The Office of General Counsel issued the following opinion on February 14, 2002, representing the position of the New York State Insurance Department.

Re: Compliance with N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0-420.24 (2001) (Regulation 169).

Question Presented:

Does a licensee have any obligations under N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0-420.24 (2001) (Reg. 169) where it currently has not written any business or issued any policies in New York?

Conclusion:

No. Since the licensee has not written any business or issued any policies in New York, there is nothing for it to do at this time. However, if in the future, the licensee transacts business in New York causing it to have consumers or customers, it must be in compliance with the regulation.

Facts:

ABC Co. is a Massachusetts insurance company that holds a license to do business in New York. However, it has not currently written any business or issued any policies in New York. The inquirer would like to know whether ABC Co. has any obligations under N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0-420.24 (2001).

Analysis:

N.Y. Comp. Codes R. & Regs. tit. 11, § 420.1(a) (2001) provides as follows:

(a) Purpose. This Part governs the treatment of nonpublic personal information about individuals (defined in this part as consumers or customers) in this State by all licensees of the Insurance Department. This Part:

(1) Requires a licensee to provide notice to individuals about its privacy policies and practices;

(2) Describes the conditions under which a licensee may disclose nonpublic personal health information and nonpublic personal financial information about individuals to nonaffiliated third parties;

(3) Provides methods for individuals to prevent a licensee from disclosing that information; and

(4) Provides a method for individuals to prevent a licensee from disclosing nonpublic personal health information by not affirmatively consenting to such disclosure, subject to the exceptions in section 420.17(b) of this Part.

N.Y. Comp. Codes R. & Regs. tit. 11, § 420.3(p)(1)(2001) defines the term "licensee" as follows:

(p)(1) [A] person licensed, or required to be licensed, or authorized, or required to be authorized, or registered, or required to be registered pursuant to the Insurance Law of this State; a health maintenance organization holding, or required to hold, a certificate of authority pursuant to Article 44 of the Public Health Law; or an unauthorized insurer in regard to the excess line business conducted pursuant to section 2118 of the Insurance Law and Part 27 of this Title (Regulation 41); but shall not include a registered service contract provider, charitable annuity society, or a licensed viatical settlement company or viatical settlement broker.

In the present case, since ABC Co. is a licensee within the meaning of the Regulation, it is subject to the requirements of N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0-420.24 (2001). However, since it has not written any business or issued any policies in New York, there is nothing for it to do at this time. If in the future, the licensee transacts business in New York causing it to have consumers or customers, it must be in compliance with the regulation.

It should also be noted that N.Y. Comp. Codes R. & Regs. tit. 11, §§ 421.0-421.10 (2002) (Regulation 173) requires licensees, as of June 1, 2002, to implement a comprehensive written information security program that includes administrative, technical and physical safeguards to protect customer records and information.

For further information, you may contact Attorney Pascale Joasil at the New York City office.