, or at alternative locations.

(2) A health insurer may require the insured to make a request for a confidential communication described in paragraph (1) in writing or by electronic transmission.

(3) The confidential communication request shall apply to all communications that disclose medical information or provider name and address related to receipt of medical services by the individual requesting the confidential communication.

(4) The confidential communication request shall be valid until the insured submits a revocation of the request, or a new confidential communication request is submitted.

(5) For the purposes of this section, a confidential communications request shall be implemented by the health insurer within 7 calendar days of the receipt of an electronic transmission, telephonic request, or request submitted through the health insurer’s internet website, or within 14 calendar days of receipt by first-class mail. The health insurer shall acknowledge receipt of the confidential communications request and advise the insured of the status of implementation of the request if an insured contacts the insurer.

(c) (1) A health insurer shall notify insureds that they may request a confidential communication pursuant to subdivision (b) and how to make the request.

(2) The information required to be provided pursuant to this subdivision shall be provided to insureds with individual or group coverage upon initial enrollment and annually thereafter upon renewal. The information shall also be provided in the following manner:

(A) In a conspicuously visible location in the evidence of coverage.

(B) On the health insurer’s internet website, accessible through a hyperlink on the internet website’s home page and in a manner that allows insureds, prospective insureds, and members of the public to easily locate the information.

(d) Notwithstanding subdivision (b), a provider of health care may make arrangements with the insured for the payment of benefit cost sharing and communicate that arrangement with the insurer.

(e) A health insurer shall not condition coverage on the waiver of rights provided in this section.

(f) If the commissioner determines that an insurer has violated this section, the commissioner may, after appropriate notice and opportunity for hearing in accordance with the Administrative Procedure Act (Chapter 5 (commencing with Section 11500) of Part 1 of Division 3 of Title 2 of the Government Code), by order, assess a civil penalty not to exceed five thousand dollars ($5,000) for each violation, or, if a violation was willful, a civil penalty not to exceed ten thousand dollars ($10,000) for each violation. The commissioner shall have the discretion to determine the acts or omissions that constitute a violation of this section.

(g) For purposes of this section:

(1) “Confidential communications request” means a request by an insured covered under a health insurance policy that insurance communications containing medical information be communicated to the insured at a specific mail or email address or specific telephone number, as designated by the insured.

(2) “Medical information” means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health insurer, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, email address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity.

(3) “Protected individual” means any adult insured covered under a health insurance policy or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. “Protected individual” does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.

(4) “Sensitive services” means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender-affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient of any age at or above the minimum age specified for consenting to the service specified in the section.

791.32.

A licensee, surplus line insurer, or reinsurer shall develop, implement, and maintain a program of administrative, technical, and physical safeguards sufficient to ensure the confidentiality, integrity, and availability of nonpublic information in the possession of the licensee, surplus line insurer, or reinsurer.

791.33.

(a) A licensee, surplus line insurer, reinsurer, or third-party service provider shall promptly, and in a manner and form specified by the commissioner, provide notice to the commissioner of an incident constituting a breach, as defined in subdivision (g) of Section 1798.82 of the Civil Code. Notice to the commissioner shall comply with Section 1798.82 of the Civil Code.

(b) A producer that, pursuant to subdivision (j) of Section 791.13, receives personal information from another licensee shall promptly report to the disclosing licensee any incident of unauthorized access to, or acquisition, disclosure, or use of, that personal information, consistent with the reporting obligation imposed on a third-party service provider under paragraph (3) of subdivision (b) of Section 791.24.

791.34.

(a) A licensee, surplus line insurer, reinsurer, or third-party service provider that, pursuant to an insurance transaction with a consumer, takes title to a vehicle storing personal information of a consumer, shall restore the vehicle to a factory default setting, thereby removing the consumer’s personal information, before selling or transferring title to the vehicle and shall not further process or share personal information obtained in this manner.

(b) A licensee, surplus line insurer, reinsurer, or third-party service provider that, pursuant to an insurance transaction with a consumer, takes title to or has leased, loaned, or otherwise provided for use by a consumer a device, other than a vehicle, capable of storing personal information of a consumer shall, upon taking or retaking possession of the nonvehicular device, delete any personal information within a reasonable period of time, and shall not further process or share personal information obtained in this manner.

(c) This section does not require the deletion of privileged information or information that the licensee, surplus line insurer, reinsurer, or third-party service provider is prohibited by law from deleting.

(d) Destroying a device capable of storing personal information, or rendering unreadable the personal information stored on the device capable of storing personal information, shall satisfy the requirements of this section.

(e) A licensee, surplus line insurer, reinsurer, or third-party service provider shall not sell or transfer title to a device capable of storing the personal information of a consumer.

(f) (1) This section is satisfied if any of the following apply before selling or transferring the title of a vehicle:

(A) The licensee, surplus line insurer, reinsurer, or third-party service provider determines, after thorough and complete visual inspection, that damage to the vehicle’s electrical system prevents any access to the components storing personal information.

(B) The licensee, surplus line insurer, reinsurer, or third-party service provider is unable to power on the vehicle after making all reasonable attempts to do so that do not create a reasonable risk to the health or safety of an employee, contractor, or other person acting on behalf of the licensee, surplus line insurer, reinsurer, or third-party service provider.

(C) The vehicle is determined to contain a biohazard or other hazardous condition that would make access to the vehicle or its electronic systems unsafe.

(D) Accessing the components storing personal information would create a reasonable risk to the health or safety of an employee, contractor, or other person acting on behalf of the licensee, surplus line insurer, reinsurer, or third-party service provider.

(E) The licensee, surplus line insurer, reinsurer, or third-party service provider destroys or renders unreadable the personal information stored on the vehicle.

(2) Other than as provided in subparagraph (B) of paragraph (1), this section does not require a licensee, surplus line insurer, reinsurer, or third-party service provider to repair, restore, energize, disassemble, or otherwise alter a vehicle or vehicular system for the purpose of removing personal information.

(g) For purposes of this section, the following definitions apply with respect to vehicles and vehicular systems:

(1) “Device capable of storing personal information” includes both of the following:

(A) A device that plugs into a vehicle’s on-board diagnostics II.

(B) Any other electronic device that is attached to a vehicle or vehicular system, and that is capable of storing personal information of a consumer.

(2) “Factory default setting” means a manufacturer-provided factory reset, master reset, or substantially equivalent process that restores the vehicle’s electronic systems to their default factory settings and that has the effect of deleting personal information stored on the system being reset.

(3) “Vehicle” has the same meaning as “motor vehicle” as defined in Section 415 of the Vehicle Code.

(h) Subdivision (g) does not limit the applicability of this article.

791.35.

A licensee, surplus line insurer, or reinsurer shall not retaliate against a consumer because the consumer exercised or attempted to exercise the consumer’s rights pursuant to this article. A licensee, surplus line insurer, or reinsurer retaliates against a consumer if the licensee, surplus line insurer, or reinsurer, as a result of a consumer’s privacy choices, does any of the following:

(a) Infringes upon a right, or impairs or impedes a benefit or protection, that is afforded to consumers under this article.

(b) Requires the consumer to consent to sharing of the consumer’s personal information for a purpose unrelated to an insurance transaction to obtain a particular product, coverage, rate, or service, if the consumer has an option to consent to sharing pursuant to this article.

(c) Imposes a fee or charge for a consumer to exercise the consumer’s rights pursuant to this article.

(d) Charges a different rate or premium to the consumer, provides a different insurance product, refuses to write insurance coverage for the consumer, or denies a claim under an insurance product purchased by the consumer.

791.36.

(a) Any documents, materials, data, or information in the control or possession of the commissioner that are furnished by a licensee, surplus line insurer, reinsurer, or third-party service provider, or an employee or agent thereof acting on behalf of the licensee, surplus line insurer, reinsurer, or third-party service provider, pursuant to this article, or that are obtained by the commissioner in any investigation, or an examination pursuant to this article shall be confidential by law and privileged, shall not be subject to the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code), shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in a private civil action. This article does not limit the commissioner’s authority to use and, if appropriate, to make public, a final or preliminary examination report, examiner or company work papers or other documents, or any other information discovered or developed during the course of any examination in the furtherance of a legal or regulatory action that the commissioner may, in the commissioner’s discretion, deem appropriate.

(b) The commissioner or a person who receives documents, data, materials, or information while acting pursuant to the authority of the commissioner shall not be permitted or required to testify in a private civil action concerning confidential documents, materials, or information subject to this article.

(c) To assist in the performance of the commissioner’s duties pursuant to this article, the commissioner:

(1) May share documents, data, materials, or information, including the confidential and privileged documents, data, materials, or information subject to this article, with other state, federal, and international regulatory agencies, the National Association of Insurance Commissioners, its affiliates, or subsidiaries, a third-party consultant or vendor, and with state, federal, and international law enforcement authorities, if the recipient agrees in writing to maintain the confidentiality and privileged status of the documents, data, materials, or information.

(2) May receive documents, data, materials, or information, including otherwise confidential and privileged documents, data, materials, or information, from the National Association of Insurance Commissioners, its affiliates, or subsidiaries and from regulatory and law enforcement officials of other foreign or domestic jurisdictions, and shall maintain as confidential or privileged the documents, data, materials, or information received with notice or the understanding that it is confidential or privileged pursuant to the laws of the jurisdiction that is the source of the documents, data, materials, or information.

(3) Shall enter into a written agreement with a third-party consultant or vendor governing sharing and use of documents, data, materials, or information provided pursuant to this article, consistent with this subdivision that shall do all of the following:

(A) Specify that the third-party consultant or vendor agrees in writing to maintain the confidentiality and privileged status of the documents, data, materials, or information subject to this article.

(B) Specify that the ownership of the documents, data, materials, or information shared pursuant to this article with the third-party consultant or vendor remains with the commissioner, and the third-party consultant’s or vendor’s use of the information is subject to the direction of the commissioner.

(C) Prohibit the third-party consultant or vendor from retaining the documents, data, materials, or information shared pursuant to this article after the purposes of the contract have been satisfied.

(D) Require prompt notice be given to the commissioner if confidential documents, data, materials, or information in possession of the third-party consultant or vendor pursuant to this article is subject to a request or subpoena to the third-party consultant or vendor for disclosure or production.

(E) Require the third-party consultant or vendor to consent to intervention by a licensee, surplus line insurer, reinsurer, or third-party service provider in a judicial or administrative action in which the third-party consultant or vendor may be required to disclose confidential information about the licensee, surplus line insurer, reinsurer, or third-party service provider shared with the third-party consultant or vendor pursuant to this article.

(d) A waiver of any applicable privilege or claim of confidentiality in the documents, data, materials, or information shall not occur due to disclosure to the commissioner pursuant to this section or due to sharing as authorized in this article.

(e) This article does not prohibit the commissioner from exercising discretion, pursuant to applicable laws, to release final, adjudicated actions that are open to public inspection to a database or other clearinghouse service maintained by the National Association of Insurance Commissioners, its affiliates, or subsidiaries.

791.37.

(a) Notwithstanding any other law, a licensee, surplus line insurer, reinsurer, or third-party service provider shall maintain sufficient evidence in its records of compliance with this article for the calendar year in which the activities governed by this article occurred and the five calendar years thereafter.

(b) A licensee, surplus line insurer, reinsurer, or third-party service provider shall maintain all records necessary for compliance with this article, including all of the following:

(1) Records related to the consumer’s rights of access, correction, deletion, and adverse underwriting information pursuant to this article.

(2) Copies of any consent executed by a consumer pursuant to this article, for as long as the consumer is in a continuing business relationship with the licensee, surplus line insurer, or reinsurer.

(3) Representative samples of a notice required to be provided to a consumer pursuant to this article, for as long as the consumer is in a continuing business relationship with the licensee, surplus line insurer, or reinsurer.

791.38.

The provisions of this article are severable. If any provision of this article or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

791.39.

(a) This article preempts and supersedes all state laws and portions of state laws relating to consumer privacy that are inconsistent with this article.

(b) This article does not preempt or supersede existing federal or state law related to protected health information.

(c) The Legislature finds and declares that the act that added this section furthers the purposes and intent of the California Privacy Rights Act of 2020, and that the Insurance Commissioner shall retain primary responsibility for regulation of insurance privacy practices in accordance with the California Privacy Rights Act of 2020.

(d) This article shall not be construed to reduce or eliminate any existing records retention periods or supersede any legal requirements pertaining to records retention.

(e) This article shall not be construed to abridge or limit the rights of litigants, including parties to administrative proceedings, under the laws, or case law, of discovery of this state.

(f) This article does not limit or otherwise impede the reporting of suspected insurance fraud under Chapter 12 (commencing with Section 1871) or limit the legal immunities granted within Article 8 (commencing with Section 1879) of Chapter 12.

791.40.

(a) The commissioner may issue rules, regulations, and orders as the commissioner deems necessary to carry out this article.

(b) When adopting regulations pursuant to this section, the commissioner shall, to the extent reasonably possible, ensure that the commissioner’s regulations do not conflict with regulations adopted by California Privacy Protection Agency, to the extent that the regulations pertain to the same subject matter and are adopted pursuant to substantially similar authorizing statutes.

(c) The commissioner shall adopt regulations providing model policies, forms, and contracts that licensees may use for compliance with this article.

791.41.

This article shall become operative on July 1, 2028.

SEC. 2.1.

Section 791.07 is added to the Insurance Code, to read:

791.07.

(a) A licensee, surplus line insurer, reinsurer, or third-party service provider shall not prepare or request an investigative consumer report about a consumer in connection with an insurance transaction involving an application for insurance, a policy renewal, a policy reinstatement, or a change in insurance benefits, unless the licensee, surplus line insurer, reinsurer, or third-party service provider informs the consumer of both of the following in writing before the report preparation:

(1) That the individual may request to be interviewed in connection with the preparation of the investigative consumer report, and the licensee, surplus line insurer, reinsurer, or third-party service provider shall conduct the interview.

(2) That upon a request pursuant to Section 791.08, the individual is entitled to receive a copy of the investigative consumer report.

(b) If an investigative consumer report is to be prepared by a licensee, surplus line insurer, or reinsurer, the licensee, surplus line insurer, or reinsurer shall institute reasonable procedures to conduct a personal interview requested by a consumer.

(c) If an investigative consumer report is to be prepared by a third-party service provider, the licensee, surplus line insurer, or reinsurer shall notify the third-party service provider in writing if a personal interview has been requested by the consumer. The third-party service provider shall conduct the interview requested.

(d) If a licensee, surplus line insurer, or reinsurer uses a third-party service provider to obtain or prepare an investigative consumer report, the written contract between the licensee, surplus line insurer, or reinsurer and the third-party service provider shall require the third-party service provider to do both of the following:

(1) Comply with the requirements of this section.

(2) Not process or share personal information provided to the third-party service provider by the licensee, surplus line insurer, or reinsurer or obtained by the third-party service provider in its investigation of the consumer other than to fulfill the purpose of the contract with the licensee, surplus line insurer, or reinsurer.

(e) A licensee, surplus line insurer, reinsurer, or third-party service provider that prepares or requests an investigative consumer report in connection with an insurance claim shall notify the consumer that the consumer may request to be interviewed in connection with the preparation of the investigative consumer report. The licensee, surplus line insurer, reinsurer, or third-party service provider is not required to provide a copy of an investigative report prepared in connection with an insurance claim, and that contains privileged information, unless compelled to do so by a state or federal court.

(f) A licensee, surplus line insurer, reinsurer, or third-party service provider shall not prepare or request an investigative consumer report that seeks an individual’s genetic information or full genome.

SEC. 2.2.

Section 791.11 is added to the Insurance Code, to read:

791.11.

A licensee, surplus line insurer, reinsurer, or insurance-support organization shall not seek information in connection with an insurance transaction concerning any of the following:

(a) A previous adverse underwriting decision experienced by an individual unless the inquiry also requests the reasons for the previous adverse underwriting decision.

(b) Any insurance coverage obtained by a consumer through a residual market mechanism, unless the inquiry also requests the reasons for a previous adverse underwriting decision or the reasons why insurance coverage was previously obtained through a residual market mechanism.

(c) An individual’s genetic information or full genome, except, unless prohibited by law, an insurance institution, agent, or insurance-support organization may seek genetic information in connection with an insurance transaction if all of the following are true:

(1) The genetic information is included in the medical record of the individual, and is not sought from any other source or record.

(2) The genetic information is not derived from a direct-to-consumer test.

(3) The genetic information is for the purpose of ruling out an adverse finding based on the individual’s medical record and the individual has provided informed, written consent for the release, disclosure, and use of the genetic test results or has provided the genetic test results to the insurer.

SEC. 2.3.

Section 791.12 is added to the Insurance Code, to read:

791.12.

A licensee, third-party service provider, surplus line insurer, or reinsurer shall not base an adverse underwriting decision in whole or in part on the following:

(a) On the fact of a previous adverse underwriting decision or on the fact that an individual previously obtained insurance coverage through a residual market mechanism. However, a licensee, third-party service provider, surplus line insurer, or reinsurer may base an adverse underwriting decision on further information obtained from a licensee, third-party service provider, surplus line insurer, or reinsurer responsible for a previous adverse underwriting decision. The further information, if requested, shall create a conclusive presumption that the information is necessary to perform the requesting insurer’s function in connection with an insurance transaction involving the individual and, if reasonably available, shall be furnished the requesting insurer and the individual, if applicable.

(b) On personal information received from an insurance-support organization whose primary source of information is licensees. However, a licensee, third-party service provider, surplus line insurer, or reinsurer may base an adverse underwriting decision on further personal information obtained as the result of information received from an insurance-support organization.

(c) On the fact that an individual has previously inquired and received information about the scope or nature of coverage under a residential fire or property insurance policy, if the information is received from an insurance-support organization whose primary source of information is licensees and the inquiry did not result in the filing of a claim.

(d) On the fact that an accident involving a peace officer, member of the Department of the California Highway Patrol, or firefighter has been reported and the insurer does not retain liability pursuant to Section 488.5 and subdivision (b) of Section 557.5.

(e) An individual’s genetic information or full genome, except, unless prohibited by law, an insurance institution or agent may base an underwriting decision in part on genetic information if all of the following are true:

(1) The genetic information is included in the medical record of the individual.

(2) The genetic information is not derived from a direct-to-consumer test.

(3) The genetic information is for the purpose of ruling out an adverse finding based on the individual’s medical record and the individual has provided informed, written consent for the release, disclosure, and use of the genetic test results or has provided the genetic test results to the insurer.

SEC. 3.

Section 791.30 is added to the Insurance Code, immediately following Section 791.29, to read:

791.30.

This article shall become inoperative on July 1, 2028, and, as of January 1, 2029, is repealed.

SEC. 4.

The Legislature finds and declares that Section 2 of this act, which adds Sections 791.10, 791.13, 791.24, and 791.36 to the Insurance Code, imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:

(a) The documents protected from public disclosure pursuant to this act are not official records of the department. These documents contain confidential and sensitive information related to a licensee’s, surplus line insurer’s, reinsurer’s, or third-party service provider’s personal information privacy compliance, internal operations, and proprietary and trade secret information that, if made public, could potentially cause the licensee, surplus line insurer, reinsurer, or third-party service provider competitive harm or disadvantage, or expose a licensee’s, surplus line insurer’s, reinsurer’s, or third-party service provider’s personal information practices to malicious external actors.

(b) The interests in protecting the internal operations and proprietary and trade secret information of the licensees, surplus line insurers, reinsurers, and third-party services providers, in order to promote consumer choice and competition in the marketplace and prevent malicious actors from exploiting this information, strongly outweigh the public interest in having access to this information, and there are other means to obtain this information, such as a subpoena for the original source of the information.

SEC. 5.

Sections 2.1, 2.2, and 2.3 of this bill incorporate amendments to Sections 791.07, 791.11, and 791.12 of the Insurance Code proposed by this bill and Assembly Bill 1798. Those sections of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2027, (2) each bill amends Sections 791.07, 791.11, and 791.12 of the Insurance Code, and (3) this bill is enacted after Assembly Bill 1798, in which case Sections 791.07, 791.11, and 791.12 of the Insurance Code, as amended by Assembly Bill 1798, shall remain operative only until the operative date of Section 2 of this bill, at which time Sections 2.1, 2.2, and 2.3 of this bill shall become operative, and Sections 791.07, 791.11, and 791.12 as added by Section 2 of this bill shall not become operative.

SEC. 5.SEC. 6.

No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.