NAIC Privacy Protections Working Group Takes First Step on Its New Path ‎Forward

The Privacy Protections (H) Working Group of the National Association of Insurance Commissioners (“NAIC”) met on Wednesday June 12, 2024, to consider which proposed path forward to pursue as it considers a new NAIC privacy model presumably for all licensed insurance entities and insurance lines of business. Readers will recall that last month, the working group posed to the public a two-part question should the working group: (i) continue its work on a combined unitary draft Model 674[1] which would replace Models 670[2] and 672[3] as a unitary model applicable to all licensees and lines of business? or (ii) revise one or both of the preexisting Models 670 and 672? In a twist, a consortium of trade associations offered a revised version of Model 672, which they referred to as 672+, as an option for public comment. In a close vote, the working group decided to revise Model 672, effectively abandoning last year’s work on draft Model 674, while also not embracing the trades’ proposed Model 672+.

Background

In January 2023, the working group exposed its first draft of the unitary Model 674 which it was contemplated would replace Models 670 and 672. The draft was immediately controversial. The working group hosted numerous public comment periods, including public drafting sessions, over a number of months. At the August 2023 Summer National Meeting the working group put its work on draft Model 674 on hold as it became clear there was insufficient support to move forward with that draft. Following the March 2024 Spring National Meeting, the working group sought input from the public on its proposed new path forward. Should it return to the draft Model 674, revise both of the preexisting privacy models (Model 670 & Model 672), or focus on revising one of the preexisting models? A coalition of trade associations[4], offered their own proposed draft revising the preexisting Model 672. The public comment period closed on May 30.

The Results

During this week’s public meeting the comments received divided clearly. The consumer representatives preferred to reopen the draft Model 674, emphasizing their preference for opt-in rather than opt-out as the default. In contrast, industry representative preferred their proposed 672+. At the conclusion of the public comments, the Vice Chair expressed her opinion that Model 672 may be more implementable, while the Chair observed that revisions to Model 672 appeared to have the support of a majority of the working group members. In the interest of transparency, the Chair asked for a formal roll call vote. A majority of the working group members chose to abandon the draft Model 674 and focus on revising the preexisting Model 672. It was a close vote: 9 yea, 6 nay, 2 abstentions. Furthermore, a number of regulators in attendance did not vote when their state was called upon – choosing not even to answer “abstain,” but rather to lodge no vote whatsoever, only silence.

The New Path Forward

The majority in support of moving forward with revising Model 672 is not a unified bloc. Three of the “yay” votes added a caveat to their support, initially raised by Bob Wake of Maine, that it is not where they start, but the final result that matters – these states expressed a need to begin the substantive work of drafting a new model. Without the 3 caveat states (Maine, Maryland, Wisconsin) putting aside their reservations to vote “yay,” the vote would have failed. It is clear that a plurality of states oppose reopening draft Model 674. Similarly, a plurality of states prefer to revise Model 672. However, a similar number of states choose to abstain or not vote at all. In this environment and without a clear mandate, the working group will move forward with revisions to Model 672. The extent to which contributions from the industry-proposed 672+ will be incorporated is uncertain.

Locke Lord will continue to monitor developments at the working group. If you have any ‎questions, please reach out to the author or your Locke Lord partner.‎

See also previous Locke Lord commentary on the working group’s prior efforts: NAIC Privacy Protections Working Group’s Path Forward, NAIC’s Work on Privacy Model Grinds On, and NAIC Picking Up Steam ‎as it Drafts New Privacy Model.‎

[1] Insurance Consumer Privacy Protection Model Act (#674) – proposed draft July 2023.

[2] Insurance Information and Privacy Protection Model Act (#670).

[3] Privacy of Consumer Financial and Health Information Regulation (#672).

[4] American Council of Life Insurers, America’s Health Insurance Plans, American Property Casualty Insurance ‎Association, National Association of Mutual Insurance Companies, and the Association for Independent Agents.‎