New York consumer privacy (Reg 169) and DFS cybersecurity requirements (23 NYCRR 500)

Two different duties: who sees the information, and how it is protected

New York places two separate obligations on insurers and producers, and the exam tests whether you can keep them apart.

• Privacy decides who may receive a consumer's nonpublic personal information, and what the consumer must be told about it. In New York, privacy rules for insurance licensees come from Regulation 169 (11 NYCRR Part 420), the state's version of the federal Gramm-Leach-Bliley Act (GLBA) privacy rules.
• Cybersecurity decides how the information and the systems that hold it are protected from attack, misuse and disruption. That is the Department of Financial Services (DFS) cybersecurity regulation, 23 NYCRR Part 500.

The federal foundation

Congress declared that every financial institution, which includes insurers, has an affirmative and continuing obligation to respect customers' privacy and to protect the security and confidentiality of their nonpublic personal information. Regulators must set standards for administrative, technical and physical safeguards that secure customer records, protect against anticipated threats, and prevent unauthorized access that could cause substantial harm or inconvenience to a customer. For insurance, the states carry out this mandate.

Regulation 169: privacy of financial and health information

Regulation 169 applies to every DFS licensee, including agents and brokers. Its core rules:

• Consumer vs. customer. A consumer is an individual who seeks or obtains an insurance product for personal, family or household purposes. A customer is a consumer with a continuing relationship, such as a policyholder.
• Privacy notices. A customer gets an initial privacy notice no later than when the relationship begins, and an annual notice while it continues. The notice describes what nonpublic personal information is collected, what is shared and with whom, and how it is protected.
• Financial information: opt-out. Before nonpublic personal financial information goes to a nonaffiliated third party, the consumer must receive notice and a reasonable opportunity to opt out. Exceptions cover things like processing the consumer's own transaction, service providers under contract, fraud prevention and legal compliance.
• Health information: opt-in. Nonpublic personal health information may not be disclosed without the individual's authorization, except for core insurance functions such as underwriting, claims administration and fraud investigation. Health information is stricter than financial information.
• Account numbers may not be shared with a nonaffiliated third party for its marketing.
• Producers acting for an insurer. A producer who is an agent of an insurer generally does not send separate notices if the insurer's notice covers the producer and the producer shares information only as that notice allows.

Part 500: the DFS cybersecurity regulation

Part 500 reaches any person licensed under the Insurance Law, the Banking Law or the Financial Services Law, so licensed producers are covered entities. Each covered entity must:

1. Maintain a cybersecurity program, based on a risk assessment, that identifies risks, protects systems, detects events, responds, recovers and meets reporting duties.
2. Designate a Chief Information Security Officer (CISO), who reports in writing at least annually to the senior governing body.
3. Keep written incident response and business continuity and disaster recovery plans.
4. Notify the superintendent within 72 hours of determining that a cybersecurity incident has occurred.
5. Submit an annual certification of material compliance, or an acknowledgment of noncompliance with a remediation timeline, by April 15, signed by the highest-ranking executive and the CISO.

Exemptions that matter to producers

• Limited exemption if the entity meets any one test: fewer than 20 employees and independent contractors, less than $7.5 million in gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets. It removes some duties, such as the CISO and the incident response plans, but not the 72-hour notice or the annual April 15 filing.
• An agent or employee covered by the cybersecurity program of the entity it works for is exempt and need not build its own program.
• An individual broker who has not sold or placed insurance for compensation for at least one year can qualify for a further exemption.

One failure to act, or a material failure to comply for any 24-hour period, is a violation. Penalties weigh cooperation, good faith, harm to consumers and similar factors.