Under GLBA, state insurance regulators are authorized to enforce Federal privacy laws as they apply to insurers and may enact and enforce privacy standards that exceed those in GLBA. Section 505(c) of GLBA provides that if a state fails to adopt regulations that meet at least the Federal minimum standards, state action is preempted. Our existing law regarding the disclosure of information gathered by insurers generally meets or exceeds these Federal standards already and, as set forth below, we do not anticipate the need for significant changes.

N.J.S.A. 17:23A-1 et seq., effective December 7, 1985, and based on the National Association of Insurance Commissioners’ Insurance Information and Privacy Protection Model Act, regulates the collection, use and disclosure of information gathered by insurers in connection with policies, contracts or certificates of insurance issued or delivered in this State. In most respects, this statute provides standards that are at least as stringent, and in many cases more stringent, than the standards set forth in GLBA. Insurers transacting business in this State have been required to comply with N.J.S.A. 17:23A-1 et seq. with respect to the use, collection and disclosure of information and continue to be so required. If needed, the Department of Banking and Insurance ("Department") will seek any amendments to the existing law to ensure that this State’s existing information practices standards are, in all respects, at least as stringent as those standards in GLBA.

The Department also notes that the Office of the Comptroller of the Currency, Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Office of Thrift Supervision, proposed interagency guidelines establishing standards for the safe keeping of customer information, on June 26, 2000. See 65 Fed. Reg. 39472. These rules set forth the standards for financial institutions related to the administrative, technical and physical safeguards for customer records and information to ensure the security and confidentiality of this information. The Department intends to promulgate rules applying similar standards to insurers to be effective July 1, 2001.

Accordingly, the Department is issuing this Bulletin to advise insurers that:

1. Insurers have been and will continue to be subject to the information collection and disclosure requirements set forth at N.J.S.A. 17:23A-1 et seq.;

2. If necessary, the Department will seek amendments to N.J.S.A. 17:23A-1 et seq. determined to be necessary to ensure that the standards set forth in that statute are, in all respects, at least as stringent as those set forth in GLBA; and

3. With respect to the enforcement of Federal privacy standards under GLBA, other than those set forth in N.J.S.A. 17:23A-1 et seq., the Department will act in accordance with the delayed enforcement date of July 1, 2001.

The Department anticipates that insurers will begin to review the requirements of the Federal rules identified above so as to become familiar with the nature of the administrative, technical and physical safeguards necessary to ensure the confidentiality of customer records and information. Insurers should identify areas that may need to be improved for compliance with similar standards to be adopted by the Department for insurers.