A. An insurance institution or insurance producer shall provide a notice of information practices to applicants and policyholders in connection with insurance transactions as prescribed in this section.

B. The insurance institution or insurance producer shall provide the notice at the following times:

1. In the case of an application for insurance, not later than when the insurance institution or insurance producer either:

(a) Delivers the insurance policy or certificate, if personal information is collected only from the applicant or from public records.

(b) First collects personal information from a source other than the applicant or public records.

2. In the case of a policy renewal, at least annually during the continuation of the relationship with the policyholder, except that an insurance institution or insurance producer is not required to provide the notice described in subsection C of this section annually if the insurance institution or insurance producer meets both of the following requirements:

(a) Provides personal information in accordance with section 20-2113.

(b) Has not changed the policies and practices related to disclosing personal information since the customer was last notified pursuant to this section.

3. In the case of a policy reinstatement or change in insurance benefits, not later than the time when the insurance institution receives a request for a policy reinstatement or change in insurance benefits except that a notice is not required if a notice was already given within the immediately preceding twelve months or the insurance institution or insurance producer meets both of the following requirements:

(a) Provides personal information in accordance with section 20-2113.

(b) Has not changed the policies and practices related to disclosing personal information since the customer was last notified pursuant to this section.

C. The notice shall be in writing or, if the applicant or policyholder agrees, in an electronic form and shall either contain the information required for compliance with the notice requirements established under section 503 of the Gramm-Leach-Bliley act (15 United States Code § 6803) or shall state:

1. Whether personal information may be collected from persons other than the individual or individuals proposed for coverage.

2. The types of personal information that may be collected and the types of sources and investigative techniques that may be used to collect the information.

3. The types of disclosures identified in section 20-2113, paragraphs 2 through 6, 9, 11, 12 and 14 and the circumstances under which the disclosures may be made without prior authorization, except only those circumstances need be described that occur with such a frequency as to indicate a general business practice.

4. A description of the rights established under sections 20-2108 and 20-2109 and the manner in which those rights may be exercised.

5. That information obtained from a report prepared by an insurance support organization may be retained by the insurance support organization and disclosed to other persons.

D. Instead of the notice prescribed in subsection C of this section, the insurance institution or insurance producer may provide an abbreviated notice informing the applicant that:

1. Personal information may be collected from persons other than the individual or individuals proposed for coverage.

2. The information as well as other personal or privileged information subsequently collected by the insurance institution or insurance producer may in certain circumstances be disclosed to third parties without authorization.

3. A right of access and correction exists with respect to all personal information collected.

4. The notice prescribed in subsection C of this section will be provided to the applicant on request.

E. The obligations imposed by this section on an insurance institution or insurance producer may be satisfied by another insurance institution or insurance producer authorized to act on its behalf.

F. If an insurance institution, insurance producer or insurance support organization that is required to give notice under this section gives the notice to the sponsor of an employee benefit plan, a group or blanket insurance policyholder or group annuity contract holder or a workers’ compensation plan participant and does not disclose personal information about any of the individuals described in paragraph 1, 2 or 3 of this subsection except as otherwise allowed under section 20-2113, the insurer, producer or insurance support organization is not required to provide the notice to:

1. A participant or a beneficiary of an employee benefit plan that the insurer administers or sponsors or for which the insurer acts as trustee, insurer or fiduciary.

2. An individual who is covered under a group or blanket insurance policy or group annuity contract issued by the insurer.

3. A beneficiary in a workers’ compensation plan.

G. An insurance institution or insurance producer is not required to give notice under this section to a policyholder whose policy is lapsed, expired or otherwise inactive if the insurance institution or insurance producer has not communicated with the policyholder for at least twelve consecutive months, other than to provide annual privacy notices, material required by law or order of a state or federal regulatory authority or promotional materials.

H. An insurance institution or insurance producer is not required to give notice under this section to a policyholder whose last known address of record is invalid. An address is deemed invalid under this subsection if mail sent to that address by the insurance institution or insurance producer has been returned by the postal authorities as undeliverable and if subsequent attempts by the insurance institution or insurance producer to obtain a valid address for the individual have been unsuccessful.