Oregon Privacy of Consumer Information

Oregon’s Insurance Information and Privacy Protection law, ORS 746.600 to 746.690, controls how insurers and producers collect, use and share personal information about the people they insure. For property and casualty business it applies to personal lines: insurance bought primarily for personal, family or household needs, not business needs. The Director’s rules, OAR 836-080-0501 to 0551, set out the privacy notices that go with it.

Privacy of Consumer Information (ORS 746.600, 746.620, 746.630, 746.665; OAR 836-080-0501 to 836-080-0551)

Who and what the law covers (ORS 746.600)

The law applies to licensees: insurers, insurance producers and anyone else licensed, or required to be licensed, under the Insurance Code. It uses these terms:

• Personal information means personal financial information, individually identifiable health information, or protected health information
• Personal financial information is information identifiable with an individual, gathered in connection with an insurance transaction, from which judgments can be made about the person’s character, habits, avocations, finances, occupation, general reputation, credit or other personal characteristics. It also includes the person’s name, address and policy number. It does not include information the licensee reasonably believes is lawfully available to the public, such as government records
• Privileged information relates to a claim for insurance benefits, or a civil or criminal proceeding, involving the individual, and is collected in connection with or in anticipation of one
• Personal insurance means private passenger auto; homeowners, mobile homeowners, condominium owners and renters; personal dwelling property; personal liability and theft, including excess personal liability; and personal inland marine coverage
• A consumer is an individual who seeks, obtains or has obtained an insurance product for personal, family or household purposes, and about whom the licensee has personal information. A customer is a consumer with a continuing relationship with the licensee. An applicant who never buys the policy is a consumer but not a customer (OAR 836-080-0506)

In property and casualty lines, an adverse underwriting decision includes:

• A declination or termination of coverage. Termination means cancellation or nonrenewal for any reason other than nonpayment of premium
• A producer’s failure to apply for coverage with an insurer the producer represents, when the applicant asked for that insurer
• Placing the risk in a residual market mechanism, with an unauthorized insurer, or with an insurer that specializes in substandard risks
• Charging a higher rate based on information that differs from what the applicant or policyholder furnished
• An increase in a charge for personal insurance in connection with underwriting (a service fee does not count)

Notice of insurance information practices (ORS 746.620)

A licensee must give a written, clear and conspicuous privacy notice. It may be delivered electronically if the recipient agrees.

• Initial notice: to a consumer who becomes a customer, not later than the date the continuing relationship begins. It may come within a reasonable time after that if the relationship was not the customer’s choice, or if giving it at the start would substantially delay the transaction and the customer agrees to receive it later. A telephone sale with prompt delivery of the policy is an example; a sale made in person at the licensee’s office is not (OAR 836-080-0516)
• To a consumer who is not a customer, the notice goes before the licensee discloses any personal information about them to a nonaffiliated third party, unless it shares only under the non-marketing exceptions in ORS 746.665 (OAR 836-080-0516). A disclosure for marketing always requires the notice first
• Annual notice: at least once in any period of 12 consecutive months while the customer relationship lasts. It is not required if the licensee shares personal information with unaffiliated third parties only as ORS 746.665 allows and has not changed the practices it last described. No annual notice is owed to a former customer (OAR 836-080-0523)
• In Oregon, the initial notice is given again when further information is collected at a renewal or reinstatement (OAR 836-080-0516)

The notice describes, among other things, the categories of personal information the licensee collects and discloses, the individual’s right to authorize disclosure and how to exercise it, how the licensee protects the confidentiality and security of the information, and the individual’s rights of access and correction. Where the licensee discloses information to nonaffiliated third parties for marketing, it also explains the right to opt out of that sharing (OAR 836-080-0519).

A notice must be delivered so that each consumer can reasonably be expected to receive actual notice. Handing over a printed copy, or mailing it (separately or with a policy or bill), meets that standard. Only posting a sign in the office, or emailing a consumer who did not do business with the licensee electronically, does not. An oral explanation alone is never enough (OAR 836-080-0536).

The producer exemption. An insurance producer does not have to give its own notice when the insurer it acts for complies with the notice requirement, and the producer discloses personal information only to that insurer or its affiliate, or as otherwise authorized by law (ORS 746.620(8); OAR 836-080-0511).

Authorization for disclosure (ORS 746.630)

When a disclosure needs the individual’s permission, the licensee uses a written authorization form (the “opt in” form). The form must be clear and conspicuous and contain:

• The identity of the individual the information is about
• A general description of the categories of information to be disclosed
• A general description of who will receive it, why, and how it may be used
• The signature of the individual (or a person legally empowered to act for them) and the date
• Notice of how long the authorization is valid, that it may be revoked at any time, and how to revoke it

An authorization is not valid for more than 24 months (ORS 746.630(2)). An authorization submitted by someone who is not a licensee or insurance-support organization must also be dated, signed, and obtained one year or less before the disclosure is sought (ORS 746.665(1)(a)). It may be revoked at any time, subject to the rights of anyone who relied on it before learning of the revocation. The licensee keeps the authorization, or a copy, in the individual’s record.

Limits on disclosure (ORS 746.665)

Oregon’s starting point is that nothing is shared without permission. A licensee may not disclose any personal or privileged information about an individual collected in connection with an insurance transaction, unless the disclosure meets one of the conditions the statute lists. The main ones are:

• With the individual’s written authorization
• To a person performing a business, professional or insurance function for the licensee, who agrees not to disclose it further without the individual’s written authorization
• To another licensee or insurance-support organization, limited to what is reasonably necessary to detect or prevent fraud, criminal activity or material misrepresentation, or to perform its function in a transaction involving the individual
• To an insurance regulator, to law enforcement in certain cases, as permitted or required by law, or in response to a valid subpoena, warrant or court or administrative order
• To an affiliate, for an audit or to market a financial product or service. Health information may not be shared with an affiliate for marketing
• To a nonaffiliated third party for marketing, under the conditions of ORS 746.665(1)(k): the individual must have been given the privacy notice and an opportunity to opt out, and must not have opted out, and the recipient must agree to use the information only for that marketing. Privileged information may not be disclosed for marketing. No opt-out opportunity is needed for a disclosure under a joint marketing agreement, a formal written contract under which an insurer jointly offers, endorses or sponsors a financial product or service with a financial institution

Opting out. The opt-out under ORS 746.665 applies only to sharing with nonaffiliated third parties for marketing. The individual must be given a reasonable time to opt out, and may opt out at any time; neither the law nor the rules fix a number of days. The licensee honors an opt-out as soon as reasonably practicable, and it stays in effect until the individual revokes it in writing, or electronically if they agree (OAR 836-080-0541). It keeps covering information from a relationship that has ended, but does not carry over to a new customer relationship. A reasonable way to opt out includes a check-off box on the form, a reply form or a toll-free number. Requiring the consumer to write their own letter is not reasonable.

A licensee may not disclose a consumer’s policy number or account access code to a nonaffiliated third party for telemarketing, direct mail or email marketing, subject to narrow exceptions such as a producer or service provider marketing the licensee’s own products. Doing so is an unfair trade practice (OAR 836-080-0546).

Other rights under the law

• Pretext interviews are prohibited (ORS 746.615). In a pretext interview, the interviewer pretends to be someone else, pretends to represent someone they do not, misrepresents the interview’s purpose, or refuses to identify themselves. The one exception is investigating a claim, when specific information available for the Director’s review gives a reasonable basis to suspect criminal activity, fraud, material misrepresentation or material nondisclosure, and then only to interview a person or institution with no privileged relationship to the individual
• Before ordering an investigative consumer report, the insurer or producer must tell the individual that they may ask to be interviewed for it, and may receive a copy (ORS 746.635)
• An individual may request access to recorded personal information, and ask for it to be corrected. The licensee responds within 30 business days (ORS 746.640, 746.645)
• After an adverse underwriting decision, the individual may ask in writing, within 90 business days, for the specific reasons. The insurer or producer furnishes them within 21 business days. An insurer or producer may not give “poor credit history”, or any similar phrase, as a reason. A decision based on credit history or an insurance score must give no more than four of the most significant credit reasons (ORS 746.650)
• A licensee that discloses information in violation of ORS 746.665 is liable for the damages the individual sustains. The action must be brought within two years after the violation is, or should have been, discovered (ORS 746.680)

Sidenote

Know this...

Two figures are easy to confuse here. An authorization to disclose personal information lasts no more than 24 months. An opt-out of marketing disclosures has no expiration date; it lasts until the individual revokes it. And a producer who shares information only with the insurer it represents rides on the insurer’s privacy notice rather than giving its own.

Lesson summary

• ORS 746.600 to 746.690 cover personal lines, and apply to insurers and producers alike.
• Personal information includes financial, character and credit information, and a person’s name, address and policy number. Privileged information relates to a claim or a legal proceeding.
• A privacy notice goes to a new customer when the relationship begins, then annually (at least once in 12 consecutive months), unless the licensee shares only as the law allows and has not changed its practices. Oregon also requires it again when more information is collected at renewal or reinstatement.
• A producer need not give its own notice if the insurer complies and the producer shares information only with that insurer or its affiliate (ORS 746.620(8)).
• A disclosure authorization must be signed and dated, describe what is shared and with whom, and is valid for no more than 24 months (ORS 746.630).
• Oregon’s default is no disclosure without authorization, subject to a closed list of exceptions (ORS 746.665). The only opt-out under ORS 746.665 is for marketing by nonaffiliated third parties, and an opt-out lasts until revoked.
• Pretext interviews are banned, except in narrowly limited claim investigations of suspected fraud. Access and correction requests are answered within 30 business days. The reasons for an adverse underwriting decision are furnished within 21 business days of a request made within 90 business days.