It’s a hot spring for state privacy legislation. Privacy bills are pending in roughly 20 states, and while Gramm-Leach-Bliley Act (GLBA) exemptions may act as a cool breeze in some, issues remain:

• Some states’ legislation has no GLBA exemption.
• Some states’ legislation only contains a data-level exemption, meaning non-GLBA data would be subject to the states’ privacy requirements.
• Even those states’ legislation that contains such an entity-level exemption will not insulate insurers from contractual obligations imposed by third parties who are subject to the legislation.

Virginia is the first state to follow California’s lead in adopting comprehensive privacy legislation, but its Consumer Data Protection Act has an entity-level GLBA exemption preventing any direct application to insurers. California, at work again, amended its Consumer Privacy Act (CCPA) by adopting the California Privacy Rights Act (CPRA), effective January 1, 2023. Below is a summary of the CPRA’s impact on insurers and the scope of the GLBA exemptions in pending legislation.

Some of the CPRA’s key impacts on insurers include:

1. Clarifying the scope of the GLBA exemption by revising the exemption to cover “personal information collected, processed, sold, or disclosed subject to,” (rather than “pursuant to”) the GLBA or the California Financial Information Privacy Act.
2. Expanding the private right of action insurers would face following breaches where the insurer failed to provide reasonable security to protect personal information.
3. For non-exempt data, insurers will need to:
   • Update California privacy notices to address a new category of PI, “sensitive personal information,” and provide a right to opt out of its sharing. “Sensitive personal information” includes information such as Social Security number, driver’s license information, financial account information, race, ethnicity, religion, biometrics, and health information.
   • Revisit/revise vendor relationships/contractual requirements related to consumer data.
   • Implement data minimization.
   • Address new requirements for “cross-context behavioral advertising” (advertising targeting consumers based on their PI obtained from the consumer’s activity across businesses, websites, applications, etc., other than those with which the consumer intentionally interacts).

Time will tell how many of the above bills pass, the modifications they will undergo before passage, and whether federal legislation, such as the Information Transparency and Personal Data Control Act introduced in Congress by Rep. Suzan DelBene (D-Wash.), which specifically preempts state privacy laws, will pass and nullify them all.