SB 354, the Insurance Consumer Privacy Protection Act (ICPPA) of 2025, would establish a modern privacy rights framework for insurance licensees and their third-party service providers. Insurance Commissioner Ricardo Lara also sponsors the bill.

“Privacy is about safeguarding every individual,” Lara said in a press release. “The last time insurance privacy laws were updated, social media was just beginning to emerge, and most people did not own a cell phone. SB 354 gives consumers the power to decide how their personal information is used and shared.”

During an April 9 hearing held on the bill by the Senate Insurance Committee, he added, “By law, consumers are required to hold many types of insurance and more than almost any other industry, insurers require significant amount of personal information to manage risk and service the requested insurance transactions. As more personal information is being shared and processed, consumers end up bearing the brunt of the risk when the privacy of their data is compromised. We don’t have the time or luxury to simply wait and see.”

According to the bill text, the insurance commissioner would be authorized to examine, investigate, and hold a hearing if any violations of the act are suspected. If violations are confirmed, the bill would require the commissioner to issue a cease and desist order and authorize a penalty of at least $5,000, not to exceed $1 million in the aggregate for multiple violations.

“Privacy is vitally important in the context of the insurance business,” the bill states. “More than almost any other industry, insurers require significant amounts of personal information from consumers to properly manage risks. Increasingly, insurance licensees are using sophisticated technologies to collect and process consumers’ personal information, which has increased the volume and sensitivity of personal information that licensees collect about consumers.

“Developments in insurance business structures have led to increasingly complex contracting arrangements between licensees and service providers, with the attendant risk in supply chain data breaches. However, California’s outdated insurance privacy laws have not kept pace with the changing insurance marketplace. There is a significant lack of oversight into how much data licensees collect, what purposes it can be used for, who it can be shared with, and how long it can be retained. The absence of effective oversight leaves consumers vulnerable. Currently, consumers are presented with privacy notices that are confusing and uninformative, and may also be subject to the overcollection of their personal information, proliferation of that information to recipients not contemplated by the consumer, unwanted marketing contacts, fraud arising from data breaches, underwriting based on data that is stale or unrepresentative, or retaliation for exercising privacy rights, among other risks.”

Under SB 354, anyone who knowingly and willfully obtains information about a consumer from a licensee or third-party service provider under false pretenses would be guilty of a misdemeanor, punishable by a fine of up to $50,000, imprisonment for not more than one year in a county jail, or both, according to the bill.

“SB 354 strengthens consumer protections by establishing data privacy standards that preserve sensitive personal information such as social security numbers, IP addresses, passport information, and more,” said Limón, in the release. “At a time when data is freely being collected, oftentimes without consumer knowledge, it has never been more important that we put the power back into consumers’ hands by providing them with the ability to take control of the personal information that is collected.”

The release states that SB 354 would expand the scope of protection regarding insurers’ use of third-party service providers and enhance notices and disclosures, data sharing and minimization/retention policies, data breach reporting and information security, and enforcement tools.

Personal information covered by the bill includes:

• • Real name
  • Alias
  • Postal address
  • Unique personal identifier
  • Online identifier,
  • Internet Protocol (IP) address
  • Email address
  • Social security number
  • Driver’s license number
  • Passport number
  • Biometric information
  • Internet or other electronic network activity information
  • Geolocation data
  • Inferences drawn from consumer preferences, characteristics, character, habits, etc;
  • Other sensitive personal information.

Consumers would have the right to:

• • Consent by opting into the sharing of personal information by licensees for purposes unrelated to insurance transactions;
  • Amend, correct, or delete inaccurate personal information that licensees have about consumers (with some exceptions);
  • Know or access the categories of personal information that are processed and sources from which personal information is collected, and identify recipients when such information is shared;
  • Know the reasons for adverse underwriting decisions;
  • Right to exercise consumer privacy rights free from retaliation

According to the press release, a coalition of consumer advocates expressed widespread support for what would be the nation’s most robust insurance consumer privacy protection measure.

“The California Privacy Rights Act of 2020 (which expanded the California Consumer Privacy Act) was intended as a baseline for the fundamental consumer privacy rights Californians should expect,” said Tracy Rosenbeg, advocacy director for Oakland Privacy, in the release. “As data collection practices become more sophisticated and risk-based industries like the insurance industry seek to manage their costs, it has become clear that more protections are necessary for sectors that manage large quantities of very sensitive information.

“As Sen. Limón and Insurance Commissioner Lara have recognized the insurance sector is ripe for enhanced privacy protections. The ICPPA will strengthen and modernize insurance industry practices and ensure Californians have clear opt-in consent, protection against data sales and breaches, and the ability to change and dispute incorrect information about themselves when they insure themselves, their homes, and their properties.”

During the hearing earlier this week, Limón noted that the state’s insurance privacy laws date back to the 1980s and don’t contemplate all the ways that consumer data can be collected and shared.

The bill passed 5-2 out of the Insurance Committee and was sent to the Judiciary Committee.

Images

Featured image: Sen. Monique Limón speaks during an April 9, 2025 Senate Insurance Committee hearing on SB 354.