Current through Register Vol. 35, No. 18, September 24, 2024
As used in this rule, unless the context requires
otherwise:
A.
"Affiliate" means a company that controls, is controlled by or is under
common control with another company.
B.
"Clear and conspicuous"
means that a notice is reasonably understandable and designed to call attention
to the nature and significance of the information in the notice. Examples:
(1)
Reasonably understandable.
A licensee makes its notice reasonably understandable if it:
(a) Presents the information in the notice in
clear, concise sentences, paragraphs and sections;
(b) Uses short explanatory sentences or
bullet lists whenever possible;
(c)
Uses definite, concrete, everyday words and active voice whenever
possible;
(d) Avoids multiple
negatives;
(e) Avoids legal and
highly technical business terminology whenever possible; and
(f) Avoids explanations that are imprecise
and readily subject to different interpretations.
(2)
Designed to call attention.
A licensee designs its notice to call attention to the nature and significance
of the information in it if the licensee:
(a)
Uses a plain-language heading to call attention to the notice;
(b) Uses a typeface and type size that are
easy to read;
(c) Provides wide
margins and ample line spacing;
(d)
Uses boldface or italics for key words; and
(e) In a form that combines the licensee's
notice with other information, uses distinctive type size, style, and graphic
devices, such as shading or sidebars.
(3)
Notices on web sites. If a
licensee provides a notice on a web page, the licensee designs its notice to
call attention to the nature and significance of the information in it if the
licensee uses text or visual cues to encourage scrolling down the page if
necessary to view the entire notice and ensure that other elements on the web
site (such as text, graphics, hyperlinks or sound) do not distract attention
from the notice, and the licensee either:
(a)
Places the notice on a screen that consumers frequently access, such as a page
on which transactions are conducted; or
(b) Places a link on a screen that consumers
frequently access, such as a page on which transactions are conducted, that
connects directly to the notice and is labeled appropriately to convey the
importance, nature and relevance of the notice.
C.
"Collect" means to obtain
information that the licensee organizes or can retrieve by the name of an
individual or by identifying number, symbol or other identifying particular
assigned to the individual, irrespective of the source of the underlying
information.
D.
"Superintendent" means the New Mexico Superintendent of
Insurance.
E.
"Company" means a corporation, limited liability company, business
trust, general or limited partnership, association, sole proprietorship or
similar organization.
F.
"Consumer" means an individual who seeks to obtain, obtains or has
obtained an insurance product or service from a licensee that is to be used
primarily for personal, family or household purposes, and about whom the
licensee has nonpublic personal information, or that individual's legal
representative. Examples:
(1) An individual
who provides nonpublic personal information to a licensee in connection with
obtaining or seeking to obtain financial, investment or economic advisory
services relating to an insurance product or service is a consumer regardless
of whether the licensee establishes an ongoing advisory relationship.
(2) An applicant for insurance prior to the
inception of insurance coverage is a licensee's consumer.
(3) An individual who is a consumer of
another financial institution is not a licensee's consumer solely because the
licensee is acting as agent for, or provides processing or other services to,
that financial institution.
(4) An
individual is a licensee's consumer if:
(a)
the individual is a beneficiary of a life insurance policy underwritten by the
licensee; the individual is a claimant under an insurance policy issued by the
licensee; the individual is an insured or an annuitant under an insurance
policy or an annuity, respectively, issued by the licensee; or the individual
is a mortgagor of a mortgage covered under a mortgage insurance policy;
and
(b) the licensee discloses
nonpublic personal financial information about the individual to a
nonaffiliated third party other than as permitted under 13.1.3.17 NMAC,
13.1.3.18 NMAC, and 13.1.3.19 NMAC.
(5) Provided that the licensee provides any
initial, annual and revised notices required under 13.1.3.8 NMAC, 13.1.3.9 NMAC
and 13.1.3.12 NMAC to the plan sponsor, group or blanket insurance
policyholder, group annuity contractholder, or workers' compensation
policyholder, and further provided that the licensee does not disclose
nonpublic personal information about such an individual other than as permitted
under 13.1.3.17 NMAC, 13.1.3.18 NMAC and 13.1.3.19 NMAC, an individual is not
the consumer of the licensee solely because he or she is:
(a) A participant or a beneficiary of an
employee benefit plan that the licensee administers or sponsors or for which
the licensee acts as a trustee, insurer or fiduciary;
(b) Covered under a group or blanket
insurance policy or group annuity contract issued by the licensee; or
(c) A claimant under a workers' compensation
policy.
(6) The
individuals described in subparagraphs (a) through (c) of paragraph (5) of
subsection F of 13.1.3. 7 NMAC are consumers of a licensee if the licensee does
not meet all the conditions of paragraph (5) of subsection F of 13.1.3.7 NMAC.
In no event shall the individuals, solely by virtue of the status described in
subparagraphs (a) through (c) of paragraph (5) of subsection F of 13.1.3.7
NMAC, be deemed to be customers for purposes of this rule.
(7) An individual is not a licensee's
consumer solely because he or she is a beneficiary of a trust for which the
licensee is a trustee.
(8) An
individual is not a licensee's consumer solely because he or she has designated
the licensee as trustee for a trust.
G.
"Consumer reporting agency"
has the same meaning as in Section 603(f) of the federal Fair Credit Reporting
Act (
15 U.S.C.
1681 a(f)).
H.
"Control" means:
(1) Ownership, control or power to vote
twenty-five percent (25%) or more of the outstanding shares of any class of
voting security of the company, directly or indirectly, or acting through one
or more other persons;
(2) Control
in any manner over the election of a majority of the directors, trustees or
general partners (or individuals exercising similar functions) of the company;
or
(3) The power to exercise,
directly or indirectly, a controlling influence over the management or policies
of the company, as the Superintendent determines.
I.
"Customer" means a consumer
who has a customer relationship with a licensee.
J.
"Customer relationship"
means a continuing relationship between a consumer and a licensee under which
the licensee provides one or more insurance products or services to the
consumer that are to be used primarily for personal, family or household
purposes. Examples:
(1) A consumer has a
continuing relationship with a licensee if:
(a) The consumer is a current policyholder of
an insurance product issued by or through the licensee; or
(b) The consumer obtains financial,
investment or economic advisory services relating to an insurance product or
service from the licensee for a fee.
(2) A consumer does not have a continuing
relationship with a licensee if:
(a) The
consumer applies for insurance but does not purchase the insurance;
(b) The licensee sells the consumer travel
insurance in an isolated transaction;
(c) The individual is no longer a current
policyholder of an insurance product or no longer obtains insurance services
with or through the licensee;
(d)
The consumer is a beneficiary or claimant under a policy and has submitted a
claim under a policy choosing a settlement option involving an ongoing
relationship with the licensee;
(e)
The consumer is a beneficiary or a claimant under a policy and has submitted a
claim under that policy choosing a lump sum settlement option;
(f) The customer's policy is lapsed, expired,
or otherwise inactive or dormant under the licensee's business practices, and
the licensee has not communicated with the customer about the relationship for
a period of twelve (12) consecutive months, other than annual privacy notices,
material required by law or rule, communication at the direction of a state or
federal authority, or promotional materials;
(g) The individual is an insured or an
annuitant under an insurance policy or annuity, respectively, but is not the
policyholder or owner of the insurance policy or annuity; or
(h) For the purposes of this rule, the
individual's last known address according to the licensee's records is deemed
invalid. An address of record is deemed invalid if mail sent to that address by
the licensee has been returned by the postal authorities as undeliverable and
if subsequent attempts by the licensee to obtain a current valid address for
the individual have been unsuccessful.
K.
"Financial institution"
means any institution the business of which is engaging in activities that are
financial in nature or incidental to such financial activities as described in
Section 4(k) of the Bank Holding Company Act of 1956 (
12 U.S.C.
1843 (k)). Financial institution does not
include:
(1) Any person or entity with respect
to any financial activity that is subject to the jurisdiction of the Commodity
Futures Trading Commission under the Commodity Exchange Act (
7
U.S.C. 1
et seq.);
(2) The Federal Agricultural Mortgage
Corporation or any entity charged and operating under the Farm Credit Act of
1971 (
12 U.S.C.
2001
et seq.); or
(3) Institutions chartered by Congress
specifically to engage in securitizations, secondary market sales (including
sales of servicing rights) or similar transactions related to a transaction of
a consumer, as long as the institutions do not sell or transfer nonpublic
personal information to a nonaffiliated third party.
L.
"Financial product or
service" means a product or service that a financial holding company
could offer by engaging in an activity that is financial in nature or
incidental to such a financial activity under Section 4(k) of the Bank Holding
Company Act of 1956 (
12 U.S.C.
1843 (k)). Financial service includes a
financial institution's evaluation or brokerage of information that the
financial institution collects in connection with a request or an application
from a consumer for a financial product or service.
M.
"Health care" means:
(1) Preventive, diagnostic, therapeutic,
rehabilitative, maintenance or palliative care, services, procedures, tests or
counseling that:
(a) Relates to the physical,
mental or behavioral condition of an individual; or
(b) Affects the structure or function of the
human body or any part of the human body, including the banking of blood,
sperm, organs or any other tissue; or
(2) Prescribing, dispensing or furnishing to
an individual drugs or biologicals, or medical devices or health care equipment
and supplies.
N.
"Health care provider" means a physician or other health care
practitioner licensed, accredited or certified to perform specified health
services consistent with state law, or a health care facility.
O.
"Health information" means
any information or data except age or gender, whether oral or recorded in any
form or medium, created by or derived from a health care provider or the
consumer that relates to:
(1) The past,
present or future physical, mental or behavioral health or condition of an
individual;
(2) The provision of
health care to an individual; or
(3) Payment for the provision of health care
to an individual.
P.
"Insurance product or service" means any product or service that
is offered by a licensee pursuant to the insurance laws of this state.
Insurance service includes a licensee's evaluation, brokerage or distribution
of information that the licensee collects in connection with a request or an
application from a consumer for a insurance product or service.
Q.
"Licensee" means all
licensed insurers, agents, brokers, solicitors, producers and other persons
licensed or required to be licensed, or authorized or required to be
authorized, or registered or required to be registered pursuant to the New
Mexico Insurance Code other than pursuant to Chapter 206 of the Laws of 2001
(Senate Bill 556, as amended).
(1) A licensee
is not subject to the notice and authorization requirements for nonpublic
personal financial information set forth in 13.1.3.8 NMAC through 13.1.3.21
NMAC if the licensee is an employee, agent or other representative of another
licensee ("the principal") and:
(a) The
principal otherwise complies with, and provides the notices required by, the
provisions of this rule; and
(b)
The licensee does not disclose any nonpublic personal information to any person
other than the principal or its affiliates in a manner permitted by this
rule.
(2) Subject to the
provisions of this paragraph, "licensee" shall also include an unauthorized
insurer that accepts business placed through a licensed surplus lines broker in
this state, but only in regard to the surplus lines placements placed pursuant
to NMSA 59A-14-1
et
seq. A
surplus lines broker or surplus lines insurer shall be deemed to be in
compliance with the notice and authorization requirements for nonpublic
personal financial information set forth in 13.1.3.8 NMAC through 13.1.3.19
NMAC provided:
(a) The broker or insurer does
not disclose nonpublic personal information of a consumer or a customer to
nonaffiliated third parties for any purpose, including joint servicing or
marketing under 13.1.3.17 NMAC, except as permitted by 13.1.3.18 NMAC or
13.1.3.19 NMAC; and
(b) The broker
or insurer delivers a notice to the consumer at the time a customer
relationship is established on which the following is printed in 16-point type:
PRIVACY NOTICE
"Neither the U.S. brokers that handled this insurance nor the
insurers that have underwritten this insurance will disclose nonpublic personal
information concerning the buyer to nonaffiliates of the brokers or insurers
except as permitted by law."
R.
"Nonaffiliated third party"
means any person except a licensee's affiliate; or a person employed jointly by
a licensee and any company that is not the licensee's affiliate (but
nonaffiliated third party includes the other company that jointly employs the
person). Nonaffiliated third party includes any company that is an affiliate
solely by virtue of the direct or indirect ownership or control of the company
by the licensee or its affiliate in conducting merchant banking or investment
banking activities of the type described in Section 4(k)(4)(H) or insurance
company investment activities of the type described in Section 4(k)(4)(I) of
the federal Bank Holding Company Act (
12 U.S.C.
1843 (k)(4)(H) and (I)).
S.
"Nonpublic personal
information" means nonpublic personal financial information and
nonpublic personal health information.
T.
"Nonpublic personal financial
information" means personally identifiable financial information; and
any list, description or other grouping of consumers (and publicly available
information pertaining to them) that is derived using any personally
identifiable financial information that is not publicly available.
(1) Nonpublic personal financial information
does not include:
(a) Health
information;
(b) Publicly available
information, except as included on a list described above in this section;
or
(c) Any list, description or
other grouping of consumers (and publicly available information pertaining to
them) that is derived without using any personally identifiable financial
information that is not publicly available.
(2)
Examples of lists.
(a) Nonpublic personal financial information
includes any list of individuals' names and street addresses that is derived in
whole or in part using personally identifiable financial information that is
not publicly available, such as account numbers.
(b) Nonpublic personal financial information
does not include any list of individuals' names and addresses that contains
only publicly available information, is not derived in whole or in part using
personally identifiable financial information that is not publicly available,
and is not disclosed in a manner that indicates that any of the individuals on
the list is a consumer of a financial institution.
U.
"Nonpublic personal
health information" means health information:
(1) That identifies an individual who is the
subject of the information; or
(2)
With respect to which there is a reasonable basis to believe that the
information could be used to identify an individual.
V.
"Personally identifiable financial
information" means any information a consumer provides to a licensee to
obtain an insurance product or service from the licensee; about a consumer
resulting from a transaction involving an insurance product or service between
a licensee and a consumer; or the licensee otherwise obtains about a consumer
in connection with providing an insurance product or service to that consumer.
Examples:
(1)
Information
included. Personally identifiable financial information includes:
(a) Information a consumer provides to a
licensee on an application to obtain an insurance product or service;
(b) Account balance information and payment
history;
(c) The fact that an
individual is or has been one of the licensee's customers or has obtained an
insurance product or service from the licensee;
(d) Any information about the licensee's
consumer if it is disclosed in a manner that indicates that the individual is
or has been the licensee's consumer;
(e) Any information that a consumer provides
to a licensee or that the licensee or its agent otherwise obtains in connection
with collecting on a loan or servicing a loan;
(f) Any information the licensee collects
through an Internet cookie (an information-collecting device from a web
server); and
(g) Information from a
consumer report.
(2)
Information not included. Personally identifiable financial
information does not include:
(a) Health
information;
(b) A list of names
and addresses of customers of an entity that is not a financial institution;
and
(c) Information that does not
identify a consumer, such as aggregate information or blind data that does not
contain personal identifiers such as account numbers, names or
addresses.
W.
"Publicly available information" means any information that a
licensee has a reasonable basis to believe is lawfully made available to the
general public from federal, state or local government records; widely
distributed media; or disclosures to the general public that are required to be
made by federal, state or local law.
(1)
Reasonable basis. A licensee has a reasonable basis to believe
that information is lawfully made available to the general public if the
licensee has taken steps to determine:
(a)
That the information is of the type that is available to the general public;
and
(b) Whether an individual can
direct that the information not be made available to the general public and, if
so, that the licensee's consumer has not done so.
(2)
Examples.
(a)
Government records.
Publicly available information in government records includes information in
government real estate records and security interest filings.
(b)
Widely distributed media.
Publicly available information from widely distributed media includes
information from a telephone book, a television or radio program, a newspaper
or a web site that is available to the general public on an unrestricted basis.
A web site is not restricted merely because an Internet service provider or a
site operator requires a fee or a password, so long as access is available to
the general public.
(c)
Reasonable basis. A licensee has a reasonable basis to believe that
mortgage information is lawfully made available to the general public if the
licensee has determined that the information is of the type included on the
public record in the jurisdiction where the mortgage would be recorded. A
licensee has a reasonable basis to believe that an individual's telephone
number is lawfully made available to the general public if the licensee has
located the telephone number in the telephone book or the consumer has informed
you that the telephone number is not unlisted.
