15.1 Insurance Information and Privacy Protection Act

Insurance Information and Privacy Protection Act

Quick Answer: CIC 791 through 791.26, the Insurance Information and Privacy Protection Act (IIPPA), treats every Chapter 7 bail licensee as an agent. You may not use or authorize a pretext interview to gather information in an insurance transaction. You must give a notice of information practices, honor the access and correction clocks, and disclose personal or privileged information only under CIC 791.13.

A bail bond is surety insurance. The family sitting in a Fresno office at 1 a.m. is not handing over a grocery list. They are handing over names, dates of birth, Social Security numbers, bank balances, employer names, home addresses, and the story of why a relative is in jail. IIPPA is the Insurance Code article that tells a licensee what may be collected, how that collection must be announced, and when any of it may be repeated to a third person.

The CDI Bail Educational Objectives also mention pretext in the Penal Code recovery cluster. That cluster is about impersonating peace officers and is taught with fugitive recovery. This section is the insurance-privacy version. CIC 791.03 is the statute. PC 1299.07 impersonation rules do not replace it.

Who is an IIPPA agent

CIC 791.02(c) defines agent as any person licensed under Chapter 5, 5A, 6, Chapter 7 (commencing with Section 1800), or Chapter 8. Chapter 7 is the bail chapter. A bail agent, bail solicitor, bail permittee, and a CDI-licensed bail fugitive recovery agent is an IIPPA agent. The surety is an insurance institution. A vendor that regularly assembles information about natural persons primarily to feed insurers or agents — credit reports, investigative consumer reports, fraud databases — is an insurance-support organization.

CIC 791.02(m) defines an insurance transaction as a transaction involving insurance primarily for personal, family, or household needs that entails determining eligibility for coverage, a benefit, or a payment, or servicing an application, policy, contract, or certificate. Writing a $25,000 undertaking for a Sacramento defendant, taking an indemnitor's financials, and servicing that bond until exoneration are insurance transactions. The article is not limited to auto and homeowners policies.

Personal information under 791.02(s) is individually identifiable information gathered in an insurance transaction from which judgments can be made about character, habits, finances, occupation, reputation, credit, health, or other personal characteristics. It includes name and address. Privileged information under 791.02(v) is individually identifiable information that relates to a claim for insurance benefits or a civil or criminal proceeding and is collected in connection with or in reasonable anticipation of that claim or proceeding. Privileged information disclosed in violation of 791.13 is reclassified as personal information.

Pretext interviews: CIC 791.02(u) and 791.03

CIC 791.02(u) defines a pretext interview as an interview in which a person, trying to obtain information about a natural person, does one or more of the following:

CIC 791.03 is the operative ban. No insurance institution, agent, or insurance-support organization shall use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction. A licensee cannot do it personally and cannot hire a skip tracer or research service to do it.

The statute then carves one exception. A pretext interview may be undertaken to obtain information from a person or institution that does not have a generally or statutorily recognized privileged relationship with the person to whom the information relates, for the purpose of investigating a claim, and only where there is a reasonable basis for suspecting criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with a claim.

That exception is not a general skip-tracing license. It is not a new-business tool. It does not authorize impersonating a lawyer, a priest, a physician, or anyone else in a privileged relationship. It does not authorize a pretext call to see whether a family can afford a bond on a fresh Riverside arrest. Asking a mother, honestly identified as a bail agent, for the defendant's usual address is not a pretext. Pretending to be the jail chaplain to extract that same address is.

Trap: Showing the CDI bail identification card at the window does not repeal 791.03. The card identifies the licensee. PC 11105.6, taught in section 15.3, is the authorized channel for aliases and booking photographs after a bench warrant or forfeiture. Using a pretext to go around that channel is still a 791.03 problem.

Trap: A lifetime you-may-investigate-me-however-you-want clause in an indemnity packet is not a 791.03 exception. CIC 791.06 requires a dated, plain-language authorization that names the types of persons who may disclose, the nature of the information, the purposes, and a stated validity period. For property or casualty applications, reinstatements, or benefit changes, that period may be no longer than one year from the date signed. For life, health, or disability, the cap is 30 months. The individual or authorized representative is entitled to a copy of the form.

Notice of information practices

CIC 791.04 requires a written notice of information practices to applicants or policyholders. Timing depends on the source of the information.

• If personal information is collected only from the applicant, an insured, or public records, the notice may go out no later than delivery of the policy or certificate.
• If personal information is collected from any other source, the notice is due when that collection is initiated.
• On renewal, a new notice is not required if a 791.04-compliant notice was given within the previous 24 months, or if personal information is collected only from the policyholder, an insured, or public records.

The full notice must state whether information may be collected from persons other than those proposed for coverage; the types of information, sources, and investigative techniques; the types of 791.13 disclosures that occur often enough to be a general business practice; the 791.08 and 791.09 access and correction rights; and that an insurance-support organization may retain and redisclose information from its report. An abbreviated notice is allowed if it tells the person that third-party collection may occur, that personal or privileged information may in certain circumstances be disclosed to third parties without authorization, that access and correction rights exist, and that the full notice is available on request. Another insurance institution or agent authorized to act on the licensee's behalf may satisfy the obligation, which is why many sureties print a combined privacy notice that appointed agents deliver.

CIC 791.05 adds a small, testable duty: questions designed solely for marketing or research must be clearly specified as such. CIC 791.07 requires that before an investigative consumer report is prepared or requested (interviews with neighbors, friends, or associates about character, reputation, personal characteristics, or mode of living), the individual must be told they may request to be interviewed and that they may obtain a copy under 791.08.

Adverse underwriting decisions

CIC 791.02(a) defines an adverse underwriting decision, for individually underwritten coverage, as a declination of coverage; a termination of coverage; an agent's failure to apply to a specific insurance institution the agent represents that the applicant requested; or, in property or casualty, charging a higher rate based on information that differs from what the applicant or policyholder furnished. A class-wide or statewide withdrawal of a form, a class-wide unavailability, or a rescission is not an adverse underwriting decision, but the specific reason must still be given.

CIC 791.10 is the notice statute. The institution or agent responsible must either give the specific reason in writing or advise the person that, on written request, the reasons will be provided in writing, and must summarize the 791.08 and 791.09 rights. If the person makes a written request within 90 business days of the mailing of the notice or other communication of the decision, the licensee has 21 business days from receipt to furnish (1) the specific reasons in writing if not already given, (2) the specific items of personal and privileged information that support those reasons, and (3) the names and addresses of institutional sources. Privileged items need not be furnished if there is a reasonable suspicion, based on specific information available for review by the commissioner, that the person engaged in criminal activity, fraud, material misrepresentation, or material nondisclosure. Medical-record items go to the individual or a designated medical professional, at the individual's preference. Mental-health record information goes to the individual only with the treating qualified professional's approval.

Oakland scenario. An applicant wants a $100,000 bond. The agent declines because a consumer report shows unpaid civil judgments that the application omitted. That is an adverse underwriting decision. The agent must give or offer the 791.10 reasons and rights. Saying only that underwriting said no, and hanging up, does not satisfy 791.10.

Disclosure is a closed list: CIC 791.13

The default is do not disclose personal or privileged information collected or received in an insurance transaction unless a 791.13 paragraph applies. The paragraphs a bail practice actually uses include:

• Written authorization meeting 791.06, or, if the authorization is from a non-industry person, dated, signed, and not more than one year old.
• A person performing a business, professional, or insurance function for the licensee who agrees not to redisclose except as 791.13 would allow.
• Another insurance institution, agent, or insurance-support organization, limited to what is reasonably necessary to detect or prevent fraud or to perform the insurance transaction.
• An insurance regulatory authority (CDI).
• A law enforcement or other governmental authority pursuant to law.
• Otherwise permitted or required by law.
• A facially valid administrative or judicial order, including a search warrant or subpoena.

Telling a cousin at a barbecue the indemnitor's bank balance is not on that list. Posting the defendant's booking photo on a Facebook ad is not on that list. Faxing the entire file to a collection agency that has not agreed to the 791.13(b) limits is not on that list. CDI's inspection of 10 CCR 2100 records is a 791.13(e) regulatory disclosure, not a public dump.

Access, correction, and remedies

CIC 791.08: after proper identification and a reasonably described written request, the licensee has 30 business days to inform the individual of the nature and substance of recorded personal information, let them see or copy it (or mail a copy; coded information needs a plain-language translation), identify recipients in the prior two years or the classes of persons to whom the licensee normally discloses, and summarize correction procedures. Institutional sources must be identified. A reasonable copy fee may be charged except for information provided under 791.10.

CIC 791.09: within 30 business days of a written correction request, correct, amend, or delete the disputed portion, or refuse in writing with reasons and the right to file a concise statement of disagreement. If the file is corrected, the correction must be furnished to persons the individual designates who received the information in the prior two years, to certain insurance-support organizations that systematically received it in the prior seven years, and to the support organization that furnished the original item.

CIC 791.20: failure to honor 791.08, 791.09, or 791.10 supports a court action for equitable relief. A 791.13 disclosure violation supports actual damages only; no monetary award may exceed the actual damages sustained. The court may award costs and reasonable attorney's fees to the prevailing party. The action must be brought within two years from the date the alleged violation is or should have been discovered.

CIC 791.19: after notice and hearing, a person who violates a CIC 791.17 cease-and-desist order may be fined not more than $10,000 for each violation, or not more than $50,000 if the commissioner finds the violations occurred with such frequency as to constitute a general business practice. The license may be suspended or revoked if the institution or agent knew or reasonably should have known it was in violation of the article. CDI's privacy-regulation notice also points to CIC 791.15 investigative authority.

CIC 791.26 is a transitional authorization rule for pre-October 1, 1981 nonprofit hospital service plan authorizations. It is in the article the blueprint cites. It is not a bail working tool.

CDI's consumer privacy page states the practical deliverable: agents, brokers, and insurers must provide a Privacy Notice describing practices, the kind of information collected in an application, claim, or other insurance transaction, how and with whom personally identifiable information will be shared, and the right to restrict that sharing. GLBA overlay notices under 10 CCR 2689.1 through 2689.24 are taught in section 15.3; they do not replace IIPPA.