April 8, 2011

Ms. Susan Denmon Banowsky

Vinson & Elkins, L.L.P.

For Texas Windstorm Insurance Association

2801 Via Fortuna, Suite 100

Austin, Texas 78746

OR2011-04859

Dear Ms. Banowsky:

You ask whether certain information is subject to required public disclosure under the Public Information Act (the "Act"), chapter 552 of the Government Code. Your request was assigned ID# 414060.

The Texas Windstorm Insurance Association (the "association"), which you represent, received two requests from the same requestor for addresses and payment amounts related to certain Hurricane Ike claims paid by the association. You claim the requested information is excepted from disclosure pursuant to sections 552.101 and 552.103 of the Government Code. We have considered the exceptions you claim and reviewed the submitted representative sample of information. ⁽¹⁾ We have also received and considered comments from the requestor. ⁽²⁾ See Gov't Code § 552.304 (interested party may submit written comments regarding availability of requested information).

Initially, we note the submitted information falls within the scope of section 552.022(a)(3) of the Government Code, which provides that information in account, voucher, or contract relating to receipt or expenditure of public or other funds by a governmental body is subject to required public disclosure unless it is made expressly confidential under "other law." See id. § 552.022(a)(3). The association claims the submitted information is excepted from disclosure under section 552.103 of the Government Code. However, this is a discretionary exception to disclosure that protects a governmental body's interests and may be waived. See Dallas Area Rapid Transit v. Dallas Morning News, 4 S.W.3d 469, 475-76 (Tex. App.--Dallas 1999, no pet.) (governmental body may waive section 552.103); Open Records Decision Nos. 665 at 2 n.5 (2000) (discretionary exceptions generally), 542 at 4 (1990) (statutory predecessor to section 552.103 may be waived). As such, section 552.103 is not other law that makes information confidential for the purposes of section 552.022. Therefore, the association may not withhold any of the submitted information under section 552.103 of the Government Code. As section 552.101 of the Government Code constitutes "other law" for purposes of section 552.022, we will consider the association's arguments for the submitted information under this exception.

Section 552.101 of the Government Code excepts from disclosure "information considered to be confidential by law, either constitutional, statutory, or by judicial decision." Gov't Code § 552.101. You assert the requested information is excepted from public disclosure under section 552.101 in conjunction with the Gramm-Leach-Bliley Act (the "GLB Act") and state insurance regulations. See 15 U.S.C. § 6801 et seq. The Federal Financial Modernization Act, also known as the GLB Act, became law in November 1999. The purpose of the GLB Act is to promote competition in the financial services industry. See H.R. Conf. Rep. No. 106-434, at 245 (1999), reprinted in 1999 U.S.C.C.A.N. 245, 245. Reflecting Congressional concern regarding the dissemination of consumers' personal financial information, the GLB Act provides certain privacy protections "to protect the security and confidentiality of [consumers'] nonpublic personal information." 15 U.S.C. § 6801(a). The statute defines nonpublic personal information ("NPI") as "personally identifiable financial information ["PIFI"] - (i) provided by a consumer to a financial institution; (ii) resulting from any transaction with the consumer or any service performed for the consumer; or (iii) otherwise obtained by the financial institution." Id. § 6809(4)(A). Federal regulations define PIFI as

any information: (i) [a] consumer provides to [a regulated financial institution] to obtain a financial product or service . . . ; (ii) [a]bout a consumer resulting from any transaction involving a financial product or service between [a regulated financial institution] and a consumer; or (iii) [a regulated financial institution] otherwise obtain[s] about a consumer in connection with providing a financial product or service to that consumer.

16 C.F.R. § 313.3(o)(1). Sections 6802(a) and (b) of title 15 of the United States Code provide in pertinent part as follows:

(a) Notice requirements

Except as otherwise provided in this subchapter, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title.

(b) Opt out

(1) In general

A financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless-

(A) such financial institution clearly and conspicuously discloses to the consumer, in writing or in electronic form or other form permitted by the regulations prescribed under section 6804 of this title, that such information may be disclosed to such third party;

(B) the consumer is given the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed to such third party; and

(C) the consumer is given an explanation of how the consumer can exercise that nondisclosure option.

15 U.S.C. § 6802(a), (b). "Nonaffiliated third party" is defined as "any entity that is not an affiliate of, or related by common ownership or affiliated by corporate control with, the financial institution, but does not include a joint employee of such institution." Id. § 6809(5). Section 6809(3)(A) of title 15 of the United States Code defines financial institution as "any institution the business of which is engaging in financial activities as described in section 1843(k) of Title 12." 15 U.S.C. § 6809(3)(A). Section 1843(k)(4)(b) of title 12 defines the following activity as financial in nature: "Insuring, guaranteeing, or indemnifying against loss, harm, damage, illness, disability, or death, or providing and issuing annuities, and acting as principal, agent, or broker for purposes of the foregoing, in any State." 12 U.S.C. § 1843(k)(4)(B).

Similarly, subchapter A of chapter 22 of the Texas Administrative Code governs the treatment of nonpublic personal financial individuals by covered entities. 28 T.A.C. § 22.1(a); see id. § 22.1(b) (providing scope of subchapter A of chapter 22). A covered entity is defined as "[a]n individual or entity who receives an authorization from the Texas Department of Insurance[,]" including an individual or entity to which chapter 82 of the Insurance Code is applicable. Id. § 22.2(11) (defining "covered entity); see also Ins. Code § 82.002 (listing types of companies to which chapter 82 of Insurance Code applies). For purposes of subchapter A, "nonpublic personal financial information" includes

(i) personally identifiable financial information;

(ii) any list, description or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable financial information that is not publicly available; and

(iii) any list of individuals' names and street addresses that is derived in whole or in part using personally identifiable financial information that is not publicly available, such as account numbers.

22 T.A.C. 22.2(21). Additionally, section 22.14 of title 28 of the Texas Administrative Code provides as follows:

(a) Conditions for disclosure. Except as otherwise authorized in this subchapter, a covered entity may not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless:

(1) the covered entity has provided to the consumer an initial notice as required under § 22.8 of this title (relating to Initial Privacy Notice);

(2) the covered entity has provided to the consumer an opt out notice as required in § 22.11 of this title (relating to Form of Opt Out Notice to Consumers and Opt Out Methods);

(3) the covered entity has given the consumer a reasonable opportunity, before it discloses the information to the nonaffiliated third party, to opt out of the disclosure; and

(4) the consumer does not opt out.

28 T.A.C. § 22.14(a). For purposes of section 22.14, a nonaffiliated third party is "[a]n entity that is not an affiliate of, or related to by common ownership or affiliated by corporate control with, the covered entity." Id. § 22.2(20).

The association is an association composed of all property insurers authorized to engage in the business of property insurance in Texas, other than insurers prevented by law from writing on a statewide basis coverages available through the association. Ins. Code § 2210.051(a); see id. §§ 2210.006, 2210.051(b) (to engage in business of insurance in Texas, property insurer must be member of the association); see also 28 T.A.C. § 5.4001(c)(2)(D). The primary purpose of the association is to provide an adequate market for windstorm and hail insurance in Texas seacoast territories. Id. § 2210.001. In addition, you state the association is an insurance company. See id. §§ 2210.053(a)(1), .203(a); see also Tex. Windstorm Ins. Ass'n v. Poole, 255 S.W.3d 775, 777 (Tex. App.--Amarillo 2008, pet. denied) (the association has "attributes of a private insurance business while operating under a governmental cloak"). Based on these representations, we agree the association is a financial institution for purposes of the GLB Act and a covered entity for purposes of section 22.14. We understand the requestor is a nonaffiliated third party. See 15 U.S.C. § 6809(5); 28 T.A.C. § 22.2(20).

You seek to withhold the requested addresses and claim amounts. You state the information at issue was provided to the association for the purpose of obtaining insurance and is also information resulting from transactions with insureds or services performed for insureds by the association, a regulated financial institution. See 15 U.S.C. § 6809(4)(A); 16 C.F.R. § 313.3(o)(1). You do not indicate the association provided opt out notices to the insureds. However, we note some of the submitted information pertains to commercial policyholders. The GLB Act and chapter 22 of title 28 of the Texas Administrative Code define a consumer as an individual who obtains insurance or financial products or services from a financial institution which are to be used primarily for personal, family, or household purposes. 15 U.S.C. § 6809(9); 28 T.A.C. § 22.2(8); see also 16 C.F.R. § 313.3(e)(1). Further, in Individual Reference Services Group, Inc. v. Federal Trade Commission, 145 F. Supp.2d 6, 30 (D.D.C. 2001), the court ruled PIFI includes only information about individuals who obtain financial services primarily for family, personal, or household purposes; therefore, excluding all information provided by individuals for business purposes.  145 F. Supp.2d at 30; see also 16 C.F.R. § 313.1(b). Thus, some of the submitted information only pertains to commercial policyholders that are not consumers for purposes of the GLB Act or chapter 22 of title 28 of the Texas Administrative Code. Because the information related to commercial policyholders was provided to the association by insureds who are not consumers, this information does not fall under the definition of PIFI. Accordingly, we find the submitted commercial policyholder information does not constitute confidential NPI for purposes of the GLB Act or chapter 22 of title 28 of the Texas Administrative Code. Thus, we find the commercial policyholder information may not be withheld under section 552.101 of the Government Code in conjunction with the GLB Act or chapter 22 of title 28 of the Texas Administrative Code. Because the remaining address information was provided to the association by insured consumers in order to obtain a service, this information falls under the definition of PIFI. See generally Individual, 145 F. Supp.2d at 26-31 (D.D.C. 2001) (discussing language, structure, and history of GLB Act to determine whether certain information meets definition of PIFI). Based on your representations and our review, we determine the association is prohibited by section 6802(a) and (b) of title 15 of the United States Code and section 22.14(a) of title 28 of the Texas Administrative Code from releasing the insured consumers' address information. Accordingly, the association must withhold the insured consumers' addresses under section 552.101 in conjunction with the GLB Act. Because the claim amounts do not personally identify any of the insured consumers, this information does not constitute PIFI or non-public personal financial information. Therefore, the remaining information may not be withheld under section 552.101 in conjunction with the GLB Act or section 22.14(a).

Section 552.101 of the Government Code also encompasses the doctrine of common-law privacy, which protects information that (1) contains highly intimate or embarrassing facts, the publication of which would be highly objectionable to a reasonable person and (2) is not of legitimate concern to the public. Indus. Found. v. Tex. Indus. Accident Bd., 540 S.W.2d 668, 685 (Tex. 1976). Prior decisions of this office have found financial information relating only to an individual ordinarily satisfies the first requirement of the test for common-law privacy, but there is a legitimate public interest in the essential facts about a financial transaction between an individual and a governmental body. See Open Records Decision Nos. 600 (1992), 545 (1990), 373 (1983). For example, information related to an individual's mortgage payments, assets, bills, and credit history is generally protected by the common-law right to privacy. See Open Records Decision Nos. 545, 523 (1989); see also ORD 600 (personal financial information includes choice of particular insurance carrier). However, most of the remaining information pertains to business entities. We note common-law privacy protects the interests of individuals, not those of corporate and other business entities. See Open Records Decision Nos. 620 (1993) (corporation has no right to privacy), 192 (1978) (right to privacy is designed primarily to protect human feelings and sensibilities, rather than property, business, or other pecuniary interests); see also United States v. Morton Salt Co., 338 U.S. 632, 652 (1950) (cited in Rosen v. Matthews Constr. Co., 777 S.W.2d 434 (Tex. App--Houston [14th Dist.] 1989), rev'd on other grounds, 796 S.W.2d 692 (Tex. 1990)) (corporation has no right to privacy). In addition, because the identifying information of insured consumers is being withheld under section 552.101 in conjunction with the GLB Act, the remaining information does not implicate the privacy interest of an individual. Therefore, the remaining information is not confidential under common-law privacy, and the association may not withhold it under section 552.101 of the Government Code on that basis.

Section 552.101 of the Government Code also encompasses section 36.159 of the Insurance Code, which governs the Texas Department of Insurance subpoena powers and duty to protect confidentiality of privileged records. You assert section 36.159(c) makes confidential the remaining information at issue. Subchapter C of chapter 36 pertains to the power of the commissioner of the Texas Department of Insurance (the "commissioner") to issue subpoenas with respect to a matter that the commissioner has authority to consider or investigate. See Ins. Code § 36.152. Section 36.159 provides in relevant part the following:

(a) A record subpoenaed and produced under this subchapter that is otherwise privileged or confidential by law remains privileged or confidential until admitted into evidence in an administrative hearing or a court.

. . .

(c) Specific information relating to a particular policy or claim is privileged and confidential while in the possession of an insurance company, organization, association, or other entity holding a certificate of authority from the department and may not be disclosed by the entity to another person, except as specifically provided by law.

Id. § 36.159(a), (c). You assert the remaining information is confidential under section 36.159(c) because the association is an insurance company and an association, and the requested information relates to particular claims in the association's possession. See id. § 36.159(c). You state the requested information was released to the Texas Department of Insurance (the "department") pursuant to the department's investigative authority. See id.§ 38.001(b). However, you have not shown the remaining information is otherwise privileged or confidential by law and relates to a matter in which the commissioner has issued a subpoena pursuant to subchapter C of chapter 36 the Insurance Code. See id. §§ 36.152, .159(a). Accordingly, we find you have failed to establish the remaining information is confidential under section 36.159(c) of the Insurance Code, and the association may not withhold it under section 552.101 of the Government Code on that ground.

In summary, the association must withhold the submitted addresses of insured consumers under section 552.101 of the Government Code in conjunction with the GLB Act. The remaining information must be released to the requestor.

This letter ruling is limited to the particular information at issue in this request and limited to the facts as presented to us; therefore, this ruling must not be relied upon as a previous determination regarding any other information or any other circumstances.

This ruling triggers important deadlines regarding the rights and responsibilities of the governmental body and of the requestor. For more information concerning those rights and responsibilities, please visit our website at http://www.oag.state.tx.us/open/index_orl.php, or call the Office of the Attorney General's Open Government Hotline, toll free, at (877) 673-6839. Questions concerning the allowable charges for providing public information under the Act must be directed to the Cost Rules Administrator of the Office of the Attorney General, toll free, at (888) 672-6787.

Sincerely,

Jennifer Burnett

Assistant Attorney General

Open Records Division

JB/dls

Ref: ID# 414060

Enc. Submitted documents

c: Requestor

(w/o enclosures)

Footnotes

1. We assume the "representative sample" of information submitted to this office is truly representative of the requested records as a whole. See Open Records Decision Nos. 499 (1988), 497 (1988). This open records letter does not reach, and therefore does not authorize the withholding of, any other requested records to the extent those records contain substantially different types of information than that submitted to this office.

2. The requestor claims the requested information is "for the most part . . . no different than some of the [previously requested information]." However, we note the previous request at issue did not encompass the specific claimant addresses and claim amounts sought in the present request.

POST OFFICE BOX 12548, AUSTIN, TEXAS 78711-2548 TEL: (512) 463-2100 WEB: WWW.OAG.STATE.TX.US
An Equal Employment Opportunity Employer