Homeowner's Insurance Data Privacy Protections

Second Regular Session Seventy-fifth General Assembly STATE OF COLORADO INTRODUCED HOUSE BILL 26-1091 LLS NO. 26-0245.01 Brita Darling x2241 HOUSE SPONSORSHIP Lieder and Ricks, SENATE SPONSORSHIP (None), House Committees Senate Committees Business Affairs & Labor A BILL FOR AN ACT CONCERNING DATA PRIVACY PROTECTIONS RELATING TO HOMEOWNER'S INSURANCE TRANSACTIONS.

Bill Summary (Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.) The bill provides personal data privacy protections for consumers relating to homeowner's insurance transactions. The bill establishes standards for an insurer, insurance producer, or surplus line insurer (licensee), and the director, officer, or agent of the licensee, as well as a processor on behalf of a licensee, relating to the use Shading denotes HOUSE amendment. Double underlining denotes SENATE amendment.

Capital letters or bold & italic numbers indicate new material to be added to existing law. Dashes through the words or numbers indicate deletions from existing law.

of a consumer's personal data. A licensee or processor is prohibited from processing a consumer's personal data for purposes unrelated to a homeowner's insurance transaction, selling personal data, or engaging in targeted advertising or joint marketing of cobranded financial products without first obtaining the consumer's affirmative consent to any of those practices by exercising the right to opt in to those practices. Affiliates of licensees are subject to the same requirements as licensees with respect to processing personal data. A consumer's personal data is defined in the bill, in part, as data that identifies, relates to, describes, or is capable of being associated with a particular consumer or household and includes, among other data, a consumer's name, unique personal identifier, account number, social security number, property records, products or services purchased, account logins, information regarding the consumer's interactions with an internet application, loss history information, credit report, insurance score, insurance policy number and expiration date, and racial and ethnic origin. Personal data does not include de-identified data and publicly available data. A consumer has the right to confirm whether a licensee is processing the consumer's personal data, to access the consumer's personal data, and to request a correction or amendment of inaccurate or incomplete personal data or the deletion of personal data that is not needed for the homeowner's insurance transaction or for specific products or services for which the consumer has given their consent. The bill requires a licensee to provide a consumer with a data privacy notice that includes the consumer's rights with respect to personal data, including the right to know whether and with whom personal data is being shared, the type and sources of personal data being collected, and the right to opt in to the sharing or sale of personal data. The bill prohibits a licensee from retaliating against a consumer with respect to the provision of homeowner's insurance and the terms of the insurance if the consumer does not consent to opt in to certain actions relating to their personal data. The bill requires a licensee to: ! Enter into a contract with a processor to ensure that those processing personal data on behalf of the licensee are complying with the consumer data privacy protections; and ! Have a retention policy to ensure that a consumer's personal data is deleted when it is no longer necessary for the insurance or other products or services to which the consumer has consented. Additionally, if a licensee makes an adverse underwriting decision relating to a consumer's request for homeowner's insurance, the licensee must provide the consumer with the specific reasons for the adverse decision and allow the consumer to review the specific data relating to the adverse decision and to correct the data if appropriate. The bill prohibits a licensee from denying insurance based solely on the loss history of the previous owner of the property, or based solely on personal data received from a processor whose primary source of information is licensees, without the licensee obtaining further information that supports the adverse decision. A consumer aggrieved by a violation of the consumer data privacy protections in the bill may bring a civil action in court and may be awarded damages for each violation, including treble damages if proved by clear and convincing evidence that the person violating the bill engaged in bad faith conduct or intentionally violated the consumer data privacy protection provisions of the bill. In addition, the bill makes a violation of the bill an unfair or deceptive act or practice in the business of insurance and gives the commissioner of insurance the power to enforce the bill through actions against licensees and the assessment of civil penalties.

Be it enacted by the General Assembly of the State of Colorado: SECTION 1. In Colorado Revised Statutes, add 10-4-125 as follows:

10-4-125. Homeowner's insurance - consumer personal data protections - licensee requirements - opt in to certain uses of data - private right of action - rules - legislative declaration - definitions.

(1) Legislative declaration.

(a) THE GENERAL ASSEMBLY FINDS AND DETERMINES THAT:

(I) A HOME IS FREQUENTLY A CONSUMER'S MOST EXPENSIVE AND MOST IMPORTANT ASSET;

(II) SECURING HOMEOWNER'S INSURANCE TO PROTECT A HOME FROM RISKS IS VITAL TO OBTAINING FINANCING TO PURCHASE A HOME, RESULTING IN A LOSS OF BARGAINING POWER FOR A PURCHASER OF HOMEOWNER'S INSURANCE;

(III) PRIVACY IS VITALLY IMPORTANT IN THE CONTEXT OF THE INSURANCE BUSINESS, AS INSURANCE COMPANIES REQUIRE SIGNIFICANT AMOUNTS OF PERSONAL DATA FROM CONSUMERS OF INSURANCE TO PROPERLY MANAGE RISKS;

(IV) CHANGES IN TECHNOLOGY ARE ALLOWING INSURANCE COMPANIES TO USE MORE SOPHISTICATED METHODS TO COLLECT AND PROCESS CONSUMER'S DATA;

(V) IN ADDITION, CHANGES IN THE STRUCTURE OF THE INSURANCE INDUSTRY HAVE LED TO INCREASINGLY COMPLEX CONTRACTING RELATIONSHIPS AMONG INSURANCE COMPANIES AND THE COMPANIES' PROCESSORS AND AFFILIATES;

(VI) HOWEVER, INSURANCE DATA PRIVACY LAWS HAVE NOT KEPT PACE WITH CHANGES IN THE INSURANCE MARKETPLACE; AND

(VII) CURRENTLY, CONSUMERS ARE PRESENTED WITH PRIVACY NOTICES THAT ARE CONFUSING AND UNINFORMATIVE, POSSIBLY SUBJECTING CONSUMERS TO THE OVERCOLLECTION OF THEIR PERSONAL DATA, THE PROLIFERATION OF THAT DATA TO RECIPIENTS NOT CONTEMPLATED BY THE CONSUMER, UNWANTED MARKETING CONTACTS, FRAUD ARISING FROM DATA BREACHES, UNDERWRITING BASED ON STALE DATA, OR RETALIATION FOR EXERCISING PRIVACY RIGHTS, AMONG OTHER RISKS.

(b) THE GENERAL ASSEMBLY DECLARES THAT THE PURPOSE OF THIS SECTION IS TO ADDRESS GAPS IN CONSUMER PROTECTIONS RELATING TO HOMEOWNER'S INSURANCE AND TO GIVE THE COMMISSIONER AND CONSUMERS POWERFUL TOOLS TO PROTECT CONSUMER PRIVACY, AS FOLLOWS:

(I) ENSURING THAT INSURANCE COMPANIES PROCESS ONLY PERSONAL DATA RELATING TO THE TRANSACTION REQUESTED BY THE CONSUMER;

(II) ENSURING POLICIES ARE IN PLACE FOR RECORD RETENTION AND DESTRUCTION OF PERSONAL DATA THAT IS NO LONGER NEEDED;

(III) ENSURING THAT VENDOR CONTRACTS BETWEEN INSURERS AND PROCESSORS PROTECT THE SECURITY OF CONSUMERS' PERSONAL DATA;

(IV) OPT-IN REQUIREMENTS SO THAT A CONSUMER'S PERSONAL DATA IS USED ONLY TO PROVIDE THE INSURANCE PRODUCT REQUESTED BY THE CONSUMER AND NOT FOR OTHER PURPOSES WITHOUT THE EXPRESS CONSENT OF THE CONSUMER;

(V) REQUIRING REASONABLE NOTICE TO CONSUMERS WITH MEANINGFUL INFORMATION ABOUT WHAT DATA IS COLLECTED, HOW IT IS USED, TO WHOM IT IS DISCLOSED, AND WHAT RIGHTS THE CONSUMER HAS UNDER THE LAW;

(VI) GOVERNANCE PROCESSES AND PROCEDURES ON DATA USE;

(VII) PROTECTING INSURANCE CONSUMERS' ACCESS TO NONRETALIATION BY ENSURING THAT THEY HAVE REASONABLE ACCESS TO THEIR PRIVACY RIGHTS AND ARE NOT RETALIATED AGAINST IN THE PURCHASE OF HOMEOWNER'S INSURANCE BY EXERCISING THEIR PRIVACY RIGHTS;

(VIII) AUTHORIZING THE COMMISSIONER TO INVESTIGATE AND TAKE ACTION AGAINST LICENSEES THAT VIOLATE CONSUMER PRIVACY PROTECTIONS, INCLUDING ACTIONS BY THE ATTORNEY GENERAL TO ENFORCE UNFAIR OR DECEPTIVE ACTS OR PRACTICES IN THE BUSINESS OF INSURANCE; AND

(IX) AUTHORIZING CONSUMERS TO BRING A CIVIL ACTION AGAINST A LICENSEE FOR VIOLATING THE DATA PRIVACY PROVISIONS OF THIS SECTION.

(2) Definitions. AS USED IN THIS SECTION, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(a) (I) "AFFILIATE" MEANS A LEGAL ENTITY THAT CONTROLS, IS CONTROLLED BY, OR IS UNDER COMMON CONTROL WITH ANOTHER LEGAL ENTITY.

(II) AS USED IN SUBSECTION (2)(a)(I) OF THIS SECTION, "CONTROL" MEANS:

(A) OWNERSHIP OF, CONTROL OF, OR POWER TO VOTE TWENTY-FIVE PERCENT OR MORE OF THE OUTSTANDING SHARES OF ANY CLASS OF VOTING SECURITY OF THE ENTITY, WHETHER DIRECTLY OR INDIRECTLY OR ACTING THROUGH ONE OR MORE OTHER PERSONS;

(B) CONTROL IN ANY MANNER OVER THE ELECTION OF A MAJORITY OF THE DIRECTORS, TRUSTEES, OR GENERAL PARTNERS OF THE ENTITY OR OF INDIVIDUALS EXERCISING SIMILAR FUNCTIONS; OR (C) THE POWER TO EXERCISE, DIRECTLY OR INDIRECTLY, A CONTROLLING INFLUENCE OVER THE MANAGEMENT OR POLICIES OF THE ENTITY AS DETERMINED BY THE APPLICABLE PRUDENTIAL REGULATOR, AS THAT TERM IS DEFINED IN 12 U.S.C. SEC. 5481 (24), IF ANY.

(b) "AUTHENTICATE" MEANS TO USE REASONABLE MEANS TO DETERMINE THAT A REQUEST TO EXERCISE A RIGHT SET FORTH IN THIS SECTION IS BEING MADE ON BEHALF OF THE CONSUMER WHO IS ENTITLED TO EXERCISE THE RIGHT.

(c) "CONSENT" MEANS A CLEAR, AFFIRMATIVE ACT SIGNIFYING A CONSUMER'S FREELY GIVEN, SPECIFIC, INFORMED, AND UNAMBIGUOUS AGREEMENT, SUCH AS BY A WRITTEN STATEMENT, INCLUDING BY ELECTRONIC MEANS, OR OTHER CLEAR, AFFIRMATIVE ACTION BY WHICH THE CONSUMER SIGNIFIES AGREEMENT TO THE PROCESSING OF PERSONAL DATA. THE FOLLOWING DOES NOT CONSTITUTE CONSENT:

(I) ACCEPTANCE OF A GENERAL OR BROAD TERMS OF USE OR SIMILAR DOCUMENT THAT CONTAINS DESCRIPTIONS OF PERSONAL DATA PROCESSING ALONG WITH OTHER, UNRELATED INFORMATION;

(II) HOVERING OVER, MUTING, PAUSING, OR CLOSING A GIVEN PIECE OF CONTENT; AND

(III) AGREEMENT OBTAINED THROUGH DARK PATTERNS.

(d) "CONSUMER" MEANS A HOMEOWNER'S INSURANCE APPLICANT, AN INSURED, AND, WITH RESPECT TO THE RETENTION OF PERSONAL DATA, A FORMERLY INSURED.

(e) "CREDIT REPORT" HAS THE MEANING SET FORTH IN SECTION 10-4-116 (8)(h).

(f) "DARK PATTERN" MEANS A USER INTERFACE DESIGNED OR MANIPULATED WITH THE SUBSTANTIAL EFFECT OF SUBVERTING OR IMPAIRING USER AUTONOMY, DECISION-MAKING, OR CHOICE.

(g) "DE-IDENTIFIED DATA" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (11).

(h) "DELETE" OR "DELETION" MEANS TO REMOVE OR DESTROY PERSONAL DATA BY PERMANENTLY ERASING THE PERSONAL DATA ON EXISTING SYSTEMS SO THAT IT IS NOT MAINTAINED IN HUMAN- OR MACHINE-READABLE FORM AND CANNOT BE RETRIEVED OR UTILIZED IN THAT FORM.

(i) (I) "INSURANCE TRANSACTION" MEANS A TRANSACTION OR SERVICE BY OR ON BEHALF OF A LICENSEE AND ITS AFFILIATES RELATED TO ANY OF THE FOLLOWING:

(A) THE UNDERWRITING OR THE DETERMINATION OF A CONSUMER'S ELIGIBILITY FOR OR THE AMOUNT OF HOMEOWNER'S INSURANCE COVERAGE, A RATE, A BENEFIT, A PAYMENT, OR A CLAIM SETTLEMENT;

(B) LICENSEES OR PROCESSORS PERFORMING SERVICES, INCLUDING MAINTAINING OR SERVICING ACCOUNTS, PROVIDING CUSTOMER SERVICE, PROCESSING REQUESTS OR TRANSACTIONS, VERIFYING CUSTOMER INFORMATION, PROCESSING PAYMENTS, PROVIDING FINANCING, PROVIDING ANALYTIC SERVICES, PROVIDING STORAGE, OR ANY SIMILAR SERVICES;

(C) PROVISION OF VALUE-ADDED SERVICES OR BENEFITS IN CONNECTION WITH THE BUSINESS OF INSURANCE;

(D) AN ACTUARIAL STUDY RELATED TO RATING, RISK MANAGEMENT, OR EXEMPT RESEARCH ACTIVITIES CONDUCTED BY OR FOR THE BENEFIT OF THE LICENSEE USING CONSUMERS' PERSONAL DATA;

(E) THE SHORT-TERM, TRANSIENT USE OF A CONSUMER'S PERSONAL DATA IN CONNECTION WITH THE CONSUMER'S CURRENT INTERACTION WITH THE LICENSEE, INCLUDING NONPERSONALIZED ADVERTISING SHOWN AS PART OF A CONSUMER'S CURRENT INTERACTION WITH THE LICENSEE, IF THE CONSUMER'S PERSONAL DATA IS NOT OTHERWISE SHARED OR SOLD WITHOUT CONSENT AND IS NOT USED TO BUILD A PROFILE ABOUT THE CONSUMER OR OTHERWISE ALTER THE CONSUMER'S EXPERIENCE OUTSIDE THE CURRENT INTERACTION WITH THE LICENSEE;

(F) DETECTION OR PREVENTION OF INSURANCE FRAUD, CRIME RELATED TO INSURANCE CLAIMS, MATERIAL MISREPRESENTATION, OR MATERIAL NONDISCLOSURE; OR

(G) PROVIDING PERSONAL DATA TO STATISTICAL AGENTS OR REINSURERS, PROVIDED THAT THE PERSONAL DATA IS ONLY USED FOR THE PURPOSES FOR WHICH IT IS SHARED.

(II) "INSURANCE TRANSACTION" DOES NOT INCLUDE PROCESSING RELATED TO MARKETING OR RESEARCH.

(j) (I) "LICENSEE" MEANS A PERSON LICENSED, REQUIRED TO BE LICENSED, OR AUTHORIZED TO DO BUSINESS IN THE STATE IN CONNECTION WITH THE TRANSACTION OF HOMEOWNER'S INSURANCE BUSINESS, INCLUDING:

(A) AN INSURER, INCLUDING THE FAIR ACCESS TO INSURANCE REQUIREMENTS PLAN ASSOCIATION CREATED IN SECTION 10-4-1804;

(B) A PRODUCER;

(C) A SURPLUS LINE INSURER; AND

(D) A DIRECTOR, OFFICER, EMPLOYEE, OR AGENT OF A LICENSEE.

(II) "LICENSEE" DOES NOT INCLUDE A PURCHASING GROUP OR A RISK RETENTION GROUP CHARTERED AND LICENSED IN A STATE OTHER THAN THIS STATE OR A LICENSEE THAT IS ACTING AS AN ASSUMING INSURER THAT IS DOMICILED IN ANOTHER STATE OR JURISDICTION.

(k) "LOSS HISTORY INFORMATION REPORT" HAS THE MEANING SET FORTH IN SECTION 10-4-117 (2).

(l) (I) "PERSONAL DATA" MEANS ANY OF THE FOLLOWING INFORMATION PROCESSED IN THE BUSINESS OF INSURANCE THAT IDENTIFIES, RELATES TO, DESCRIBES, IS REASONABLY CAPABLE OF BEING ASSOCIATED WITH, OR COULD REASONABLY BE LINKED, DIRECTLY OR INDIRECTLY, WITH A PARTICULAR CONSUMER OR HOUSEHOLD, INCLUDING:

(A) IDENTIFIERS SUCH AS REAL NAME, ALIAS, SIGNATURE, POSTAL ADDRESS, UNIQUE PERSONAL IDENTIFIER, ONLINE IDENTIFIER, INTERNET PROTOCOL ADDRESS, EMAIL ADDRESS, TELEPHONE NUMBER, ACCOUNT NAME, SOCIAL SECURITY NUMBER, DRIVER'S LICENSE NUMBER, PASSPORT NUMBER, OR OTHER SIMILAR IDENTIFIERS;

(B) COMMERCIAL DATA, INCLUDING RECORDS OF PERSONAL PROPERTY, PRODUCTS, OR SERVICES PURCHASED, OBTAINED, OR CONSIDERED, OTHER THAN PURCHASING OR CONSUMER HISTORIES OR TENDENCIES;

(C) ACCOUNT LOGIN, FINANCIAL ACCOUNT NUMBER, DEBIT CARD NUMBER, OR CREDIT CARD NUMBER IN COMBINATION WITH ANY REQUIRED SECURITY ACCESS CODE, PASSWORD, OR CREDENTIALS ALLOWING ACCESS TO AN ACCOUNT;

(D) INTERNET OR OTHER ELECTRONIC NETWORK ACTIVITY INFORMATION, INCLUDING BROWSING HISTORY, SEARCH HISTORY, AND INFORMATION REGARDING A CONSUMER'S INTERACTION WITH AN INTERNET WEBSITE APPLICATION OR ADVERTISEMENT;

(E) A LOSS HISTORY INFORMATION REPORT;

(F) A CREDIT REPORT;

(G) AN INSURANCE SCORE;

(H) AN INSURANCE POLICY NUMBER;

(I) AN INSURANCE POLICY EXPIRATION DATE;

(J) PROFESSIONAL- OR EMPLOYMENT-RELATED INFORMATION;

(K) EDUCATION INFORMATION THAT IS NOT PUBLICLY AVAILABLE;

(L) PRECISE GEOLOCATION DATA;

(M) INFERENCES DRAWN FROM ANY OF THE INFORMATION IDENTIFIED IN THIS SUBSECTION (2)(l) TO CREATE A PROFILE ABOUT A CONS U ME R CHARACTERISTICS, OCCUPATION, GENERAL REPUTATION, CREDIT, PSYCHOLOGICAL TRENDS, PREDISPOSITIONS, BEHAVIOR, ATTITUDES, INTELLIGENCE, ABILITIES, AND APTITUDES;

R E FLE C T IN G THE CHARACTER C O N S U ME R ' S HABITS, P R E FE R E N C E S , AVOCATIONS, FINANCES,

(N) CHARACTERISTICS OF PROTECTED CLASSIFICATIONS PURSUANT TO STATE OR FEDERAL LAW; AND

(O) RACIAL OR ETHNIC ORIGIN, CITIZENSHIP OR IMMIGRATION STATUS, RELIGIOUS OR PHILOSOPHICAL BELIEFS, OR UNION MEMBERSHIP.

(II) "PERSONAL DATA" DOES NOT INCLUDE DE-IDENTIFIED DATA, PSEUDONYMOUS DATA, PUBLICLY AVAILABLE DATA, OR LAWFULLY OBTAINED, TRUTHFUL INFORMATION THAT IS A MATTER OF PUBLIC CONCERN.

(m) "PRIVILEGED DATA" MEANS PERSONAL DATA THAT IS COLLECTED IN CONNECTION WITH OR IN REASONABLE ANTICIPATION OF A CLAIM FOR INSURANCE BENEFITS OR A CIVIL OR CRIMINAL PROCEEDING INVOLVING A CONSUMER UNTIL THE CLAIM OR PROCEEDING IS FINALIZED;

EXCEPT THAT INFORMATION THAT MEETS THE REQUIREMENTS OF THIS SECTION SHALL NEVERTHELESS BE CONSIDERED PERSONAL DATA IF IT IS DISCLOSED IN VIOLATION OF THIS SECTION.

(n) "PROCESS" OR "PROCESSING" MEANS THE USE, SALE, STORAGE, DISCLOSURE, ANALYSIS, DELETION, OR MODIFICATION OF PERSONAL DATA AND INCLUDES THE ACTIONS OF A LICENSEE DIRECTING A PROCESSOR TO PROCESS PERSONAL DATA.

(o) "PROCESSOR" MEANS A PERSON THAT PROCESSES PERSONAL DATA ON BEHALF OF A LICENSEE.

(p) "PRODUCER" MEANS A PERSON THAT SOLICITS, NEGOTIATES, EFFECTS, PROCURES, DELIVERS, RENEWS, CONTINUES, OR BINDS POLICIES OF HOMEOWNER'S INSURANCE.

(q) "PSEUDONYMOUS DATA" MEANS PERSONAL DATA THAT CANNOT BE ATTRIBUTED TO A SPECIFIC INDIVIDUAL WITHOUT THE USE OF ADDITIONAL INFORMATION, PROVIDED THE ADDITIONAL INFORMATION IS KEPT SEPARATELY AND IS SUBJECT TO APPROPRIATE TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THAT THE PERSONAL DATA IS NOT ATTRIBUTABLE TO AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL.

(r) "PUBLICLY AVAILABLE DATA" MEANS DATA RELATING TO A CONSUMER THAT A LICENSEE HAS A REASONABLE BASIS TO BELIEVE IS LAWFULLY MADE AVAILABLE FROM ANY OF THE FOLLOWING:

(I) FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS;

(II) WIDELY DISTRIBUTED MEDIA; OR

(III) DISCLOSURES TO THE GENERAL PUBLIC THAT ARE REQUIRED TO BE MADE PURSUANT TO FEDERAL, STATE, OR LOCAL LAW.

(s) "RETAIN" OR "RETENTION" MEANS STORING OR ARCHIVING PERSONAL DATA THAT IS IN THE CONTINUOUS POSSESSION, USE, OR CONTROL OF A LICENSEE OR PROCESSOR.

(t) (I) "SALE OF PERSONAL DATA" OR "SELL PERSONAL DATA" MEANS THE EXCHANGE OF A CONSUMER'S PERSONAL DATA TO A THIRD PARTY FOR MONETARY OR OTHER VALUABLE CONSIDERATION.

(II) "SALE OF PERSONAL DATA" OR "SELL PERSONAL DATA" DOES NOT INCLUDE ANY OF THE FOLLOWING SHARING OF PERSONAL DATA:

(A) DISCLOSING PERSONAL DATA TO A PROCESSOR THAT PROCESSES THE PERSONAL DATA ON BEHALF OF A LICENSEE;

(B) DISCLOSING PERSONAL DATA TO A THIRD PARTY FOR PURPOSES OF PROVIDING A PRODUCT OR SERVICE SPECIFICALLY REQUESTED BY A CONSUMER;

(C) DISCLOSING PERSONAL DATA TO AN AFFILIATE OF A LICENSEE;

(D) DISCLOSING PERSONAL DATA PURSUANT TO A CONSUMER'S DIRECTION TO A LICENSEE TO DISCLOSE PERSONAL DATA TO, OR INTERACT WITH, ONE OR MORE LICENSEES, A REINSURER, OR A THIRD PARTY;

(E) TRANSFERRING PERSONAL DATA TO A THIRD PARTY AS AN ASSET PURSUANT TO A MERGER, ACQUISITION, BANKRUPTCY, OR OTHER TRANSACTION, OR A PROPOSED MERGER, ACQUISITION, BANKRUPTCY, OR OTHER TRANSACTION, IN WHICH THE THIRD PARTY ASSUMES CONTROL OF ALL OR PART OF A LICENSEE'S ASSETS; OR

(F) THE DISCLOSURE OF PERSONAL DATA THAT A CONSUMER INTENTIONALLY MADE AVAILABLE TO THE GENERAL PUBLIC VIA A CHANNEL OF MASS MEDIA.

(u) "SHARE" OR "SHARING" MEANS SHARING, RENTING, RELEASING, DISCLOSING, DISSEMINATING, MAKING AVAILABLE, TRANSFERRING, OR OTHERWISE COMMUNICATING ORALLY, IN WRITING, OR BY ELECTRONIC OR OTHER MEANS A CONSUMER'S PERSONAL DATA BY A LICENSEE OR PROCESSOR TO A THIRD PARTY, WHETHER OR NOT FOR MONETARY OR OTHER VALUABLE CONSIDERATION, INCLUDING TRANSACTIONS BETWEEN A LICENSEE AND A THIRD PARTY, FOR THE BENEFIT OF ANY PERSON, IN WHICH NO MONEY IS EXCHANGED.

(v) "TARGETED ADVERTISING" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (25).

(w) "THIRD PARTY" MEANS A PERSON, PUBLIC AUTHORITY, AGENCY, OR BODY OTHER THAN THE CONSUMER, LICENSEE, PROCESSOR, OR AFFILIATE OF THE LICENSEE OR PROCESSOR.

(x) "VALUE-ADDED SERVICE OR BENEFIT" MEANS A PRODUCT OR SERVICE THAT RELATES TO HOMEOWNER'S INSURANCE APPLIED FOR OR PURCHASED BY A CONSUMER THAT IS PRIMARILY DESIGNED TO:

(I) PROVIDE LOSS MITIGATION OR LOSS CONTROL TO MITIGATE RISKS RELATED TO THE HOMEOWNER'S INSURANCE REQUESTED BY OR OFFERED TO THE CONSUMER;

(II) REDUCE CLAIM COSTS OR CLAIM SETTLEMENT COSTS;

(III) PROVIDE EDUCATION ABOUT LIABILITY RISKS OR RISK OF LOSS TO PERSONS OR PROPERTY;

(IV) MONITOR OR ASSESS RISK, IDENTIFY SOURCES OF RISK, OR DEVELOP STRATEGIES FOR ELIMINATING OR REDUCING RISK; OR

(V) PROVIDE POST-LOSS SERVICES.

(3) Applicability of section.

(a) ON AND AFTER JANUARY 1, 2028, THIS SECTION APPLIES TO A LICENSEE OR A PROCESSOR THAT:

(I) PROCESSES CONSUMERS' PERSONAL DATA IN CONNECTION WITH A POLICY OF HOMEOWNER'S INSURANCE;

(II) ENGAGES IN HOMEOWNER'S INSURANCE TRANSACTIONS WITH CONSUMERS; OR

(III) ENGAGES IN ACTIVITIES NOT RELATED TO HOMEOWNER'S INSURANCE TRANSACTIONS INVOLVING HOMEOWNER'S INSURANCE CONSUMERS' PERSONAL DATA.

(b) THE PROTECTIONS OF THIS SECTION EXTEND TO A CONSUMER:

(I) WHOSE PERSONAL DATA IS PROCESSED IN CONNECTION WITH A HOMEOWNER'S INSURANCE TRANSACTION;

(II) WHO HAS PREVIOUSLY ENGAGED IN HOMEOWNER'S INSURANCE TRANSACTIONS WITH A LICENSEE OR PROCESSOR INVOLVING THE CONSUMER'S PERSONAL DATA; OR

(III) WHOSE PERSONAL DATA IS USED FOR PURPOSES OTHER THAN HOMEOWNER 'S PROCESSORS.

INSURANCE TRANSACTIONS BY LICENSEES AND

(c) AN AFFILIATE THAT PROCESSES PERSONAL DATA RECEIVED FROM, OR ON BEHALF OF, A LICENSEE IS SUBJECT TO THE SAME REQUIREMENTS UNDER THIS SECTION THAT ARE APPLICABLE TO A LICENSEE.

(d) THE OBLIGATIONS IMPOSED BY THIS SECTION DO NOT APPLY TO DEPOSITORY INSTITUTIONS OR AFFILIATES OF DEPOSITORY INSTITUTIONS THAT ARE SUBJECT TO THE FEDERAL "GRAMM-LEACH-BLILEY ACT", 15 U.S.C. SEC. 6801 ET SEQ., UNLESS THE AFFILIATES ARE LICENSEES FOR PURPOSES OF THIS SECTION.

(4) Right to access, correct, and delete personal data - right to opt in to certain activities regarding personal data - rules.

(a) NO LATER THAN JANUARY 1, 2028, A HOMEOWNER'S INSURANCE CONSUMER HAS THE RIGHT TO:

(I) CONFIRM WHETHER A LICENSEE IS PROCESSING PERSONAL DATA CONCERNING THE CONSUMER AND TO ACCESS THE CONSUMER'S PERSONAL DATA;

(II) TAKING INTO ACCOUNT THE NATURE OF THE PERSONAL DATA AND THE PURPOSE FOR PROCESSING THE CONSUMER'S PERSONAL DATA:

(A) REQUEST A CORRECTION OR AMENDMENT OF INACCURATE OR INCOMPLETE PERSONAL DATA ABOUT THE CONSUMER; AND

(B) REQUEST THE DELETION OF PERSONAL DATA THAT IS NOT NEEDED FOR THE COMPLETION OF THE HOMEOWNER'S INSURANCE TRANSACTION OR FOR SPECIFIC PRODUCTS OR SERVICES FOR WHICH THE CONSUMER HAS PROVIDED CONSENT;

(III) WHEN EXERCISING THE RIGHT TO ACCESS PERSONAL DATA PURSUANT TO SUBSECTION (4)(a)(I) OF THIS SECTION, OBTAIN FROM THE LICENSEE THE PERSONAL DATA IN A PORTABLE AND, TO THE EXTENT TECHNICALLY FEASIBLE, READILY USABLE FORMAT THAT ALLOWS THE CONSUMER TO TRANSMIT THE DATA TO ANOTHER ENTITY WITHOUT HINDRANCE, SO LONG AS THE LICENSEE IS NOT REQUIRED TO REVEAL ANY TRADE SECRET; AND

(IV) NOTWITHSTANDING ANY OTHER PROVISION OF LAW, OPT IN TO THE PROCESSING OF THE CONSUMER'S PERSONAL DATA FOR PURPOSES OF:

(A) THE SHARING OF PERSONAL DATA UNRELATED TO THE INSURANCE TRANSACTION;

(B) THE SALE OF PERSONAL DATA;

(C) TARGETED ADVERTISING; AND

(D) JOINT MARKETING OF COBRANDED FINANCIAL PRODUCTS.

(b) A LICENSEE PROVIDING AN OPT-IN PROCESS REQUIRED PURSUANT TO SUBSECTION (4)(a)(IV) OF THIS SECTION OR OTHERWISE OBTAINING CONSENT REQUIRED PURSUANT TO THIS SECTION SHALL PROVIDE TO A CONSUMER A CLEAR AND CONSPICUOUS NOTICE OF THE TYPE AND USE OF PERSONAL DATA THAT THE LICENSEE WOULD BE ABLE TO PROCESS IF THE CONSUMER OPTS IN OR CONSENTS AND A PROCESS FOR THE CONSUMER TO REVOKE CONSENT AS EASILY AS IT WAS AFFIRMATIVELY PROVIDED.

(c) THE COMMISSIONER SHALL ADOPT RULES RELATING TO THE FORM AND MANNER FOR IMPLEMENTING THE CONSUMER RIGHTS SET FORTH IN THIS SUBSECTION (4).

(5) Duties of licensees - consumer data privacy notice - consent - prohibited actions.

(a) A LICENSEE SHALL ENSURE THAT A CONSUMER'S PERSONAL DATA IS NOT PROCESSED, RETAINED, OR SHARED WITHOUT THE CONSUMER'S CONSENT FOR PURPOSES OTHER THAN THOSE REASONABLY NECESSARY TO TRANSACT HOMEOWNER'S INSURANCE BUSINESS AND FOR PRODUCTS OR SERVICES RELATED TO HOMEOWNER'S INSURANCE THAT ARE SPECIFICALLY REQUESTED BY THE CONSUMER.

(b) (I) A LICENSEE SHALL CREATE A REASONABLY ACCESSIBLE, CLEAR, AND MEANINGFUL CONSUMER DATA PRIVACY NOTICE AND DISTRIBUTE THE NOTICE TO EACH CONSUMER WITHIN A REASONABLE TIME AFTER THE LICENSEE, DIRECTLY OR THROUGH A PROCESSOR, FIRST COLLECTS, PROCESSES, OR SHARES THE CONSUMER'S PERSONAL DATA.

(II) THE CONSUMER DATA PRIVACY NOTICE MUST STATE IN WRITING ALL OF THE FOLLOWING:

(A) THAT PERSONAL DATA HAS BEEN OR MAY BE COLLECTED BY THE LICENSEE OR A PROCESSOR FROM SOURCES OTHER THAN THE CONSUMER;

(B) THE OTHER SOURCES THAT HAVE BEEN OR MAY BE USED TO COLLECT PERSONAL DATA;

(C) THE CATEGORIES OF THE CONSUMER'S PERSONAL DATA THAT THE LICENSEE OR A PROCESSOR HAVE PROCESSED OR MAY PROCESS, INCLUDING EXAMPLES OF THE DATA IN EACH CATEGORY;

(D) THE PURPOSES FOR WHICH THE LICENSEE PROCESSES THE CONSUMER'S PERSONAL DATA;

(E) THAT THE LICENSEE AND A PROCESSOR MAY SHARE THE CONSUMER'S PERSONAL DATA FOR PURPOSES OF THE INSURANCE TRANSACTION;

(F) THE CATEGORIES OF PERSONS WITH WHOM THE LICENSEE OR A PROCESSOR HAS SHARED, OR MAY SHARE, THE CONSUMER'S PERSONAL DATA;

(G) THAT THE CONSUMER MAY, UPON REQUEST, ANNUALLY OBTAIN A LIST OF PERSONS WITH WHOM THE LICENSEE OR A PROCESSOR HAS SHARED THE CONSUMER'S PERSONAL DATA WITHIN THE LAST TWELVE MONTHS;

(H) THAT THE CONSUMER'S PRIOR CONSENT IS REQUIRED FOR THE LICENSEE OR A PROCESSOR TO PROCESS THE CONSUMER'S PERSONAL DATA FOR ANY PURPOSES UNRELATED TO THE INSURANCE TRANSACTION OR TO SELL PERSONAL DATA;

(I) A STATEMENT OF THE CONSUMER'S RIGHTS OF NONRETALIATION ESTABLISHED PURSUANT TO SUBSECTION (13) OF THIS SECTION;

(J) A STATEMENT OF THE RIGHTS OF THE CONSUMER TO ACCESS, CORRECT, AMEND, OR DELETE PERSONAL DATA ABOUT THE CONSUMER, AND THE INSTRUCTIONS FOR EXERCISING THOSE RIGHTS;

(K) A STATEMENT OF THE RIGHTS OF THE CONSUMER TO RECEIVE NOTICE REGARDING AN ADVERSE UNDERWRITING DECISION, INCLUDING THE REASONS FOR THE ADVERSE UNDERWRITING DECISION, THE SPECIFIC DATA UNDERLYING THE ADVERSE UNDERWRITING DECISION, AND THE SOURCES OF THE DATA;

(L) A STATEMENT OF THE CONSUMER'S RIGHT TO PROVIDE CONSENT BEFORE THE CONSUMER'S PERSONAL DATA MAY BE PROCESSED IN A JURISDICTION OUTSIDE OF THE UNITED STATES OR ITS TERRITORIES;

EXCEPT THAT THE REQUIREMENT IN THIS SUBSECTION (5)(b)(II)(L) DOES NOT APPLY IF THE ONLY SHARING OR PROCESSING IS IN CONNECTION WITH A REINSURANCE TRANSACTION OR WITH AN AFFILIATE OF THE LICENSEE;

(M) HOW A CONSUMER MAY CONTACT A LICENSEE BY MAIL, TELEPHONE, AND ACTIVE EMAIL ADDRESS OR OTHER ONLINE MECHANISM;

AND

(N) ADDITIONAL ITEMS THAT THE COMMISSIONER SPECIFIES BY RULE.

(III) IF THE LICENSEE INTENDS TO SHARE A CONSUMER'S PERSONAL DATA FOR PURPOSES UNRELATED TO THE INSURANCE TRANSACTION OR TO SELL PERSONAL DATA, IN ADDITION TO THE INFORMATION REQUIRED PURSUANT TO SUBSECTION (5)(b)(II) OF THIS SECTION, THE CONSUMER PRIVACY NOTICE MUST INCLUDE:

(A) A DESCRIPTION OF THE REASONABLE MEANS BY WHICH A CONSUMER MAY OPT IN OR OTHERWISE INDICATE THEIR CONSENT FOR ANY ONE OR MORE OF THOSE PURPOSES; AND

(B) THAT ONCE THE CONSUMER CONSENTS TO THE SHARING OR SALE OF PERSONAL DATA, THE CONSUMER MAY REVOKE THE CONSENT AT ANY TIME AND THAT THE LICENSEE WILL NO LONGER SHARE OR SELL THE CONSUMER'S PERSONAL DATA FOR THOSE PURPOSES.

(IV) THE OBLIGATIONS IMPOSED BY THIS SECTION UPON A LICENSEE MAY BE SATISFIED BY ANOTHER LICENSEE OR A PROCESSOR AUTHORIZED TO ACT ON THE LICENSEE'S BEHALF.

(c) A LICENSEE AND PROCESSOR SHALL TAKE REASONABLE STEPS TO SECURE PERSONAL DATA DURING BOTH STORAGE AND USE FROM UNAUTHORIZED ACQUISITION. A LICENSEE'S DATA SECURITY PRACTICES MUST BE APPROPRIATE TO THE VOLUME, SCOPE, AND NATURE OF THE PERSONAL DATA PROCESSED TO TRANSACT HOMEOWNER'S INSURANCE BUSINESS.

(6) Form of consent.

(a) TO COMPLY WITH THE OPT-IN OR CONSENT REQUIREMENTS OF THIS SECTION, A LICENSEE OR PROCESSOR SHALL USE A METHOD OF CAPTURING A CONSUMER'S CONSENT THAT IS CAPABLE OF BEING RECORDED OR MAINTAINED FOR AS LONG AS THE LICENSEE HAS A BUSINESS RELATIONSHIP WITH A CONSUMER OR A METHOD REQUIRED PURSUANT TO THIS SECTION.

(b) A LICENSEE SHALL NOT REQUIRE A CONSUMER TO CREATE A NEW ACCOUNT IN ORDER TO EXERCISE A RIGHT SPECIFIED IN SUBSECTION

(4) OR (5) OF THIS SECTION.

(c) (I) WHEN A CONSUMER HAS A CHOICE TO OPT IN OR PROVIDE PRIOR CONSENT PURSUANT TO THIS SECTION, THE FORM USED TO OBTAIN THE CONSUMER'S CONSENT MUST:

(A) BE WRITTEN IN PLAIN LANGUAGE;

(B) BE DATED AND, IF THE CONSENT RELATES TO THE SHARING OR USE OF PERSONAL DATA OF A CONSUMER WITH WHOM THE LICENSEE HAS NO ONGOING RELATIONSHIP PURSUANT TO A CLAIM UNDER THE LICENSEE'S POLICY, CONTAIN A TERMINATION DATE FOR THE CONSENT;

(C) NAME THE LICENSEE THAT THE CONSUMER AUTHORIZES TO SHARE THE CONSUMER'S PERSONAL DATA;

(D) SPECIFY TO WHOM THE CONSUMER'S PERSONAL DATA WILL BE SHARED CONSISTENT WITH THIS SECTION;

(E) SPECIFY THE TYPES AND USES OF THE PERSONAL DATA THAT THE CONSUMER IS AUTHORIZING TO BE SHARED;

(F) ADVISE THE CONSUMER THAT THE CONSUMER IS ENTITLED TO RECEIVE A COPY OF THE FORM CONTAINING THE CONSUMER'S CONSENT;

(G) EXPLAIN THAT, PURSUANT TO SUBSECTION (13) OF THIS SECTION, DISCRIMINATION, OR DISPARATE TREATMENT BASED ON THE CONSUMER'S DECISION TO PROVIDE OR WITHHOLD CONSENT; AND THE CONSUMER IS PROTECTED FROM RETALIATION,

(H) INCLUDE ADDITIONAL DATA OR ELEMENTS SPECIFIED BY THE COMMISSIONER BY RULE.

(II) THE CONSUMER'S MOST RECENT CONSENT SHALL TAKE PRECEDENCE OVER ANY PRIOR CONSENT.

(III) A CONSUMER'S CONSENT GIVEN PURSUANT TO THIS SECTION IS EFFECTIVE UNTIL IT IS REVOKED BY THE CONSUMER, BUT CONSENT PROVIDED BY A CONSUMER WITH WHOM A LICENSEE HAS NO ONGOING CUSTOMER RELATIONSHIP IS ONLY VALID FOR THE DURATION SPECIFIED ON THE CONSENT DOCUMENT.

(IV) IF A CONSUMER ESTABLISHES A NEW RELATIONSHIP WITH A LICENSEE, ANY CONSENT THAT APPLIED TO THE FORMER RELATIONSHIP DOES NOT APPLY TO THE NEW RELATIONSHIP. A NEW RELATIONSHIP OCCURS WHEN THE CONSUMER WHO PREVIOUSLY ENDED ALL BUSINESS RELATIONSHIPS RELATIONSHIP MORE THAN THIRTY DAYS AFTER THE PREVIOUS BUSINESS RELATIONSHIP ENDED.

WITH A LICENSEE REESTABLISHES A BUSINESS

(V) IF TWO OR MORE CONSUMERS JOINTLY OBTAIN HOMEOWNER'S INSURANCE OR ANOTHER PRODUCT OR SERVICE FROM A LICENSEE, THE LICENSEE OR A PROCESSOR MAY PROVIDE A SINGLE CONSENT NOTICE.

EACH OF THE JOINT CONSUMERS SHALL INDICATE THEIR CONSENT.

(7) Designated agent - authorization.

(a) A CONSUMER MAY DESIGNATE ANOTHER PERSON, ACTING ON THE CONSUMER'S BEHALF TO EXERCISE THE CONSUMER'S RIGHTS, INCLUDING PROVIDING CONSENT WHERE REQUIRED AND OPTING IN TO LICENSEE OR PROCESSOR ACTIONS SPECIFIED IN SUBSECTIONS (4) AND (5) OF THIS SECTION.

(b) A LICENSEE OR PROCESSOR SHALL COMPLY WITH ACTIONS TAKEN BY A CONSUMER'S DESIGNATED AGENT IF THE LICENSEE IS ABLE TO AUTHENTICATE, WITH COMMERCIALLY REASONABLE EFFORT, THE IDENTITY OF THE CONSUMER AND THE AUTHORITY OF THE AUTHORIZED AGENT TO ACT ON THE CONSUMER'S BEHALF.

(8) Requirements for processing consumer's personal data - prohibitions. (a) A LICENSEE SHALL NOT PROCESS A CONSUMER'S PERSONAL DATA UNLESS:

(I) THE PROCESSING, RETENTION, OR SHARING OF THE CONSUMER'S PERSONAL DATA IS CONSISTENT WITH AND COMPLIES WITH THE MOST RECENT DATA PRIVACY NOTICE PROVIDED TO THE CONSUMER BY THE LICENSEE PURSUANT TO SUBSECTION (5) OF THIS SECTION; AND (II) THE PROCESSING AND RETENTION OF THE CONSUMER'S PERSONAL DATA IS REASONABLY NECESSARY AND PROPORTIONATE TO ACHIEVE THE PURPOSES RELATED TO A HOMEOWNER'S INSURANCE TRANSACTION OR OTHER PURPOSE THE CONSUMER REQUESTED OR AUTHORIZED AND NOT FURTHER PROCESSED IN A MANNER THAT IS INCOMPATIBLE WITH THOSE PURPOSES.

(b) A LICENSEE SHALL NOT PERMIT AN EMPLOYEE TO PROCESS, RETAIN, OR SHARE A CONSUMER'S PERSONAL DATA, EXCEPT AS RELEVANT AND NECESSARY AS PART OF THAT EMPLOYEE'S ASSIGNED DUTIES.

(c) A REINSURER, PROCESSOR, OR SURPLUS LINE INSURER SHALL NOT PROCESS A CONSUMER'S PERSONAL DATA UNLESS:

(I) THE PROCESSING IS IN COMPLIANCE WITH THIS SECTION;

(II) THE PROCESSING OF THE CONSUMER'S PERSONAL DATA IS CONSISTENT WITH AND COMPLIES WITH THE MOST RECENT PRIVACY NOTICE PROVIDED BY THE REINSURER, PROCESSOR, OR SURPLUS LINE INSURER ON ITS INTERNET WEBSITE;

(III) WITH RESPECT TO REINSURERS, THE PROCESSING OF THE CONSUMER'S PROPORTIONATE REINSURANCE TRANSACTION AND NOT FURTHER PROCESSED IN A MANNER PERSONAL DATA TO ACHIEVE IS REASONABLY THE PURPOSES NECESSARY RELATED TO AND THE THAT IS INCOMPATIBLE WITH THOSE PURPOSES; AND

(IV) WITH RESPECT TO PROCESSORS AND SURPLUS LINE INSURERS, THE PROCESSING OF THE CONSUMER'S PERSONAL DATA IS REASONABLY NECESSARY AND PROPORTIONATE TO ACHIEVE THE PURPOSES RELATED TO THE PURPOSES FOR WHICH THE PROCESSOR OR SURPLUS LINE INSURER COLLECTED THE DATA AND NOT FURTHER PROCESSED IN A MANNER THAT IS INCOMPATIBLE WITH THOSE PURPOSES.

(d) OTHER THAN PROCESSING PURSUANT TO A CONTRACT WITH A LICENSEE PURSUANT TO SUBSECTION (10) OF THIS SECTION, A REINSURER, PROCESSOR, OR SURPLUS LINE INSURER SHALL NOT PROCESS A CONSUMER'S PERSONAL DATA OBTAINED IN THE BUSINESS OF INSURANCE FOR A PURPOSE UNRELATED TO AN INSURANCE TRANSACTION.

(9) Authorized processing of personal data.

(a) CONSISTENT WITH THIS SECTION, A LICENSEE MAY PROCESS A CONSUMER'S PERSONAL DATA AS NECESSARY FOR THE FOLLOWING PURPOSES:

(I) IN CONNECTION WITH AN INSURANCE TRANSACTION;

(II) FOR COMPLIANCE WITH A REQUEST OR DIRECTIVE FROM A LAW ENFORCEMENT AGENCY OR INSURANCE REGULATORY AUTHORITY OR AN ADMINISTRATIVE, CRIMINAL, OR CIVIL LEGAL PROCESS, ARBITRATION, OR OTHER LEGAL REQUIREMENT OR ORDER THAT IS BINDING UPON THE LICENSEE;

(III) WHEN SPECIFICALLY REQUIRED BY STATE LAW;

(IV) FOR A LIENHOLDER, MORTGAGEE, ASSIGNEE, LESSOR, OR OTHER PERSON SHOWN IN THE RECORDS OF A LICENSEE AS HAVING A LEGAL OR BENEFICIAL INTEREST IN AN INSURANCE POLICY, TO PROTECT THAT INTEREST, IF THE PERSONAL DATA SHARED IS LIMITED TO WHAT IS REASONABLY NECESSARY TO PROTECT THE REQUESTOR'S LEGAL INTERESTS IN THE POLICY;

(V) TO PERMIT A PARTY OR A REPRESENTATIVE OF A PARTY TO A PROPOSED CONSOLIDATION OF ALL OR PART OF THE BUSINESS OF THE LICENSEE TO REVIEW THE PERSONAL DATA NECESSARY FOR THE TRANSACTION, IF:

(A) OR CONSUMMATED SALE , TRANSFER , MERGER , OR BEFORE THE CONSUMMATION OF THE SALE, TRANSFER, MERGER, OR CONSOLIDATION, PERSONAL DATA IS ONLY SHARED AS IS REASONABLY NECESSARY TO ENABLE THE RECIPIENT TO MAKE BUSINESS DECISIONS ABOUT THE SALE, TRANSFER, MERGER, OR CONSOLIDATION;

AND (B) THE RECIPIENT AGREES NOT TO SHARE THE ACQUIRED PERSONAL DATA FOR PURPOSES OTHER THAN THE SALE, TRANSFER, MERGER, OR CONSOLIDATION;

(VI) IN CONNECTION WITH THE MARKETING OF A PRODUCT OR SERVICE, AFTER RECEIVING AFFIRMATIVE CONSENT FROM THE CONSUMER TO USE THE CONSUMER'S PERSONAL DATA IN CONNECTION WITH THE SPECIFIC MARKETING ACTIVITY TO WHICH THE CONSUMER HAS CONSENTED;

(VII) IN CONNECTION WITH THE JOINT MARKETING OF COBRANDED FINANCIAL PRODUCTS OR SERVICES BETWEEN A LICENSEE AND A FINANCIAL INSTITUTION, IF:

(A) THE CONSUMER OPTS IN TO THE JOINT MARKETING ACTIVITY;

(B) PERSONAL DATA IS ONLY PROCESSED PURSUANT TO A CONTRACT COMPLYING WITH THE REQUIREMENTS OF SUBSECTION (10) OF THIS SECTION; AND

(C) ONLY THE FOLLOWING ELEMENTS OF PERSONAL DATA ARE SHARED AND PROCESSED FOR PURPOSES OF THE JOINT MARKETING: THE CONSUMER'S NAME, ADDRESS OR EMAIL ADDRESS, FINANCIAL INSTITUTION AFFILIATION, AND ACCOUNT TYPE; AND

(VIII) ADDITIONAL PURPOSES SPECIFIED BY THE COMMISSIONER BY RULE.

(b) A LICENSEE MAY PROCESS A CONSUMER'S DE-IDENTIFIED DATA.

(c) THIS SUBSECTION (9) DOES NOT PROHIBIT THE SHARING OF A CONSUMER'S PERSONAL DATA WITH A LICENSEE'S AFFILIATES TO THE EXTENT PREEMPTED BY SECTION 15 U.S.C. SEC. 1681t (b)(1)(H) OR 1681t (b)(2).

(10) Contracts between licensees and processors.

(a) A LICENSEE SHALL EXERCISE DUE DILIGENCE IN SELECTING AND OVERSEEING THE LICENSEE'S PROCESSORS. A LICENSEE SHALL DEVELOP WRITTEN PROCEDURES FOR THE SELECTION AND OVERSIGHT OF PROCESSORS AND SHALL MAKE THE PROCEDURES AVAILABLE TO THE COMMISSIONER UPON REQUEST. A LICENSEE'S PROCEDURES DEVELOPED PURSUANT TO THIS SUBSECTION (10) ARE NOT A PUBLIC RECORD AND ARE EXEMPT FROM PUBLIC INSPECTION AND COPYING UNDER THE "COLORADO OPEN RECORDS ACT", PART 2 OF ARTICLE 72 OF TITLE 24.

(b) PROCESSING BY A PROCESSOR MUST BE GOVERNED BY A CONTRACT BETWEEN THE LICENSEE AND THE PROCESSOR THAT IS BINDING ON BOTH PARTIES. THE CONTRACT MUST CONTAIN CLEAR INSTRUCTIONS FOR PROCESSING PERSONAL DATA, THE NATURE AND PURPOSE OF PROCESSING, THE TYPES OF PERSONAL DATA SUBJECT TO PROCESSING, THE DURATION OF PROCESSING, AND THE RIGHTS AND OBLIGATIONS OF BOTH PARTIES. THE CONTRACT MUST ALSO INCLUDE REQUIREMENTS THAT THE PROCESSOR DO ALL OF THE FOLLOWING:

(I) ENSURE THAT EACH PERSON PROCESSING PERSONAL DATA IS SUBJECT TO A DUTY OF CONFIDENTIALITY WITH RESPECT TO THE PERSONAL DATA AND ONLY USES THE PERSONAL DATA FOR LEGITIMATE DUTIES AS ASSIGNED;

(II) DEVELOP AND MAINTAIN A PROGRAM OF ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS SUFFICIENT TO ENSURE THE CONFIDENTIALITY, INTEGRITY, AND AVAILABILITY OF PERSONAL DATA PROVIDED BY THE LICENSEE;

(III) PROMPTLY REPORT TO THE LICENSEE AND THE COMMISSIONER ANY INCIDENT AFFECTING THE CONFIDENTIALITY, INTEGRITY, OR AVAILABILITY OF PERSONAL DATA, INCLUDING A BREACH IN THE SECURITY OF PERSONAL DATA;

(IV) AT THE CHOICE OF THE LICENSEE, DELETE OR RETURN ALL PERSONAL DATA TO THE LICENSEE AS REQUESTED AT THE END OF THE PROVISION OF SERVICES, UNLESS RETENTION OF THE PERSONAL DATA IS REQUIRED BY LAW OR THE LICENSEE REQUESTS AN EARLIER DELETION DATE;

(V) UPON THE REASONABLE REQUEST OF THE LICENSEE, MAKE AVAILABLE TO THE LICENSEE ALL INFORMATION IN THE PROCESSOR'S POSSESSION NECESSARY TO DEMONSTRATE THE PROCESSOR'S COMPLIANCE WITH THIS SECTION;

(VI) PROVIDE REASONABLE ASSISTANCE TO THE COMMISSIONER WITH RESPECT TO AN INVESTIGATION OR PROCEEDING PURSUANT TO THIS SECTION OR TO THE LICENSEE WITH RESPECT TO A CONSUMER REQUEST PURSUANT TO THIS SECTION;

(VII) ENGAGE A SUBCONTRACTOR PURSUANT TO A WRITTEN CONTRACT THAT REQUIRES THE SUBCONTRACTOR TO COMPLY WITH THE SAME OBLIGATIONS AS THE PROCESSOR WITH RESPECT TO THE PERSONAL DATA;

(VIII) NOT FURTHER PROCESS OR DISCLOSE THE PERSONAL DATA OBTAINED FROM OR ON BEHALF OF THE LICENSEE OTHER THAN AS SPECIFICALLY STATED IN THE CONTRACT; AND

(IX) PROMPTLY NOTIFY THE LICENSEE IF THE PROCESSOR IS NO LONGER ABLE TO COMPLY WITH THE PROCESSOR'S OBLIGATIONS UNDER THE CONTRACT, IN WHICH CASE THE LICENSEE HAS THE RIGHT TO TERMINATE THE CONTRACT.

(c) NOTWITHSTANDING SUBSECTION (10)(b) OF THIS SECTION, IN CONNECTION WITH AN INSURANCE TRANSACTION, A LICENSEE MAY SHARE A CONSUMER'S PERSONAL DATA WITH A PROCESSOR WITH WHICH THE LICENSEE HAS NO ONGOING BUSINESS RELATIONSHIP AND WITH WHICH THE LICENSEE HAS NO WRITTEN CONTRACT UPON RECEIVING THE CONSENT OF THE CONSUMER AND ONLY TO THE EXTENT NECESSARY TO PROVIDE THE TEMPORARY SERVICE REQUESTED BY THE LICENSEE ON BEHALF OF THE CONSUMER.

(d) A PROCESSOR SHALL ALLOW FOR, AND CONTRIBUTE TO, REASONABLE AUDITS AND INSPECTIONS BY THE LICENSEE OR THE LICENSEE'S DESIGNATED AUDITOR. ALTERNATIVELY, THE PROCESSOR MAY, WITH THE LICENSEE'S CONSENT, ARRANGE FOR A QUALIFIED AND INDEPENDENT AUDITOR TO CONDUCT, AT LEAST ANNUALLY AND AT THE PROCESSOR'S EXPENSE, AN AUDIT OF THE PROCESSOR'S POLICIES AND TECHNICAL AND ORGANIZATIONAL MEASURES IN SUPPORT OF THE OBLIGATIONS UNDER THIS SECTION USING AN APPROPRIATE AND ACCEPTED CONTROL STANDARD OR FRAMEWORK AND AUDIT PROCEDURE FOR THE AUDITS AS APPLICABLE. THE PROCESSOR SHALL PROVIDE A REPORT OF THE AUDIT TO THE LICENSEE UPON REQUEST.

(e) THIS SUBSECTION (10) APPLIES TO A CONTRACT BETWEEN A LICENSEE AND A PROCESSOR THAT IS EXECUTED, AMENDED, OR RENEWED ON OR AFTER JANUARY 1, 2028. IF A LICENSEE HAS AN IN-FORCE CONTRACT WITH A PROCESSOR THAT PROCESSES, RETAINS, OR SHARES ANY CONSUMER'S PERSONAL DATA AND THE CONTRACT HAS NOT BEEN RENEWED AFTER THE EFFECTIVE DATE OF THIS SECTION, THE LICENSEE SHALL NOTIFY THE PROCESSOR OF THE REQUIREMENTS OF THIS SECTION.

(f) IN NO EVENT MAY A CONTRACT RELIEVE A LICENSEE OR A PROCESSOR FROM THE LIABILITIES IMPOSED ON THEM BY VIRTUE OF THEIR ROLE IN THE PROCESSING RELATIONSHIP AS DESCRIBED IN THIS SECTION.

(11) Retention of personal data.

(a) A LICENSEE OR PROCESSOR MAY RETAIN A CONSUMER'S PERSONAL DATA AS NECESSARY FOR ANY OF THE FOLLOWING:

(I) PERFORMANCE OF A HOMEOWNER'S INSURANCE TRANSACTION, PRODUCT, OR SERVICE WITH A CONSUMER WHO IS IN AN ONGOING BUSINESS RELATIONSHIP WITH THE LICENSEE AND WHO, IF REQUIRED, HAS CONSENTED TO OR OPTED IN TO THE PRODUCT OR SERVICE;

(II) COMPLIANCE WITH A LEGAL OBLIGATION OF THE LICENSEE RELATED TO THE INSURANCE TRANSACTION INVOLVING THE CONSUMER'S PERSONAL DATA;

(III) COMPLIANCE WITH A REQUEST OR DIRECTIVE FROM A LAW ENFORCEMENT AGENCY OR STATE, FEDERAL, OR INTERNATIONAL REGULATORY AUTHORITY; A WARRANT, A SUBPOENA, A DISCOVERY REQUEST, A JUDICIAL ORDER, OR OTHER ADMINISTRATIVE, CRIMINAL, OR CIVIL LEGAL PROCESS; OR ANOTHER LEGAL REQUIREMENT THAT IS BINDING UPON A LICENSEE;

(IV) PROTECTION OF A LEGAL OR BENEFICIAL INTEREST IN AN INSURANCE POLICY, WITH RESPECT TO A LIENHOLDER, A MORTGAGEE, AN ASSIGNEE, A LESSOR, OR OTHER PERSON SHOWN ON THE RECORDS OF A LICENSEE AS HAVING A LEGAL OR BENEFICIAL INTEREST IN THE INSURANCE POLICY;

(V) EXEMPT RESEARCH ACTIVITIES RELATED TO AN INSURANCE TRANSACTION INVOLVING THE CONSUMER'S PERSONAL DATA, OR FOR RATING OR RISK MANAGEMENT PURPOSES FOR OR ON BEHALF OF THE LICENSEE IN CONNECTION WITH A HOMEOWNER'S INSURANCE PRODUCT OR SERVICE;

(VI) IDENTIFICATION OF BENEFICIARIES OF UNCLAIMED INSURANCE POLICY BENEFITS; AND

(VII) OTHER PURPOSES THAT THE COMMISSIONER IDENTIFIES BY RULE.

(b) (I) NOT LESS THAN ANNUALLY, A LICENSEE AND PROCESSOR SHALL REVIEW ANY RECORDS CONTAINING PERSONAL DATA TO DETERMINE WHETHER ANY OF THE PURPOSES SPECIFIED IN SUBSECTION (11)(a) OF THIS SECTION PERMIT THE CONTINUING RETENTION OF A CONSUMER'S PERSONAL DATA.

(II) ONCE A LICENSEE HAS DETERMINED THAT A CONSUMER'S PERSONAL DATA, OR A SPECIFIC ELEMENT OF PERSONAL DATA, IS NO LONGER NEEDED, THE LICENSEE SHALL DESTROY THE CONSUMER'S PERSONAL DETERMINATION.

DATA WITHIN NINETY DAYS AFTER MAKING THE

(III) SUBJECT TO THE APPROVAL OF THE COMMISSIONER, IF A LICENSEE'S SYSTEMS DO NOT ALLOW THE TARGETED DESTRUCTION OF PERSONAL DATA, THE LICENSEE SHALL:

(A) DEVELOP A WRITTEN PLAN THAT PROVIDES FOR TRANSITIONING FROM THE EXISTING SYSTEMS WITHIN A REASONABLE TIME FRAME; AND

(B) REPORT PROGRESS TO THE COMMISSIONER.

(IV) A LICENSEE SHALL DEVELOP A WRITTEN DATA RETENTION POLICY AND DATA RETENTION SCHEDULE AND SHALL MAKE THE POLICY AND SCHEDULE AVAILABLE TO THE COMMISSIONER UPON REQUEST.

(V) UNLESS RETENTION OF THE PERSONAL DATA IS OTHERWISE REQUIRED BY LAW, A PROCESSOR IN POSSESSION OF A CONSUMER'S PERSONAL DATA PROVIDED BY A LICENSEE SHALL DELETE THAT DATA AS OF THE DATE SPECIFIED IN THE CONTRACT BETWEEN THE LICENSEE AND A THIRD-PARTY SERVICE PROVIDER, OR UPON THE CONCLUSION OF THE PROVISION OF SERVICES, UNLESS THE LICENSEE SPECIFIES AN EARLIER DESTRUCTION DATE.

(VI) THIS SUBSECTION (11)(b) DOES NOT PERMIT OR REQUIRE THE DELETION OF A RECORD THAT IS REQUIRED BY LAW TO BE RETAINED.

(12) Adverse underwriting decision - consumer rights.

(a) (I) IN THE EVENT OF AN ADVERSE UNDERWRITING DECISION RELATING TO A HOMEOWNER'S INSURANCE TRANSACTION, THE LICENSEE RESPONSIBLE FOR THE DECISION SHALL PROVIDE IN WRITING TO THE CONSUMER AT THE CONSUMER'S ADDRESS OF RECORD AND, IF KNOWN, THE EMAIL ADDRESS OF THE CONSUMER:

(A) THE SPECIFIC REASON OR REASONS FOR THE ADVERSE UNDERWRITING DECISION;

(B) THE SPECIFIC ITEMS OF PERSONAL, PUBLICLY AVAILABLE, OR PRIVILEGED DATA THAT SUPPORT THOSE REASONS, INCLUDING THE NAMES AND ADDRESSES OF THE SOURCES THAT SUPPLIED THE DATA THAT RESULTED IN THE ADVERSE UNDERWRITING DECISION;

(C) A LIST IDENTIFYING WITH REASONABLE SPECIFICITY ANY SYSTEMS, PROCESSES, POLICIES, GENERATING DATA THAT RESULTED IN THE ADVERSE UNDERWRITING DECISION; AND OR PROCEDURES INVOLVED IN

(D) A SUMMARY OF THE CONSUMER'S RIGHT TO ACCESS, CORRECT, AMEND, OR DELETE PERSONAL DATA PURSUANT TO SUBSECTION (4) OF THIS SECTION.

NOTWITHSTANDING SUBSECTION (12)(a)(I)(B) OF THIS (II) SECTION, A LICENSEE IS NOT REQUIRED TO FURNISH SPECIFIC PRIVILEGED DATA IF THE LICENSEE HAS A REASONABLE SUSPICION, BASED UPON SPECIFIC INFORMATION AVAILABLE FOR REVIEW BY THE COMMISSIONER, THAT THE CONSUMER HAS ENGAGED IN CRIMINAL ACTIVITY, FRAUD, MATERIAL MISREPRESENTATION, OR A MATERIAL NONDISCLOSURE AND THAT THE DATA WITHHELD RELATES TO THE SUSPECTED CRIMINAL ACTIVITY, FRAUD, MATERIAL MISREPRESENTATION, OR MATERIAL NONDISCLOSURE.

(b) A LICENSEE SHALL NOT BASE AN ADVERSE UNDERWRITING DECISION ON:

(I) SOLELY THE LOSS HISTORY OF THE PREVIOUS OWNER OF THE PROPERTY TO BE INSURED;

(II) PERSONAL DATA RECEIVED FROM A PROCESSOR WHOSE PRIMARY SOURCE OF INFORMATION IS LICENSEES, UNLESS THE LICENSEE OBTAINS FURTHER DATA INDEPENDENTLY SUPPORTING THE ADVERSE UNDERWRITING DECISION;

(III) A PREVIOUS ADVERSE UNDERWRITING DECISION AFFECTING THE CONSUMER, UNLESS THE LICENSEE BASES ITS UNDERWRITING DECISION ON THE UNDERLYING BASIS OF THE PREVIOUS DECISION; OR

(IV) INFORMATION THAT THE CONSUMER INQUIRED ABOUT THE NATURE OR SCOPE OF COVERAGE UNDER A POLICY AND THE INQUIRY DID NOT RESULT IN THE FILING OF A CLAIM.

(c) THE COMMISSIONER MAY ASSIST A CONSUMER WITH OBTAINING INFORMATION ABOUT AN ADVERSE UNDERWRITING DECISION AFFECTING THE CONSUMER.

REGARDING SYSTEMS, PROCESSES, POLICIES, OR PROCEDURES RESPONSIBLE FOR GENERATING THE DATA THAT RESULTED IN THE ADVERSE UNDERWRITING DECISION. INFORMATION RECEIVED ABOUT SYSTEMS, PROCESSES, POLICIES, OR PROCEDURES IS CONFIDENTIAL AND IS EXEMPT FROM PUBLIC INSPECTION AND COPYING UNDER THE "COLORADO OPEN RECORDS ACT", PART 2 OF ARTICLE 72 OF TITLE 24.

THE COMMISSIONER MAY REQUEST INFORMATION

(d) FOR PURPOSES OF THIS SECTION, THE FOLLOWING ACTIONS ARE NOT ADVERSE UNDERWRITING DECISIONS, BUT THE LICENSEE RESPONSIBLE FOR TAKING THE ACTION SHALL PROVIDE THE CONSUMER WITH THE SPECIFIC REASON OR REASONS FOR THE ACTION IN WRITING:

(I) THE TERMINATION OF AN INDIVIDUAL POLICY FORM ON A CLASS-WIDE OR STATEWIDE BASIS;

(II) A DENIAL OF INSURANCE COVERAGE SOLELY BECAUSE THE COVERAGE IS NOT AVAILABLE ON A CLASS-WIDE OR STATEWIDE BASIS; OR

(III) IF REQUESTED BY A CONSUMER, ANY INSURER-INITIATED INCREASE IN THE PREMIUM ON AN INSURANCE PRODUCT PURCHASED BY THE CONSUMER.

(13) Nonretaliation for exercise of privacy rights. A LICENSEE OR PROCESSOR SHALL NOT RETALIATE AGAINST A CONSUMER BECAUSE THE CONSUMER EXERCISED OR ATTEMPTED TO EXERCISE THE CONSUMER'S RIGHTS PURSUANT TO THIS SECTION.

A LICENSEE OR PROCESSOR RETALIATES AGAINST A CONSUMER IF THE LICENSEE OR PROCESSOR, AS A RESULT OF A CONSUMER'S PRIVACY CHOICES:

(a) INFRINGES UPON A RIGHT, OR IMPAIRS OR IMPEDES A BENEFIT OR PROTECTION, THAT IS AFFORDED TO CONSUMERS UNDER THIS SECTION;

(b) REQUIRES THE CONSUMER TO CONSENT TO THE SHARING OR SALE OF PERSONAL DATA FOR A PURPOSE UNRELATED TO AN INSURANCE TRANSACTION TO OBTAIN A PARTICULAR PRODUCT, COVERAGE, RATE, OR SERVICE, AND THE PERSONAL DATA IS NOT NECESSARY FOR THE PROVISION OF THE PRODUCT OR SERVICE;

(c) IMPOSES A FEE OR CHARGE FOR THE CONSUMER TO EXERCISE THEIR RIGHTS PURSUANT TO THIS SECTION; OR

(d) CHARGES A DIFFERENT RATE OR PREMIUM TO THE CONSUMER, PROVIDES A DIFFERENT INSURANCE PRODUCT TO THE CONSUMER, REFUSES TO WRITE INSURANCE COVERAGE FOR THE CONSUMER, OR DENIES A CLAIM UNDER AN INSURANCE PRODUCT PURCHASED BY THE CONSUMER.

(14) Data protection assessments - definition.

(a) A LICENSEE SHALL NOT CONDUCT PROCESSING THAT PRESENTS A HEIGHTENED RISK OF HARM TO A CONSUMER WITHOUT CONDUCTING AND DOCUMENTING A DATA PROTECTION ASSESSMENT OF THE LICENSEE'S PROCESSING ACTIVITIES THAT INVOLVE PERSONAL DATA ACQUIRED ON OR AFTER JANUARY 1, 2028, AND THAT PRESENT A HEIGHTENED RISK OF HARM TO A HOMEOWNER'S INSURANCE CONSUMER.

(b) FOR PURPOSES OF THIS SUBSECTION (14), "PROCESSING THAT PRESENTS A HEIGHTENED RISK OF HARM TO A CONSUMER" INCLUDES:

(I) PROCESSING PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR FOR PROFILING, IF THE PROFILING PRESENTS A REASONABLY FORESEEABLE RISK OF:

(A) UNFAIR OR DECEPTIVE TREATMENT OF, OR UNLAWFUL DISPARATE IMPACT ON, A CONSUMER; OR

(B) FINANCIAL INJURY TO A CONSUMER, INCLUDING ADVERSE UNDERWRITING DECISIONS;

(II) SELLING PERSONAL DATA; OR

(III) PROCESSING PERSONAL DATA.

(c) DATA PROTECTION ASSESSMENTS MUST IDENTIFY THE BENEFITS THAT MAY FLOW, DIRECTLY OR INDIRECTLY, FROM THE PROCESSING TO THE LICENSEE, THE CONSUMER, OTHER STAKEHOLDERS, AND THE PUBLIC AND WEIGH THESE BENEFITS AGAINST THE POTENTIAL RISKS TO THE RIGHTS OF THE CONSUMER ASSOCIATED WITH THE PROCESSING, AS MITIGATED BY SAFEGUARDS THAT THE LICENSEE CAN EMPLOY TO REDUCE THE RISKS. THE LICENSEE SHALL FACTOR INTO THIS ASSESSMENT THE USE OF DE-IDENTIFIED DATA AND THE REASONABLE EXPECTATIONS OF CONSUMERS, AS WELL AS THE CONTEXT OF THE PROCESSING AND THE RELATIONSHIP BETWEEN THE LICENSEE AND THE CONSUMER WHOSE PERSONAL DATA WILL BE PROCESSED.

(d) A LICENSEE SHALL MAKE A DATA PROTECTION ASSESSMENT AVAILABLE TO THE COMMISSIONER UPON REQUEST. THE COMMISSIONER MAY EVALUATE THE DATA PROTECTION ASSESSMENT FOR COMPLIANCE BY A LICENSEE WITH THE DUTIES OF THE LICENSEE PURSUANT TO THIS SECTION. DATA PROTECTION ASSESSMENTS ARE CONFIDENTIAL AND EXEMPT FROM PUBLIC INSPECTION AND COPYING UNDER THE "COLORADO OPEN RECORDS ACT", PART 2 OF ARTICLE 72 OF TITLE 24. THE DISCLOSURE OF A DATA PROTECTION ASSESSMENT PURSUANT TO A REQUEST FROM THE COMMISSIONER UNDER THIS SUBSECTION (14) DOES NOT CONSTITUTE A WAIVER OF ANY PRIVILEGE OR PROTECTION THAT MIGHT OTHERWISE EXIST WITH RESPECT TO THE ASSESSMENT AND ANY INFORMATION CONTAINED IN THE ASSESSMENT.

(e) A SINGLE DATA PROTECTION ASSESSMENT MAY ADDRESS A COMPARABLE SET OF PROCESSING OPERATIONS THAT INCLUDE SIMILAR ACTIVITIES.

(f) DATA PROTECTION ASSESSMENTS APPLY TO PROCESSING ACTIVITIES CREATED OR GENERATED ON OR AFTER JANUARY 1, 2028, AND ARE NOT RETROACTIVE.

(15) Rules. THE COMMISSIONER SHALL ADOPT RULES NECESSARY TO IMPLEMENT THIS SECTION, INCLUDING THE RIGHTS AND PROTECTIONS AFFORDED TO HOMEOWNER'S INSURANCE RESPONSIBILITIES OF PERSONS INVOLVED IN HOMEOWNER'S INSURANCE TRANSACTIONS.

CONSUMERS AND THE

(16) Enforcement - investigation by commissioner - penalties.

(a) THE COMMISSIONER MAY USE ANY OF THE COMMISSIONER'S ENFORCEMENT POWERS TO OBTAIN COMPLIANCE WITH THIS SECTION. TO DETERMINE WHETHER A LICENSEE OR A PROCESSOR CONTRACTED WITH A LICENSEE HAS BEEN OR IS ENGAGED IN ANY CONDUCT IN VIOLATION OF THIS SECTION, THE COMMISSIONER MAY EXAMINE AND INVESTIGATE THE BUSINESS PRACTICES OF A LICENSEE OR PROCESSOR TRANSACTING BUSINESS IN THIS STATE OR TRANSACTING BUSINESS OUTSIDE OF THIS STATE THAT HAVE AN EFFECT ON A CONSUMER RESIDING IN THIS STATE.

(b) A VIOLATION OF THIS SECTION IS AN UNFAIR OR DECEPTIVE ACT OR PRACTICE IN THE BUSINESS OF INSURANCE PURSUANT TO SECTION 10-3-1104 (1)(uu) AND IS SUBJECT TO SECTIONS 10-3-1106 TO 10-3-1113.

(17) Consumer - private right of action - damages.

(a) IN ADDITION TO OTHER REMEDIES PROVIDED AT LAW OR IN EQUITY, A CONSUMER AGGRIEVED BY A VIOLATION OF SUBSECTIONS (4) TO

(13) OF THIS SECTION MAY BRING A CIVIL ACTION ON BEHALF OF THEMSELF OR A GROUP OF SIMILARLY SITUATED CONSUMERS TO RESTRAIN FURTHER VIOLATIONS AND TO RECOVER DAMAGES, COSTS, AND REASONABLE ATTORNEY FEES, INCLUDING THE GREATER OF:

(I) THE AMOUNT OF ACTUAL DAMAGES SUSTAINED, INCLUDING PREJUDGMENT INTEREST EITHER OF EIGHT PERCENT PER YEAR OR AT THE RATE PROVIDED IN SECTION 13-21-101, WHICHEVER IS GREATER, FROM THE DATE ON WHICH THE CLAIM UNDER THIS SECTION BEGAN ACCRUING OR THREE TIMES THE AMOUNT OF ACTUAL DAMAGES SUSTAINED, IF IT IS ESTABLISHED BY CLEAR AND CONVINCING EVIDENCE THAT THE PERSON VIOLATING THIS SECTION ENGAGED IN BAD FAITH CONDUCT OR INTENTIONALLY VIOLATED THIS SECTION; OR

(II) THREE THOUSAND DOLLARS FOR EACH VIOLATION OF THIS SECTION, WITH EACH VIOLATION OF THIS SECTION CONSTITUTING A SEPARATE VIOLATION WITH RESPECT TO EACH CONSUMER AND TRANSACTION INVOLVED.

(b) A CAUSE OF ACTION FOR DEFAMATION, INVASION OF PRIVACY, OR NEGLIGENCE SHALL NOT ARISE AGAINST A PERSON:

(I) DISCLOSING PERSONAL OR PRIVILEGED DATA IN ACCORDANCE WITH THIS SECTION; OR

(II) FURNISHING PERSONAL OR PRIVILEGED DATA TO A LICENSEE OR PROCESSOR.

SECTION 2. In Colorado Revised Statutes, 10-3-1104, add (1)(uu) as follows: 10-3-1104. Unfair methods of competition - unfair or deceptive practices - rules - definitions. (1) The following are defined as unfair methods of competition and unfair or deceptive acts or practices in the business of insurance: (uu) A VIOLATION OF SECTION CONCERNING HOMEOWNER'S INSURANCE CONSUMER DATA PRIVACY PROTECTIONS.

SECTION 3. Act subject to petition - effective date. This act takes effect at 12:01 a.m. on the day following the expiration of the ninety-day period after final adjournment of the general assembly (August 12, 2026, if adjournment sine die is on May 13, 2026); except that, if a referendum petition is filed pursuant to section 1 (3) of article V of the state constitution against this act or an item, section, or part of this act within such period, then the act, item, section, or part will not take effect unless approved by the people at the general election to be held in November 2026 and, in such case, will take effect on the date of the official declaration of the vote thereon by the governor.