May 21, 2019

CCPA and IIPPA Update

By Jo Cicchetti and Gail J. Kamal

Earlier this year, California legislators proposed A.B. 9811  (“the proposal”), which, among other things, would have exempted insurance institutions, agents and support organizations2  (“insurers”) from many provisions of the California Consumer Privacy Act of 20183  (“CCPA”). However, as of the April 30 amendment,4  the exemption has not survived. The current version of the bill only exempts insurers from the CCPA insofar as it eliminates a consumer’s right to request that an insurer delete or not sell the consumer’s personal information when the insurer’s retaining or sharing of that information is necessary to complete an insurance transaction on behalf of the consumer.

In addition, the proposal would also amend the Insurance Information and Privacy Protection Act5  (“IIPPA”). Those amendments include the following:

  • Expanding the IIPPA’s requirement that insurers disclose to consumers their information and privacy practices by requiring 1) that the same types of disclosures are made to the general public, and 2) that those disclosures also include the categories of personal information to be collected and the purposes for which the categories of personal information will be used;
  • Requiring insurers to provide a reasonable means by which an individual may exercise the right to opt out of any such disclosures;
  • Amending the definition of “Personal Information” to mirror the CCPA definition, except that the IIPPA definition does not include a reference to “household”;
  • Requiring insurers to implement a written security program with specific program content requirements, including staff training, regular testing, and a third-party management program; and
  • Adding definitions for “Aggregate consumer information,” “Biometric information,” and “Deidentified” information.6

Bottom line: the potential for overlapping requirements and regulators for the insurance industry still exists, and insurers should not delay in preparing for the January 1, 2020, CCPA compliance date.

1 A.B. 981 (Cal. 2019–2020), introduced February 21, 2019.

2 Defined as “insurance institutions, agents, and support organizations” (“Bill Analysis” by Nichole Rapier, P. & C. P., 4/19/19) for the 4/23/19 Hearing on A.B. 981 by the Privacy & Consumer Protection Committee.

3 Cal. Civ. Code §§1798.100–1798.199.

4 A.B. 981 (Cal. 2019–2020), amended April 30, 2019.

5 CA INS § 791.

6 A.B. 981 (Cal. 2019–2020)

The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.

Related Legal Services

Related Industries

The Faegre Drinker Biddle & Reath LLP website uses cookies to make your browsing experience as useful as possible. In order to have the full site experience, keep cookies enabled on your web browser. By browsing our site with cookies enabled, you are agreeing to their use. Review Faegre Drinker Biddle & Reath LLP's cookies information for more details.