Homeowner's Insurance Data Privacy Protections
HB1091 would create a new section of Colorado insurance law governing how homeowner’s insurance licensees, processors, and certain affiliates may collect, use, share, retain, and delete consumers’ personal data. The bill limits processing to purposes reasonably necessary for a homeowner’s insurance transaction unless the consumer affirmatively opts in or consents to other uses, including sale of data, targeted advertising, and joint marketing of cobranded financial products. It also requires clear privacy notices, written consent procedures, processor contracts, data security safeguards, retention schedules, annual review and deletion of no-longer-needed data, and data protection assessments for higher-risk processing.
The bill gives consumers several rights, including the right to confirm processing, access their data, request correction or deletion, receive portable copies of data, and obtain specific reasons and supporting data for adverse underwriting decisions. It also prohibits certain underwriting practices, such as denying coverage based solely on a prior owner’s loss history or on data from a processor without independent support. The bill creates enforcement authority for the insurance commissioner, classifies violations as unfair or deceptive acts or practices in the business of insurance, and authorizes a private right of action with damages, attorney fees, and potential treble damages for bad-faith or intentional violations.
In practical terms, the bill would significantly expand state-level privacy obligations for the homeowner’s insurance market and related vendors. It would amend Colorado insurance statutes by adding a new data privacy section and by tying violations to the state’s unfair insurance practices law. The bill also includes a delayed applicability date of January 1, 2028, and exempts depository institutions and certain affiliates already subject to federal Gramm-Leach-Bliley Act requirements unless they are acting as licensees under the bill.
The overall sentiment in committee appears mixed to negative. The bill received unanimous support for several amendments, but the final committee action was to postpone the bill indefinitely, indicating that it did not advance out of House Business Affairs & Labor. The vote history suggests some support for refining the proposal, but not enough consensus to move it forward in its introduced form.
The main points of contention likely centered on the breadth of the privacy restrictions, the compliance burden on insurers and processors, and the bill’s private right of action and damages provisions. The bill’s limits on data sharing, targeted advertising, and joint marketing, along with detailed notice, retention, and assessment requirements, would impose substantial operational changes on insurers and their vendors. Supporters would likely view those provisions as necessary consumer protections, while opponents may have viewed them as overly prescriptive or costly for the insurance market.
The bill would add section 10-4-125 to the Colorado Revised Statutes and amend section 10-3-1104 to make any violation of the new homeowner’s insurance data privacy section an unfair or deceptive insurance practice. It would regulate insurers, producers, surplus line insurers, their officers and agents, processors, affiliates, and certain reinsurers in connection with homeowner’s insurance transactions, while carving out some federally regulated depository institutions and affiliates. The measure would also authorize rulemaking by the insurance commissioner, administrative enforcement, civil penalties, and a consumer lawsuit remedy, thereby expanding both regulatory oversight and private enforcement in the insurance privacy space.
The bill’s committee history suggests a divided reception. Several amendments were adopted unanimously, showing some willingness to improve or narrow the proposal, but the bill ultimately failed to advance and was postponed indefinitely in committee. That outcome indicates that, despite some support for the concept of consumer privacy protections, there was not enough agreement on the final policy approach, scope, or enforcement structure to move the bill forward.
Likely areas of disagreement included whether the bill went too far in restricting insurers’ use of consumer data, especially for marketing, targeted advertising, and joint marketing, and whether the consent and notice requirements were too burdensome. Another likely point of contention was the private right of action with statutory damages and treble damages, which can raise concerns about litigation exposure. Insurers and processors may also have objected to the detailed retention, security, audit, and data protection assessment requirements, while supporters likely emphasized consumer control, transparency, and limits on underwriting based on stale or third-party data.