Michigan Consumer Privacy
Michigan’s privacy chapter, chapter 5 of the Insurance Code (MCL 500.501 to 500.547), controls what an insurer or producer may do with a consumer’s financial information. A separate rule, R 500.551 to R 500.560, requires every licensee to protect the customer information it holds. Both bind a producer personally, because “licensee” includes a licensed insurer or producer (MCL 500.503(l)).
What the Chapter Protects
The chapter covers “nonpublic personal financial information” about individuals who obtain, claim under or are beneficiaries of products used primarily for personal, family or household purposes. It does not cover information about companies, or about people buying for business, commercial or agricultural purposes (MCL 500.501(1)). A sole proprietor’s commercial package policy is outside it; the same person’s homeowners policy is inside.
Personally identifiable financial information is what a consumer gives you to obtain coverage, such as an application; what results from a transaction, such as a payment history or a claim; and anything else you obtain about the consumer in connection with providing the product or service (MCL 500.503(p)).
A list of consumers built using nonpublic financial information is protected. Publicly available information is excluded, and so is health and medical information that other state or federal law protects (MCL 500.501(3), 500.503(n)).
Consumers and Customers
A consumer is an individual who seeks to obtain, obtains or has obtained a personal-use insurance product or service, including an applicant before coverage begins (MCL 500.503(f)). A customer is a consumer with a continuing relationship, and for a producer the relationship begins “when the consumer obtains insurance through that licensee” (MCL 500.509(1)(b); 500.503(h), (i)).
Some people are not customers on that basis alone: a person covered under a group or blanket policy, a plan participant, a beneficiary and a claimant (MCL 500.503(h)). Group and plan members are not consumers either, so long as the licensee gives its notices to the plan sponsor or group policyholder and discloses their information only under the exceptions below (MCL 500.503(f)(ii)). A beneficiary, claimant or insured whose information is disclosed beyond those exceptions becomes a consumer (MCL 500.503(f)(i)(C)).
A relationship is not continuing if the policy has been inactive and you have not communicated with the person for 12 consecutive months, apart from privacy notices, required material and promotions. Nor is it continuing for an insured who is not the policyholder, or when mail came back and efforts to find a good address failed (MCL 500.509(2)).
The Notices
Initial notice
A customer gets a clear and conspicuous notice that accurately reflects your privacy practices no later than when the relationship starts (MCL 500.507(1)(a)). It may follow within a reasonable time only if the customer did not choose to establish the relationship, or if notice at the start would substantially delay the transaction and the customer agrees to wait (MCL 500.511(1)). A consumer who is not a customer needs a notice only before you disclose information to a nonaffiliated third party other than under MCL 500.537 and 500.539, described below (MCL 500.507(1)(c), (2)(a)).
The notice describes what you collect and disclose, the categories of parties receiving it, the consumer’s right to opt out and how to use it, and your policies for protecting confidentiality and security (MCL 500.515(1)). If you neither disclose nor reserve the right to disclose information except under MCL 500.537 and 500.539, a simplified notice may say so, along with what you collect and how you protect it (MCL 500.515(3)).
Annual and revised notices
Customers get the notice again at least once in every 12 consecutive months, a period you may define but must apply consistently (MCL 500.513(1)). No annual notice is owed to a former customer, or when you share information only under the exceptions and your practices have not changed since the last notice (MCL 500.513(2), (3)).
A revised notice is owed when an existing customer buys a new personal-use product and the notice they last received does not accurately cover it (MCL 500.509(3)). Before you disclose to a nonaffiliated third party in a way your initial notice did not describe, you must give a revised notice, a new opt-out notice and a reasonable chance to opt out (MCL 500.525).
Delivery
The test is whether the consumer can reasonably be expected to receive actual notice in writing, or electronically if the consumer agrees (MCL 500.527(1)). Handing over a printed copy, mailing one, or posting it online and requiring acknowledgment as a step in an online purchase all qualify. A sign in your office, a general advertisement, or an email to someone who did not buy electronically does not. Reading the notice aloud, in person or by phone, is never enough by itself (MCL 500.527(2), (4)). A customer must also be able to keep or retrieve it later (MCL 500.527(5)).
The Opt-Out
A licensee may not disclose a consumer’s nonpublic personal financial information to a nonaffiliated third party unless it has given the initial notice and an opt-out notice and allowed a reasonable opportunity to opt out, and the consumer has not done so (MCL 500.529(1)). The opt-out notice states that you disclose or reserve the right to disclose, that the consumer may opt out, and how (MCL 500.519(1)).
The opportunity is reasonable if you mail the notices and allow 30 days to respond by mailed form, toll-free call or another reasonable means. For an isolated transaction such as a quote, it is reasonable to give the notices at the time and require the decision before the transaction is completed (MCL 500.529(2)).
Suppose an agency mails its notices on March 1. The 30 days run through March 31, so the earliest it may disclose the information of anyone who has not opted out is April 1.
A consumer may opt out at any time, and you must comply as soon as reasonably practicable. An opt-out lasts until the consumer revokes it in writing, or electronically if the consumer agrees. It survives the end of the relationship for the information collected during it, and does not carry into a new relationship (MCL 500.523). Joint consumers may receive one notice. The notice says whether one consumer’s opt-out applies to all of them or each may opt out separately. Where each may opt out separately, one must be allowed to opt out for all, and the licensee can’t require all of them to opt out before it acts on any direction (MCL 500.521). A licensee may not unfairly discriminate against a consumer who opts out (MCL 500.543).
When the Opt-Out Does Not Apply
Disclosure to a nonaffiliated third party needs no opt-out in three groups of cases.
| Situation | Provision | What it requires |
|---|---|---|
| A vendor performs services for you, including marketing your own products | MCL 500.535 | The initial notice, and a contract barring the vendor from using the information for any other purpose |
| Necessary to carry out a transaction the consumer requests: servicing, claims, underwriting, premium processing, reinsurance | MCL 500.537 | Nothing further |
| Consent of the consumer, protecting records, preventing fraud, risk control, dispute resolution, fiduciaries, auditors and guaranty funds, regulators and law enforcement, a sale of the business, legal compliance, group plan replacement | MCL 500.539 | Nothing further; the consumer’s consent can be revoked |
Apart from sharing with affiliates, information received under MCL 500.537 or 500.539 may be used only to carry out that exception’s activity, and a recipient of yours is bound the same way (MCL 500.531).
One restriction has only narrow exceptions. You may not give a nonaffiliated third party, other than a consumer reporting agency, a consumer’s policy number, account number or access code for telemarketing, direct mail or email marketing (MCL 500.533(1)). You may give it to your own service provider that markets your products and cannot itself charge the account, to a producer solely to market the licensee’s own products, and to a participant in an affinity program identified to the customer on entry. An encrypted number is also allowed if the recipient cannot decode it (MCL 500.533(2), (3)).
Applying the Chapter to a Producer’s File
A producer who is the agent of an insurer that gives the required notices, and who shares information with no one but that insurer or its affiliates, need not give separate notices (MCL 500.505(1)). Whether an agency placing business with several insurers fits is unsettled, so give your own notice unless you have confirmed the exception applies.
A quote request. Nia Okafor asks an agency for a homeowners quote online. She is a consumer, not a customer, and nothing is owed until the agency wants to share her information outside the exceptions. The agency wants to give her contact details to a mortgage broker it has no contract with, so it must give a notice and an opt-out and wait for the decision. If Nia opts out, the details stay put, and the agency may not quote her a worse rate for it.
Two vendors. The same agency mails renewal reminders through a mailing house, and sells a customer list to a lender. The mailing house is a service provider, so the initial notice and a contract limiting its use are enough. The lender is not, so the opt-out applies, and policy numbers could not be on the list for the lender’s marketing.
A suspected fraud. A producer authorized to act for the insurer sees what looks like an altered repair estimate on a client’s claim and notifies the state police, an authorized agency (MCL 500.4501(a)). Disclosure to prevent fraud is an exception (MCL 500.539(c)), and an insurer or its authorized agent may notify an authorized agency of suspected fraud (MCL 500.4507(2)). Absent malice, the producer has no civil liability for providing it, unless the producer knows it contains false information about a material fact (MCL 500.4509(3)).
A purchased lead. A producer working a bought list of names may not use a method that fails to disclose conspicuously that a purpose of it is solicitation of insurance and that an agent or insurer will make contact. That is an unfair practice (MCL 500.2005a(c)).
Safeguarding Information
Each licensee must adopt policies and procedures for administrative, technical and physical safeguards for customer records (MCL 500.547(2)). R 500.553 turns this into a written information security program scaled to “the size and complexity of the licensee and the nature and scope of its activities,” designed to ensure security and confidentiality, protect against anticipated threats, and guard against unauthorized access that could cause substantial harm or inconvenience (R 500.554).
The rules give four steps as non-exclusive examples, and a licensee that performs all of them is treated as compliant (R 500.555):
- Assess risk: identify threats, estimate their likelihood and damage, and assess whether current controls suffice (R 500.556).
- Manage and control risk: design controls, train staff, and regularly test or monitor them (R 500.557).
- Oversee service providers: select them with due diligence and require appropriate safeguards (R 500.558).
- Adjust the program for changes in technology, sensitivity of data, threats and the licensee’s own business (R 500.559).
A one-person agency’s program may be short, but it must still be written.
A violation of chapter 5 or these rules is an unfair method of competition and an unfair or deceptive act or practice (MCL 500.2013; R 500.560(a)). A licensee that complies with all of the federal HIPAA privacy rule, including its security standards and any stricter laws, for all customer information also complies with chapter 5 and the safeguarding rules (R 500.560(b)).
Lesson summary
- Chapter 5 protects nonpublic personal financial information of individuals buying coverage for personal, family or household purposes. It excludes business purchasers, public information, and health information governed by other law.
- A customer has a continuing relationship, which for a producer begins when the consumer obtains insurance through you. An applicant or quote-seeker is a consumer, who receives rights before that point.
- A customer must receive an initial notice by the time the relationship begins, an annual notice (with exceptions), and a revised notice when a new disclosure or a new product makes the last notice inaccurate. Notice must reach the person in writing, or electronically with agreement; speaking it alone is not enough.
- Before disclosing to a nonaffiliated third party, you need the initial notice, an opt-out notice and a reasonable chance to opt out, such as 30 days after mailing. An opt-out stays in force until revoked and may not be answered with unfair discrimination.
- No opt-out is needed for service-provider contracts, transaction processing, consent, fraud prevention and the other listed exceptions. Policy and account numbers may not go to third parties for marketing, with narrow exceptions.
- Reporting suspected fraud to an authorized agency fits the fraud exception, and a person who reports without malice is protected unless the person knows the report contains false information on a material fact.
- R 500.553 requires a written information security program. Assessing risk, managing it, overseeing vendors and adjusting over time is the example the rules treat as compliant. A violation is an unfair practice.