Comments Submitted by:
Privacy Rights Clearinghouse
Consumers Union
Consumer Action
September 17, 2003
Donald Hilla, Senior Staff Counsel
California Department of Insurance
45 Fremont Street, 21st Floor
San Francisco, CA 94105
RE: RH 03031129, Consideration of Losses and Loss Exposure
- Notice of Proposed Action and Notice of Public Hearing (July 26, 2003), available at
www20.insurance.ca.gov/pdf/REG/24586.pdf - Initial Statement of Reasons, available at
www20.insurance.ca.gov/epubacc/REG/24606.htm - Text of Proposed Regulation, available at
www20.insurance.ca.gov/epubacc/REG/24606.htm
NOTE September 19, 2003: These comments were prepared to address specific regulatory proposals by the California Department of Insurance, which aimed to remedy certain unfair practices resulting from the insurance industry's use of loss reports, known as CLUE and A-Plus Reports. Hearings scheduled to consider the proposed regulations were originally scheduled for September 23, 2003 (Los Angeles) and September 25, 2003 (San Francisco). We have learned that the hearings have been postponed, but new dates have not been set. If needed, we will revise this posting to address any revisions to the Department's regulatory proposal. In the meantime, the views expressed here have not changed, and we urge the Department and the California legislature to act on this important consumer protection and privacy issue.
Dear Mr. Hilla:
The following nonprofit consumer organizations1 are pleased to offer these comments in support of the California Department of Insurance's (Department) Proposed Regulations to address growing consumer problems associated with property loss databases maintained by entities identified as "insurance support organizations."
- Privacy Rights Clearinghouse
- Consumers Union
- Consumer Action
Our comments are organized as follows:
Introduction.
A. Specific comments in response to the Department's Proposed Regulations
B. Concerns about the privacy and consumer protection implications of property loss databases.
C. Concerns about the insurance industry's use of insurance "scores" based on credit history.
D. Recommendations for Commission and legislative action to ensure customer protection and privacy for California insurance consumers.
Introduction
The major insurance support organization is the Comprehensive Loss Underwriting Exchange (CLUE), operated by ChoicePoint, Inc. The other insurance support organization whose service would be covered by the proposed regulation is ISO, supplier of the A-Plus report.
A crisis exists in California's homeowner's insurance market. In May of this year, the Department noted a four-fold increase in the number of consumer complaints about homeowner's insurance, topping the Department's complaint hotline.2 Non-renewal of coverage was a leading cause of consumer complaints, nearly always based on information included in a CLUE or A-Plus report. Adverse insurer decisions based upon inaccurate information included in reports was also a leading cause of consumer complaints.
One of the most troubling practices noted was that of a consumer's insurance being cancelled simply because the individual made an inquiry to the insurer without ever having filed a claim for loss. The Department also identified the serious disadvantage to consumers from lack of notice or knowledge about the loss databases.
Modest proposals in the 2003 state legislative session3 to correct unfair practices of insurers and insurance support organizations failed. For now, consumers have only the Department's rulemaking authority to act as a buffer against inadequate notice, inaccuracies, and unfair adverse insurance decisions based upon property loss databases.
A. Proposed Regulations
Reports issued from property loss databases, known commercially as the CLUE report (Comprehensive Loss Underwriting Exchange) and the A-Plus report, have been the source of much consumer confusion. Such reports often result in adverse and sometimes unfair insurance decisions about an insurer's risk of loss based on criteria unknown to consumers.
Undeniably, loss databases and reports issued by insurance support organizations use personal information that may have no logical connection to the insurer's risk of loss. Furthermore, there is ever growing reason to question the accuracy of negative information included in such reports. As a result, consumers unaware of rating criteria can be denied vital insurance services at a reasonable price. In our view, the Proposed Regulations will restore fairness to the underwriting process and stop certain practices that, unknown to consumers, form the basis of adverse insurance decisions.
We focus our comments on proposed section 2361, subsections (b), (d), (e), and (f).
Proposed Regulation sections 2361(b)(3)(i - iii), by defining the term "fully remedied and otherwise resolved," ensures a new degree of fairness for insurance consumers. The fact that an insurance claim was once made should not be a negative factor in an insurer's risk assessment when the problem has been remedied and there is no longer a risk of loss to the insurer.
A system that allows negative connotations drawn from a problem that no longer exists defies all standards of fairness. The Department's adoption of this definition should mean that prior property damage, once resolved, should not appear in the CLUE or A-Plus report. Adoption of the proposed definition should also mean that a consumer would not be penalized in a loss data report for loss to a property no longer owned by that consumer.
Proposed Regulation sections 2361(b)(4) and (b)(5) reinforce and clarify existing definitions in California Insurance Code Section 791.02. Section (b)(4) affirms an insurer's obligations to consumers under California law when an insurer cancels or denies coverage. Section (b)(5) leaves no doubt that information collected by insurance support organizations like ChoicePoint and ISO is included in the definition of personal information.
Proposed Regulation section 2361(d) will keep insurers from drawing a negative risk inference from the mere fact that a consumer inquires about coverage. The practice of weighing inquiries about coverage as a risk factor is particularly egregious.
The number of consumer complaints reported by the Department about CLUE warrants strict oversight of the insurance industry. Customer service is an accepted part of any business relationship today. Quite naturally, consumers call insurers with questions about coverage. For an insurer to collect information about a consumer inquiry and then, without notice to the consumer, report that inquiry to a national loss database is nothing short of deceitful. This practice must be prohibited.
Proposed Regulation section 2361(e) would require risk determinations to be based on information in addition to that obtained from an insurance support organization. In our view, this will decrease the possibility that risk determinations will be based on inaccurate information included in CLUE or A-Plus reports. Insurers will in effect be required to verify negative information from a source other than the insurance support organization.
Proposed Regulation section 2361(f) requires insurers to document hazards or conditions that led to an adverse underwriting decision. This is a minimum recordkeeping requirement for the insurer. For the consumer, such records are necessary to effectively exercise the right to dispute inaccurate or incomplete information included in a CLUE or A-Plus report.
B. Consumer Privacy Issues Raised by CLUE and A-Plus
A major factor fueling the privacy debate is the proliferation of databases containing personal information, with that data resold for a variety of commercial purposes without the individual's affirmative consent. Without knowing that such databases exist, individuals have had little choice but to grudgingly tolerate the fallout from the unregulated uses of those databases in the marketplace, namely "junk" mail and telemarketing calls. However, this lack of knowledge and absence of consumer control is untenable in a regulated industry like insurance where customers risk losing a critical financial product like homeowner's insurance without ever knowing the rules of the game.
Transparency and accuracy involving collection and uses of personal data form the foundation upon which consumer protection and privacy laws are based. Key laws are the federal Fair Credit Reporting Act (15 USC §1681 et seq.) and the California Investigative Consumer Reporting Agencies Act (California Civil Code §1786 et seq.)4
Likewise, transparency and accuracy are the primary tools individuals have to defend against identity theft, recently called the "crime of the times" by the Federal Trade Commission (FTC). On September 3, 2003, the FTC released a survey that found nearly 10 million victims of identity theft last year alone. www.ftc.gov/opa/2003/09/idtheft.htm The FTC's findings correspond with other recent surveys by Gartner, Inc. and Privacy and American Business.
The FCRA, which controls how consumer information is accessed, collected, and used, is the chief consumer privacy protection law of the land. It is the law consumers nationwide look to when attempting to prevent or repair instances of identity theft.
The stated purpose of the FCRA is to:
Require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information.(15 USC §1681(b))
When it comes to insurance, the FCRA serves a dual purpose. First, the FCRA allows access to credit reports and other consumer reports for "insurance to be used primarily for personal, family, or household purposes." (16 USC 1681a(d)(1)(A))
Second, the FCRA covers not just credit reports5 but any report that bears on a consumer's ". credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living . that serves as a factor in establishing the consumer's eligibility for . insurance ." (16 USC1681a(d)(1)) when the report is prepared by a "consumer reporting agency" as defined by subparagraph (f) of Section 1681a.
ChoicePoint, the supplier of the CLUE report, and ISO, the supplier of the A-Plus report, are consumer reporting agencies.
In short, insurance companies under the FCRA are both "users" of consumer reports and "furnishers" of information that are included in consumer reports. Companies furnish information about property loss claims to the insurance loss exchange database and then use that information when they request reports of loss history. Thus reports provided by CLUE and A-Plus are consumer reports under the FCRA.
The FCRA requires insurers to give notice to a consumer of an "adverse action." For insurance purposes, an adverse action means:
a denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of, any insurance, existing or applied for, in connection with the underwriting of insurance. (1681a(k)(1)(B)(i))
Insurers' obligations under the FCRA are affirmed by the Federal Trade Commission (FTC) in its publication "Consumer Reports: What Insurers Need to Know." www.ftc.gov/bcp/conline/pubs/buspubs/insurers.htm
Consumers who do not receive such an adverse action notice are denied the FCRA's fundamental promise of "fairness, impartiality, and respect for privacy." (16 USC §1681(a)(4)) The insurance industry's adherence to basic guidelines for collection and use of loss databases would go far to quell the current controversy, as would a clear explanation of reasons that an adverse action was taken.
But the FCRA falls far short on consumer protection in failing to require notice before an A-Plus or CLUE report is obtained. "Up-front" notice is required for employment reports but not insurance reports. This shortcoming in the FCRA deprives insurance customers of the ability to take measures that result in correction of inaccuracies before an adverse decision is taken.
Consumer complaints received by the Department as well as calls to the PRC hotline indicate that most individuals do not know that loss databases such as CLUE and A-Plus exist. Thus, when a homeowner's insurance policy is cancelled or denied based on inaccuracies in a loss database, the consumer is in the position of not only being uninsured but also having to disprove the information that led to the insurer's decision.
The general lack of understanding of even the better known credit reporting system was recently reported by a Consumer Federation of America study prepared for the 2003 Congressional hearings on the FCRA.
www.consumerfed.org/072803creditscores.html
From the CFA's July 28, 2003, press release:
Only 25 percent of Americans -- and less than 20 percent of those with incomes below $35,000 -- said they knew what their credit score was. And only three percent of Americans could, unprompted, name the three main credit bureaus -- Experian, Equifax, and Trans Union -- that provide both lenders and consumers with information from credit reports. Forty-three percent of Americans -- only 35 percent of those with incomes below $35,000 -- said they had obtained a copy of their credit report from the three credit bureaus in the past two years.
Recognizing the link between inaccurate information included in consumer reports and identity theft, California lawmakers adopted changes to the Investigative Consumer Reporting Agencies Act (ICRAA) in 2001. (AB655, California Civil Code §1786 et seq.) The ICRAA supplements the consumer and privacy protections of the FCRA for reports on consumers gathered for purposes of employment, insurance, and the hiring of dwelling units.6 But here, too, insurance consumers are shortchanged.
For job applicants and employees, the ICRAA adds significant notice requirements that enable individuals to correct inaccuracies. However, for insurance reports, the ICRAA limits itself to the definition of "investigative consumer report" included in subdivision (n) of Section 791.02 of the Insurance Code, which says.
(n) "Investigative consumer report" means a consumer report or portion thereof in which information about a natural person's character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with the person's neighbors, friends, associates, acquaintances, or others who may have knowledge concerning those items of information.7 [emphasis added]
This means that California insurance consumers are afforded the added protections of the ICRAA only when CLUE and A-Plus reports include information derived from personal interviews, not the usual method used to compile these reports. This is a significant loophole in the law. Such disparate treatment for insurance consumers warrants the Department's attention and increased efforts to improve consumers' plight associated with CLUE and A-Plus reports.
The ICRAA's shortcomings for insurance consumers can be remedied by a revision to the Insurance Code's definition of "investigative consumer report." Then consumers who are the subject of reports such as CLUE and A-Plus would have rights comparable to those that the subjects of employment background checks now have. Insurance consumers would then have the right to receive:
- Notice that a report for insurance purposes will be obtained.
- Notice of rights to receive a copy of the insurance report.
- Notice of the name, address, and telephone number of the investigative
consumer reporting agency that prepares the insurance report.
California Civil Code §1786.22 and §609 of the Fair Credit Reporting Act (15 USC §1681g) both give consumers the right of access to all information in the consumer's "file." This right to access is absolute in both statutes. It is not contingent upon the consumer having received an adverse action notice. Still, without up-front notice that includes the identity of the reporting agency that has the file, this is an empty right for consumers.
C. Consumer Privacy and Other Concerns Raised by Insurance Scores Based on Credit History
Access to credit reports for insurance underwriting is a "permissible purpose" under the FCRA. There is a growing trend among insurers to use consumers' credit history to calculate risk potential. Credit factors combined with other data make up the consumer's insurance "score." This means a consumer who for whatever reason has a late payment on an installment debt is automatically considered by insurers to be more likely than others to file an insurance property loss claim.
The use of credit history as a measure of insurance risk raises a number of issues, not the least of which is the potential for discrimination against certain segments of society. To address this issue, many states have pending legislation that would prohibit or curtail the use of credit history for insurance underwriting purposes. The states with pending legislation are listed on the web site of the National Association of Mutual Insurance Companies. www.namic.org/scorecard/03InsScoring.asp. Unfortunately, a California bill SB 64 which would have prohibited credit history as an underwriting factor did not pass the last legislative session.
In addition to the threat of bias against many Americans, we are also concerned about the failure of the credit reporting system to ensure accuracy of credit data. With recent studies finding identity theft crimes to number 7 to 10 million victims per year, it is reasonable to conclude that negative information should be viewed as suspect until proven otherwise.
The Department is justified in being concerned about the propensity for errors in credit reports and other consumer reports such as CLUE and A-Plus. A recent study investigated the accuracy and uses of automated credit scoring models: "Credit Score Accuracy and Implications for Consumers," by the Consumer Federation of America (CFA) and the National Credit Reporting Association (NCRA), Dec. 17, 2002. www.consumerfed.org/121702CFA_NCRA_Credit_Score_Report_Final.pdf 8
The CFA/NCRA study cites inaccuracies in credit reports as the fundamental flaw of credit score models.
The most fundamental issue connected to credit scoring is the level of accuracy of the information that forms the basis for the scores. Regardless of whether lending and pricing decisions are made by a manual or automated review of a consumer's credit, the potential for inaccuracies in credit reports to result in loan denials or higher borrowing costs is a cause for concern. Several organizations have conducted studies and surveys to quantify the pervasiveness of credit report errors, with widely ranging findings regarding how many credit reports contain errors (from 0.2% to 70%). (pg. 6)
The report concluded that "tens of millions" of consumers are at risk of being penalized because of incorrect information in credit reports. The potential penalties range from increased cost to decreased access. (CFA/NCRA Report, pg. 40)Most identity fraud victims learn about the crime through information included on the credit report. This could happen when the victim is turned down for credit or when the victim is contacted by a collection agency. Even if the consumer is not a victim of identity fraud, numerous administrative errors can result in negative and inaccurate information being reported. The CFA/NCRA study lists some of the reasons for inaccuracies in credit reports:
- Confusion between generations with the same name (Jr., Sr., II, III, etc.). Mixed files with similar names, but different Social Security numbers.Mixed files with matching Social Security numbers, but different names.Mixed files that list accounts recorded under the applicant's name, but with
the Social Security number of the co-applicant.Name variations that appeared to contain transposed first and middle names.Files that appeared to be tracking credit under an applicant's nickname.Spelling errors in the name.Transposing digits in the Social Security number. - An account reporting the consumer as deceased. (CFA/NCRA study, pg. 21)
In short, inaccuracies in credit reports are the rule, not the exception. When the insurance industry uses such unreliable information to calculate yet another "score," the effect is only to compound the errors. Consumers, with little or no knowledge of scoring practices, have no opportunity to correct inaccuracies before essential services like homeowner's insurance are denied.
D. Steps Needed to Protect California Insurance Consumers
We offer the following as measures that should be addressed by regulators and lawmakers in the coming year.
- The Department's Proposed Regulations should be adopted.California Insurance Code Section 791.02 should be amended to define
"investigative consumer report" consistent with other types of reports covered
by California Civil Code §1786 et seq. - Prohibit the use of credit history as a means of determining consumer's eligibility for insurance.
Again, the PRC, Consumers Union, and Consumer Action appreciate the opportunity to present our views. We support the Insurance Department's efforts to increase transparency and accuracy for reports that form the basis for insurance underwriting decisions.
Sincerely,
Tena Friery, Research Director
Beth Givens, Director
Privacy Rights Clearinghouse
www.privacyrights.org
Norma Garcia, Senior Attorney
Consumers Union
www.consumer.org
Ken McEldowney, Executive Director
Consumer Action
www.consumer-action.org
1 The Privacy Rights Clearinghouse is a nonprofit consumer education and advocacy organization based in San Diego, CA, and established in 1992. The PRC advises consumers on a variety of informational privacy issues through a series of fact sheets as well as individual counseling available via telephone and e-mail. It represents consumers' interests in legislative and regulatory proceedings on the state and federal levels. www.privacyrights.org
Consumers Union is a nonprofit membership organization chartered in 1936 under the laws of the State of New York to provide consumers with information, education, and counsel about goods, services, health and personal finance; and to initiate and cooperate with individual and group efforts to maintain and enhance the quality of life for consumers. Consumers Union publishes Consumer Reports. www.consumer.org
Consumer Action is a nonprofit, membership-based organization founded in San Francisco in 1971. It serves consumers nationwide by advancing consumer rights, referring consumers to complaint-handling agencies, publishing educational materials in many languages, advocating for consumers in the media and before lawmakers, and comparing prices on credit cards, bank accounts, and long distance services. www.consumer-action.org
2 Homeowner's Insurance Fact sheet, May 19, 2003. www.insurance.ca.gov/docs/FS-Consumer.htm 3 AB 81 (Wyland) and SB 64 (Speier). www.leginfo.ca.gov
4 These consumer protection laws are meant to work with, but never replace, the Department's exclusive authority to protect insurance consumers.
5 The FCRA also covers employment reports, reports made for renters, and a specific type of consumer report called an "investigative consumer report," limited to information gathered through personal interviews with a consumer's friends, neighbors, or associates.
6 California supplements consumer privacy protections for credit reports in the consumer Credit Reporting Agencies Act, Civil Code §1785 et seq.
7 This is the same definition used in the FCRA for a type of consumer report based on personal interviews. 15 USC §1681a(e)
8 A previous study by US PIRG found similar inaccuracies in credit reports. www.uspirg.org/uspirg.asp?id2=5970&id3=USPIRG&
