GLBA, NAIC Model 672 and carrier contracts: what stays out of an insurance agency data license

What stays out of an insurance agency data license, in one table

GLBA nonpublic personal information and insurance agencies

The Gramm-Leach-Bliley Act bars a financial institution from disclosing a consumer's nonpublic personal information to a nonaffiliated third party unless it has given the consumer notice and a chance to opt out before the information is first disclosed (source: 15 U.S.C. 6802 (Cornell LII)). A third party that receives information under those rules generally may not pass it on to anyone else the institution could not have disclosed to directly (§6802(c)) (source: 15 U.S.C. 6802 (Cornell LII)).

Three definitions decide how this applies to an agency:

• Consumer. An individual who obtains financial products or services for “personal, family, or household purposes”, or that individual's legal representative (§6809(9)) (source: 15 U.S.C. 6809 (Cornell LII)). Your personal lines clients are consumers; a business insured is not.
• Nonpublic personal information. Personally identifiable financial information a consumer provides, that results from a transaction or service, or that the institution otherwise obtains. It excludes publicly available information, and it includes any list or grouping of consumers derived using nonpublic personal information (§6809(4)) (source: 15 U.S.C. 6809 (Cornell LII)).
• Who enforces it. For anyone providing insurance, the applicable state insurance authority of the state where the person is domiciled (§6805(a)(6)) (source: 15 U.S.C. 6805 (Cornell LII)). In practice that means your state's version of NAIC Model 672.

Commercial files are not exempt just because the insured is a business. They name owners, officers, drivers, injured workers and claimants, and some of those people can be consumers in their own right. Treat every individual in a file as someone to remove.

NAIC Model 672 and de-identified agency data

Model 672, the Privacy of Consumer Financial and Health Information Regulation, governs how licensees treat nonpublic personal financial and health information about individuals (§2A) (source: NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation). Its definition of licensee covers “all licensed insurers, producers and other persons licensed or required to be licensed” under the state's insurance law (§4Q) (source: NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation), so it reaches independent agencies directly.

The parts that matter most for a data license:

• Blind data is outside personally identifiable financial information. The regulation excludes “information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names or addresses” (§4V(2)(b)(iii)) (source: NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation).
• Consumers are defined by purpose. As in GLBA, a consumer obtains insurance “to be used primarily for personal, family or household purposes” (§4F(1)) (source: NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation).
• Claimants can become consumers. A claimant under a policy becomes the licensee's consumer if the licensee discloses nonpublic personal financial information about that person to a nonaffiliated third party other than as the regulation permits, and workers comp claimants keep their protection on the same condition (§4F(2)(d) and (e)) (source: NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation).
• The sale exception is for a sale. Notice and opt-out do not apply to disclosures “in connection with a proposed or actual sale, merger, transfer or exchange” of all or part of a business, when the information concerns solely that business's consumers (§17A(6)) (source: NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation). That is written for selling the agency, not for licensing records. Our guide to selling an insurance agency covers how the two fit together.

Health information, workers comp and bodily injury claims

Model 672 handles health information more strictly than financial information. Nonpublic personal health information is health information that identifies the individual, or “with respect to which there is a reasonable basis to believe that the information could be used to identify an individual” (§4U) (source: NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation). And “a licensee shall not disclose” it without an authorization from the person it concerns (§18A) (source: NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation).

Section 18B lists insurance functions that do not need an authorization, from claims administration and underwriting to actuarial, scientific, medical or public policy research and activities connected with selling a business (source: NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation). Whether licensing records to an AI developer fits any of those is not something the text answers, and buyers typically avoid the question by excluding health content.

In an agency, health information turns up in more places than the benefits department:

• Workers comp claim files, injury reports and return-to-work notes.
• Bodily injury claims under auto and general liability policies.
• Loss runs that describe injuries.
• Life, disability and group health applications and enrollment files.

The usual approach is to exclude those record types as a whole, rather than trying to scrub them. Property and liability claims advocacy without injury detail is a different matter and can usually be de-identified.

MVRs and the Driver's Privacy Protection Act

Commercial auto files often hold motor vehicle records for every driver. The Driver's Privacy Protection Act lets insurers and their agents use that information “in connection with claims investigation activities, antifraud activities, rating or underwriting” (§2721(b)(6)), and allows research and statistical use only “so long as the personal information is not published, redisclosed, or used to contact individuals” (§2721(b)(5)) (source: 18 U.S.C. 2721 (Cornell LII)). An authorized recipient may resell or redisclose the information only for a permitted use (§2721(c)) (source: 18 U.S.C. 2721 (Cornell LII)).

Licensing MVRs to a third party is a redisclosure. Keep MVRs, driver schedules with license numbers, and any credit-based insurance scores out of the set entirely.

Carrier agency agreements: confidentiality and trade secrets

The agency owns its expirations and work product under the default rule, but carriers protect their own material. One agency agreement filed with the SEC treats “rates, forms, policies, program manuals, manuals, underwriting guidelines” as trade secrets of the carrier, to be “used only for the purpose provided herein”, with the obligation surviving termination (§8.1) (source: Crum & Forster agency agreement, SEC exhibit 10.1 (2009), sections 8.1 and 10.8).

Big I's model clause on client information has agent and carrier agree not to redisclose or use clients' nonpublic personal information “except as necessary to carry out the terms of this Agreement” or to complete a transaction the client requests, and its guide notes that a carrier “may have a significant interest in preserving the confidentiality of its commissions and quote data” (source: Big I, Guide to Agency-Company Appointment Contracts, v1.0).

What that usually means for a license:

• Out: rating manuals, underwriting guidelines and appetite guides, carrier forms, commission schedules and contingency agreements, and carrier pricing.
• Reduced: quotes and market summaries, kept as outcomes (quoted, declined, reason given) with carrier names and premiums removed; carrier and underwriter email, reviewed and stripped of rates and appetite detail, or left out.
• In: the agency's own notes, submissions it wrote, checklists, certificates, proposals and procedures.

Your own agency agreements govern, and they differ by carrier. Read the confidentiality and ownership sections of each one before you set the scope; you approve the scope, and the exclusions are named in writing.

NAIC Model 668: the Insurance Data Security Model Law and outside vendors

Model 668 requires licensees to maintain an information security program, and it reaches the vendors around them. A licensee “shall exercise due diligence in selecting its Third-Party Service Provider” and must require that provider to implement appropriate administrative, technical and physical measures to protect the nonpublic information it can access (§4F) (source: NAIC Model 668, Insurance Data Security Model Law). A third-party service provider is any person, not itself a licensee, that contracts with a licensee and is permitted access to nonpublic information through its services (§3P). Licensees with fewer than ten employees, counting independent contractors, are exempt from the program section (§9A(1)) (source: NAIC Model 668, Insurance Data Security Model Law).

The NAIC tracks which states have acted on the model on a map, last updated with status as of October 8, 2026 (source: NAIC, implementation map for Model 668 (status as of Oct 8, 2026)). If any outside party will handle raw agency files before they are de-identified, it is a service provider under these rules in states that adopted the model. The simplest answer is the one that runs through this guide: de-identify on your side, and deliver only the finished set. How to run that export under your AMS terms is in our guide to Applied Epic, AMS360 and HawkSoft data terms.

The NAIC insurance privacy model revision

The rules are being rewritten. The NAIC's Privacy Protections (H) Working Group has a charge to draft a new or revised privacy protections model to replace or update Models 670 and 672, and its charge refers to “collection, data ownership and use rights, and disclosure of information” gathered in insurance transactions. A full revised Model 672 draft dated July 24, 2026 is exposed for comment (source: NAIC Privacy Protections (H) Working Group).

Until states adopt a new version, the existing state rules apply. A license should still be written to survive changes: name the exclusions, state that no consumer or health information is included, and require the buyer not to try to re-identify anyone.

What an insurance agency can still license after the exclusions

Once consumers, claimants, drivers, health content and carrier material are out, a commercial lines agency still holds most of what buyers ask for:

• Account activity logs and service notes, with insureds and people tokenized.
• Submissions and ACORD applications, with the market response kept as an outcome.
• Endorsement, binder and certificate workflows.
• Policy checking logs and renewal and remarketing decisions.
• Property and liability claims advocacy without injury detail.
• SOPs, E&O procedures, training and agency-written proposals.

Our insurance agency data licensing guide shows which buyers name these records and who qualifies, and the data value checker shows what moves price. For a parallel in another regulated profession, see how IRC 7216 shapes accounting firm licensing. When the scope is clear, see what your agency's records could qualify for.

Frequently asked questions

Sources

Statutes, NAIC Models 672 and 668, the NAIC working group page and adoption map, the Big I guide, the SEC exhibit and the Vertafore terms read on their own pages on October 18, 2026. Program terms checked October 15, 2026; our buyer directory lists the programs and links to their published terms.

1. 15 U.S.C. 6802 (Cornell LII)
2. 15 U.S.C. 6805 (Cornell LII)
3. 15 U.S.C. 6809 (Cornell LII)
4. NAIC Model 672, Privacy of Consumer Financial and Health Information Regulation
5. NAIC Privacy Protections (H) Working Group
6. NAIC Model 668, Insurance Data Security Model Law
7. NAIC, implementation map for Model 668 (status as of Oct 8, 2026)
8. 18 U.S.C. 2721 (Cornell LII)
9. Big I, Guide to Agency-Company Appointment Contracts, v1.0
10. Crum & Forster agency agreement, SEC exhibit 10.1 (2009), sections 8.1 and 10.8
11. Vertafore Standard Terms, updated August 2026 (2.8.3)
12. program terms, Regulr buyer directory