Landmark Consumer Privacy Bill to Modernize California’s Insurance Privacy Laws By Senate President pro Tempore Monique Limón Signed Into Law

What you need to know: SB 354, authored by pro Tempore Limón and sponsored by Commissioner Lara, will usher in much-needed modern privacy protections for Californians.

SACRAMENTO – Senate President pro Tempore Monique Limón and Insurance Commissioner Ricardo Lara today celebrated the signing of SB 354, the “Insurance Information and Privacy Protection Act”,  which provides critical updates to the state’s nearly 50-year-old insurance privacy laws. Authored by President pro Tempore Limón and sponsored by Commissioner Lara, SB 354 sets clear standards for how insurance licensees and their third-party vendors collect, process, and share personal information. As concerns about protecting consumers’ personal information keep growing within the insurance industry, SB 354 is even more timely and necessary.

Californians should not have to wonder who has their personal information. SB 354 gives consumers control of their most sensitive data and holds insurers and their vendors accountable for protecting that data. Thank you, Commissioner Lara, for your partnership in helping to bring our insurance privacy laws into the 21st century.

 

Senate President pro Tempore Monique Limón

Insurance companies routinely collect and analyze vast amounts of personal information, including financial records, medical histories, behavioral patterns, and demographic characteristics, at a depth and frequency that surpass most other industries. SB 354 directly tackles these growing data privacy risks by ensuring that Californians remain protected, informed, and in control of their personal information. It modernizes consumer privacy protections by increasing transparency and accountability for how insurers and third parties collect, use, and share personal information.

Californians shouldn’t have to be privacy experts to know who is collecting, sharing, or using their personal information. At a time when data is more valuable than ever, SB 354 puts consumers back in control and brings California’s insurance privacy protections into the 21st century. This new law gives Californians greater transparency, stronger rights, and greater confidence that their personal information will not be used in ways they never expected. I thank Senate President pro Tempore Monique Limón and Governor Newsom for their leadership in delivering this important protection for Californians.

 

Insurance Commissioner Ricardo Lara

Supporting Innovation within a Modern Insurance Privacy Framework

SB 354 affirms California’s constitutional commitment to privacy. The new law sets comprehensive privacy standards that Californians increasingly expect in today’s data-driven insurance business environment, including:

1. Clear and Enforceable Consumer Protections: SB 354 delivers meaningful, enforceable privacy protections, such as escalating penalties for licensees and third-party service providers found in violation of the Act. The bill also sets clear definitions, uniform standards, and clear-cut compliance pathways. These give insurers, insurance producers, surplus line insurers, reinsurers, and third-party service providers certainty, while ensuring consumers receive the robust safeguards they deserve.

2. Enhanced Consumer Privacy Rights: SB 354 enhances privacy protections by strengthening consumer rights to:
   1. consent to how their personal information is shared for purposes unrelated to the insurance transaction;
   2. amend, correct, or delete inaccurate personal information that licensees have about them, with limited exceptions;
   3. know what categories of personal information are collected, where the information comes from, and who it is shared with; and
   4. exercise their insurance privacy rights free from retaliation.

3. Permissible Uses: SB 354 ensures that data is gathered only for legitimate purposes, such as underwriting, servicing, or claims handling, and permits the consumer to opt-out of uses that are not required for an insurance transaction.

4. Prohibition on Sale of Personal Information: SB 354 prohibits the sale of consumers’ personal information and requires that the consumer be notified and permitted to opt-out of uses of sensitive personal information that are not required for an insurance transaction. It also creates accountability mechanisms to prevent misuse by insurers and their third-party service providers.

SB 354 takes effect July 1, 2028. Licensees get a delayed five-year implementation period for their records retention and deletion policies. Specified compliance provisions extend to California insurance producers, including insurance agents, brokers, and wholesale intermediaries, beginning January 1, 2029.