Insurance Information and Privacy Protection Act.

The bill was restructured from amending individual sections (791 through 791.40) to a single repeal-and-add of the entire Article 6.6, simplifying the legislative mechanism but making all changes effective simultaneously.

The exemption for SEC-regulated entities and depository institutions was expanded to clarify that the article does not apply when information is collected in connection with making, modifying, or servicing a loan or line of credit, provided the insurer issuing coverage complies with the article on behalf of the depository institution.

The data minimization principle was changed from ensuring collection is 'related to the insurance transaction requested by the consumer' to being 'reasonable and proportionate to the purposes disclosed to the consumer,' shifting from a transaction-based standard to a disclosure-based standard.

The digest removed the reference to 'publicly available information' from the consumer's right to access, correct, amend, or delete personal information, narrowing the scope of that right.

The definition of 'processing' in Section 791 was expanded to explicitly include 'use, storage, disclosure, analysis, deletion, retention, or modification' of personal information, broadening what activities fall under the privacy regime.

The residency determination was changed from 'last known mailing address' to 'last known residential mailing address,' potentially narrowing who qualifies as a California resident consumer under the act.

A new detailed exemption for producers (agents/brokers) who process or share a consumer's personal information in response to a consumer's request to solicit, obtain, or place insurance coverage. The exemption applies only if the producer does not use the data for unrelated purposes, discloses it only to licensees for the requested purpose, provides notice within 21 days, does not retain data after placement (except for servicing/compliance), and the insurer complies with privacy requirements on the producer's behalf.

A new provision for wholesale intermediaries allowing them to satisfy consumer access and correction requirements (Sections 791.08 and 791.09) through the insurer they place with, while still requiring opt-out mechanisms for certain sharing and compliance with data security and breach notification provisions.

A new exemption for surplus lines advisory organizations designated by the commissioner from most obligations, though they must still comply with data security (791.13(i)), breach notification (791.24), and two other sections (791.32, 791.33).

The commissioner's regulatory deadline (January 1, 2029) now covers Sections 791.04, 791.045, 791.046, 791.13, 791.19, and 791.24 for producers (previously only 791.13 and 791.24), and must include sample notices, forms, and compliance documents.

New coordination language states the bill incorporates additional changes to Sections 791.07, 791.11, and 791.12 proposed by AB 1798, operative only if both bills are enacted and SB 354 is enacted last.

An effective date of July 1, 2028 was added to the bill's operative provisions, meaning the new insurance privacy standards will not take effect until that date.

The scope of obligations for third-party service providers was narrowed. The prior version covered third-party service providers that 'engage in activities not related to insurance transactions involving consumers' personal information.' That third category was removed, so third-party service providers are now only covered to the extent they process personal information in connection with the business of insurance or engage in insurance transactions with consumers.

A new Section 791.30 was added to the Insurance Code, expanding the set of sections this bill creates or amends within Article 6.6.

The consumer right to act on their personal information was expanded from 'correct, amend, or delete' to 'access, correct, amend, or delete,' explicitly adding a right of access to one's own personal information held by insurers and their service providers.

The prohibition on unauthorized use of consumer personal information was narrowed from prohibiting 'the processing sharing of' to specifically prohibiting 'the sharing of' personal information unless it is reasonably necessary and proportionate. This removes the ambiguous 'processing' language and limits the restriction to sharing only.

Third-party service provider obligations narrowed: previously applied when they processed personal information in insurance business, engaged in insurance transactions, OR engaged in activities not related to insurance transactions involving consumers' personal information. Now applies only to the first two criteria (processing in connection with insurance business or engaging in insurance transactions), removing the third criterion about non-insurance activities.

New exemption added for Securities Exchange Commission-regulated brokers, dealers, investment companies, and registered investment advisors, joining the existing exemption for depository institutions subject to the Gramm-Leach-Bliley Act. These entities are exempt unless also licensed by the Insurance Department.

Sections 791.25, 791.30, and 791.31 removed from the list of sections to be added to the Insurance Code, reducing the total number of new provisions in the bill.

Key regulatory standard shifted from 'processing' to 'sharing' of personal information in the prohibition clause. The prior standard required processing be 'consistent with and complies with that notice and is reasonably necessary and proportionate'; the new standard requires only that sharing be 'reasonably necessary and proportionate' to achieve specified purposes.

Privacy notice requirement simplified: removed the phrase 'at specified times' so the notice is now required only 'within a specified period of time.' Contract requirement between licensees and third-party service providers changed from 'clearly govern' to simply 'govern' the processing of personal information.

New definitions added for 'cross marketing' (marketing insurance or financial products to consumers with an ongoing business relationship), 'dark pattern' (user interface designed to subvert user autonomy), 'genetic information' (including fetal and embryo genetic data), 'health care,' 'health care provider,' and 'health information.'

The self-contained definition of 'affiliate' (with 25 percent ownership threshold and control criteria) was replaced with a cross-reference to Section 1215 of the Insurance Code, aligning it with existing insurance law definitions.

Title insurers are now fully exempt from the article. A new subdivision (f) of Section 791.01 states the article shall not apply to any person or entity engaged in the business of title insurance as defined in Section 12340.3.

The law now applies only to personal information processed in connection with insurance for personal, family, or household purposes. Business or professional purpose insurance is excluded, though cross-marketing consistent with Section 791.13 is still permitted.

Section 791.099 was added to the list of new sections being created in the Insurance Code, though its content is not visible in this truncated diff.

Multiple provisions that previously applied only to 'a licensee' now explicitly extend to surplus line insurers and reinsurers as well, including adverse underwriting decision notifications, data correction/deletion rights, and third-party service provider contract requirements.

A new phased compliance timeline for producers: the commissioner must adopt regulations applying Sections 791.13 and 791.24 to producers by January 1, 2029. Producers are not subject to those sections before regulation adoption but may not disclose personal information in violation of Section 791.13. Full compliance is required by July 1, 2029 or upon regulation adoption, whichever comes first.

The definition of 'adverse underwriting decision' was substantially rewritten. It now applies only to individually underwritten coverage, adds a new trigger (a producer's failure to apply for coverage with a specific insurer the consumer requested), and creates a new exception category: class-wide policy terminations, declinations due to unavailability on a class or statewide basis, and rescissions are not adverse underwriting decisions, though the responsible party must still provide specific reasons.

The definition of 'affiliate' was simplified from a detailed three-part test to a cross-reference to Section 1215(a) and (d) of the Insurance Code.

The definition of 'collect' or 'collecting' now includes 'licensing' as a method of collection, in addition to buying, renting, gathering, obtaining, receiving, or accessing.

The maximum penalty for violating a cease and desist order was reduced from $10,000,000 to $15,000 per violation (the minimum remains at least $15,000 per violation; the general business practice tier of at least $50,000 per violation is unchanged).

The privacy notice must now be presented as a standalone document and provided within a specified period of time. Processing is also limited to purposes that are fully disclosed to the consumer and to which the consumer has consented.

The bill was restructured from creating a new Article 6.65 (Sections 792 and following) into amending the existing Insurance Information and Privacy Protection Act sections (791, 791.01, 791.02, etc.). This integrates the new privacy standards into the existing statutory framework rather than creating a parallel regime.

Surplus line insurers and reinsurers are now explicitly covered entities under the act, in addition to licensees and their third-party service providers. This extends privacy obligations (consent requirements, data retention policies, records retention schedules) to these previously unaddressed categories of insurance market participants.

The depository institution exemption was refined: if a depository institution or its affiliate is also licensed by the Department of Insurance, the article now applies only to their processing of personal information in the business of insurance, rather than being entirely exempt.

The residency determination was moved from the definitions section to the applicability section and now references records of 'the licensee or the licensee's third-party service provider' rather than only the licensee, broadening how a person's California residency is established for purposes of the act.

A new exclusion was added to the definition of 'consumer': an individual acting as a job applicant, employee, director, officer, or independent contractor of a licensee, surplus line insurer, reinsurer, or third-party service provider is not a consumer to the extent their personal information is processed solely in that employment or business relationship context.

The definition of 'adverse underwriting decision' changed the first subpart from 'denial' to 'declination' of insurance coverage. The definition of 'applicant' was broadened from 'a person who seeks' to 'any person who seeks' to contract for insurance coverage.

The disability insurer carve-out was made more specific, changing from 'licensed pursuant to Section 106' to 'licensed to transact health insurance, as defined in Section 106,' clarifying which disability insurers remain covered by the act.

The enforcement digest language was restructured. The old version described a multi-step process (examination, investigation, hearing, finding of knowing violation, cease and desist order) and mentioned 'additional fines and suspension or revocation of the licensee's license.' The new version simplifies this to a penalty structure with a base fine of at least $5,000 up to $1,000,000 in aggregate, increased fines for cease and desist violations (at least $25,000 up to $10,000,000, with $15,000 per violation), and $50,000 minimum per violation for general business practices.

The bill now amends existing Sections 791 through 791.29 of the Insurance Code (the Insurance Information and Privacy Protection Act) in addition to adding the new Article 6.65. It adds 14 new sections (791.046, 791.24-791.25, 791.30-791.40) and repeals-and-readds Sections 791.13 and 791.23 to the existing article.

The bill title changes from 'Insurance Consumer Privacy Protection Act of 2025' to 'Insurance Consumer Information and Privacy Protection Act of 2025,' adding the word 'Information.'

Maximum penalty for violations increases from $1,000,000 in the aggregate to $10,000,000 per violation when a cease and desist order is violated. A new penalty tier of at least $50,000 per violation applies if the commissioner finds violations constitute a general business practice.

The requirement that the commissioner must issue a cease and desist order before imposing penalties appears to be removed or made non-mandatory in the amended digest language.

The criminal misdemeanor provision for knowingly and willfully obtaining consumer information under false pretenses is expanded to cover obtaining information from a third-party service provider, not just from a licensee.

The digest adds language stating the bill would make 'technical and conforming changes' to the existing Insurance Information and Privacy Protection Act.

Added new subdivision (c) to Section 792.104 exempting providers of health care governed by the Confidentiality of Medical Information Act (CMIA) and covered entities or business associates under HIPAA from all obligations imposed by this article.

Added a carve-out stating that the health care exemption does NOT apply to a disability insurer licensed pursuant to Section 106 that is not regulated as a health care service plan under the Knox-Keene Health Care Service Plan Act of 1975, meaning such disability insurers remain fully subject to the bill's requirements.

Clarified that 'third-party service provider' does not include a provider of health care governed by CMIA or a covered entity or business associate under HIPAA, ensuring these entities are excluded even when acting as service providers to insurance licensees.

Corrected a drafting error in the legislative counsel's digest: changed 'imprisonment for not more than one year in a county jail, in a county jail for up to six months' to 'imprisonment in a county jail for up to six 6 months' (the 'six 6' appears to be a residual typo).

The definition of 'consent' was replaced. The old definition described consent as 'a method of capturing a consumer's consent that is capable of being recorded or maintained.' The new definition requires consent to be 'a freely given, specific, informed, and unambiguous indication of the consumer's wishes' by the consumer or their legal guardian, power of attorney holder, or conservator, signifying agreement for a narrowly defined particular purpose. This is a substantive shift toward a higher standard for valid consent.

The definition of 'licensee' removed the specific reference to 'a nonadmitted insurer that accepts business placed through a licensed surplus line broker pursuant to Chapter 6.' The new version simply lists 'a surplus line insurer' as a category of licensee, which may narrow or clarify who falls under the bill's coverage.

The criminal penalty for knowingly and willfully obtaining consumer information under false pretenses was clarified. The original stated 'imprisonment for not more than one year in a county jail.' The amendment adds 'in a county jail for up to six months' as an alternative, likely correcting the penalty to align with California misdemeanor sentencing limits (county jail terms are typically capped at 6 months).

Multiple federal statute citations were simplified by removing redundant full-title references. For example, 'Section 1681a(d) of Title 15 of the United States Code' was shortened to '15 U.S.C. Sec. 1681a(d),' and similar changes were made for Title 12 and Title 20 citations.

Several drafting errors were corrected: a duplicate word in the 'adverse underwriting decision' definition ('by a consumer. consumer, including' changed to 'by a consumer, including'), a duplicate possessive in scope language ('their the licensee's' changed to 'the licensee's'), and a possessive pronoun removed from the 'health information' definition ('except their age or gender' changed to 'except age or gender').

The bill no longer amends Section 791.07 regarding investigative consumer reports. It now only adds Article 6.65 (Insurance Consumer Privacy Protection Act of 2025) to the Insurance Code, removing the technical changes to existing investigative consumer report provisions.

Section 792 now includes two new stated purposes: (g) requiring data minimization practices for all licensees and their third-party service providers, and (h) providing accountability for improper processing of consumers' personal information in violation of the article.

The legislative digest now states that the bill would require a licensee or third-party service provider to obtain a consumer's consent to take specified actions and would set forth the means by which consent is obtained, reflecting the new consent framework.

The definition of 'consent' in Section 792.110(j) was completely replaced. The old definition described consent as a method of capturing consent that is capable of being recorded or maintained. The new definition requires consent to be a freely given, specific, informed, and unambiguous indication of the consumer's wishes (or those of a legal guardian, power of attorney holder, or conservator) by statement or clear affirmative action, signifying agreement to processing for a narrowly defined particular purpose.

The definition of 'adverse underwriting decision' in Section 792.110(b)(1) was expanded to include 'a reduction in coverage limits or scope of coverage' as part of a denial of insurance coverage, broadening the situations that trigger notice obligations to consumers.

Entirely new Article 6.65 (Insurance Consumer Privacy Protection Act of 2025) added to the Insurance Code, establishing comprehensive privacy standards for collection, processing, retention, and sharing of consumer personal information by insurance licensees and their third-party service providers.

The original bill was limited to technical, nonsubstantive changes to Section 791.07 regarding investigative consumer reports. The amended bill retains those technical changes but adds an entirely new multi-section article making it a major substantive privacy law.

Applies to any licensee and their third-party service providers who process consumers' personal information in connection with the business of insurance, engage in insurance transactions with consumers, or engage in non-insurance activities involving consumers' personal information. Exempts depository institutions subject to the Gramm-Leach-Bliley Act unless they are also licensees.

Adds extensive definitions including 'personal information,' 'sensitive personal information' (covering SSN, precise geolocation, genetic/neural data, health information, biometric info, etc.), 'processing,' 'consumer,' 'licensee,' 'insurance transaction,' 'adverse underwriting decision,' 'dark pattern,' 'neural data,' and many others.

Requires licensees to provide clear and conspicuous privacy notices at specified times, maintain written records retention policies and schedules, obtain opt-in consent before sharing personal information for purposes other than insurance transactions, limit use of sensitive personal information to the insurance product requested, and notify consumers of reasons for adverse underwriting decisions.

Requires contracts between licensees and third-party service providers to clearly govern the processing of personal information performed on behalf of the licensee.

Authorizes the Insurance Commissioner to examine, investigate, hold hearings, issue cease and desist orders, and impose penalties of at least $5,000 up to $1,000,000 in aggregate for knowing violations. Additional fines and license suspension or revocation apply if a cease and desist order is violated.

Creates a misdemeanor offense (up to $50,000 fine and/or up to 1 year county jail) for knowingly and willfully obtaining consumer information from a licensee or third-party service provider under false pretenses.

Fiscal committee review changed from 'no' to 'yes,' and state-mandated local program changed from 'no' to 'yes,' reflecting the expanded scope and enforcement mechanisms requiring local resources.