Opinion
No. 31270
Submitted: October 7, 2003
Filed: March 15, 2004
Certified Questions from the Circuit Court of Harrison County, Honorable John Lewis Marks, Jr., Judge, Civil Action No. 01-C-414-1.
David J. Romano, Michael J. Romano, Romano Law Offices, Clarksburg, West Virginia, Attorneys for Frank S. Martino.
E. Kay Fuller, Walter M. Jones, III, Martin Seibert, L.C., Martinsburg, West Virginia, Attorneys for the defendant, Nationwide Mutual Insurance Company.
Sandra M. Murphy, Amy J. Tawney, Bowles Rice McDavid Graff Love P.L.L.C., Charleston, West Virginia, Attorneys for Amici Curiae, West Virginia Bankers Association and American Bankers Association.
JUSTICE ALBRIGHT delivered the opinion of the Court.
This matter involves three certified questions from the Circuit Court of Harrison County regarding whether applicable state and federal privacy laws allow dissemination of confidential customer information by an insurance company to an unaffiliated third party during the adjustment or litigation of an insurance claim. After completing our examination of the record, briefs and arguments presented in light of the applicable law, we conclude that nonpublic personal information may be subject to release pursuant to judicial process.
We have been informed that all matters in controversy in the underlying case have been settled. Nevertheless, "[a] case is not rendered moot even though a party to the litigation has had a change in status such that he no longer has a legally cognizable interest in the litigation or the issues have lost their adversarial vitality, if such issues are capable of repetition and yet will evade review." Syl. Pt. 1, State ex rel. M.C.H. v. Kinder, 173 W. Va. 387, 317 S.E.2d 150 (1984). Having determined that the questions presented raise issues subject to repetition which have significant public interest requiring guidance for the bar and public in future actions, we find the questions remain vital and are not rendered moot. See Syl. Pt. 1, Israel by Israel v. W. Va. Secondary Schools Activities Com'n, 182 W. Va. 454, 388 S.E.2d 480 (1989).
We pause to recognize the helpful contributions of the West Virginia Bankers Association and the American Bankers Association in this case through their submission of a joint brief as amici curiae.
I. Factual and Procedural History
The certified questions arise from a civil action in which Frank Martino, plaintiff below, alleges he was injured in an automobile accident on November 18, 1999, due to the negligence of, among others, Betty Jean Barnett, one of the defendants below. Ms. Barnett is insured by Nationwide Mutual Insurance Company (hereinafter referred to as "Nationwide"). Before filing the civil complaint, Mr. Martino asked Nationwide to supply Ms. Barnett's home address so that he could attempt service of the summons and complaint. Nationwide refused to disclose the home address of Ms. Barnett, claiming that to do so would violate the privacy provisions of the Gramm-Leach-Bliley-Act (hereinafter referred to as "GLBA" or "Act") and the West Virginia Insurance Commission's Privacy Rule (hereinafter referred to as "Privacy Rule"). Nationwide based its refusal to supply Ms. Barnett's address on the belief that, under these federal and state authorities, insurance companies are considered financial institutions which are prohibited from disclosing "nonpublic personal information" of its customers.
15 U.S.C. § 6801 to 6809.
114 C.S.R. Series 57, Privacy of Consumer Financial and Health Information.
Upon filing suit in the circuit court, Mr. Martino continued his efforts to acquire Ms. Barnett's home address from Nationwide. Mr. Martino notified Nationwide of his intent to depose a Nationwide representative in order to obtain certain factual information about Ms. Barnett, including her address, so that service of process could proceed. Nationwide responded by filing a motion for a protective order to enjoin the deposition. The motion was the subject of a hearing held by the lower court on February 13, 2002, at which both parties agreed the issues the GLBA and Privacy Rule raised regarding disclosure of customer information were proper to certify to this Court. At a subsequent hearing on August 26, 2002, the actual questions were formulated, and by order dated December 6, 2002, the lower court certified those questions to this Court pursuant to West Virginia Code § 58-5-2 (1998) (Supp. 2003). Upon finding the issues so certified contained questions of law necessary to the decision in the pending case, were sufficiently precise and were based on an undisputed factual record, we agreed to accept the certified questions by order entered on April 10, 2003.
See Bass v. Coltelli, 192 W. Va. 516, 453 S.E.2d 350 (1994).
II. Standard of Review
This Court's review of the certified questions presented is plenary as "`[t]he appellate standard of review of questions of law answered and certified by a circuit court is de novo.' Syllabus point 1, Galapoo v. Wal-Mart Stores, Inc., 197 W. Va. 172, 475 S.E.2d 172 (1996)." Syl. Pt. 2, Keplinger v. Virginia Elec. and Power Co., 208 W. Va. 11, 537 S.E.2d 632 (2000).
III. Certified Questions
The December 6, 2002, order of the circuit court sets forth the following legal questions and corresponding responses of the lower court:
1. Does the West Virginia Privacy Rule and the GLBA restrict the dissemination by an insurance company of "nonpublic personal information" regarding an insured or any other person to a claimant or a claimant's legal representative necessary for the proper adjustment of a claim?
Answer of the circuit court: No.
2. Does the West Virginia Privacy Rule and the GLBA restrict the dissemination by an insurance company of "nonpublic personal information" regarding an insured or any other person through the discovery process to a claimant/plaintiff once civil litigation is instituted against an insured?
Answer of the circuit court: No.
3. To what degree do the West Virginia Privacy Rule and GLBA provisions restricting dissemination by an insurance company of "nonpublic personal information" regarding an insured or any other person control an insurance company's duties under the West Virginia Unfair Trade Practices Act, W. Va. Code § 33-11-1 et seq.?
Answer of the circuit court: In accordance with the Court's answers to questions [I] and [II], the Court concludes that the West Virginia Privacy Rule and the GLBA provisions restricting dissemination by an insurance company of "nonpublic personal information" regarding an insured or any other person do not control, to any degree, an insurance company's duties under the West Virginia Unfair Trade Practices Act.
In developing its response to the first two questions, the lower court noted in its order that the GLBA expressly allows disclosure of personal information to "`comply with Federal, State, or local laws, rules and other applicable legal requirements. . . .' 15 U.S.C. § 6802 (e)(8)." The court then reasoned that the West Virginia Rules of Civil Procedure are the type of state rules contemplated by the GLBA and the comparable provisions of the Privacy Rule. Thus, the lower court concluded, information discoverable under the Rules of Civil Procedure is excepted from the GLBA and the Privacy Rule. Moreover, the court below observed a limited purpose or intent for the privacy provisions finding that "the legislative history of the GLBA indicates that the Act was passed in order to prohibit the sharing of nonpublic personal information between financial institutions and non-affiliated third parties for marketing purposes" (footnote omitted).
We believe that merging the first two questions will allow a more complete examination of the law with regard to the issues raised. As we have previously said,
[w]hen a certified question is not framed so that this Court is able to fully address the law which is involved in the question, then this Court retains the power to reformulate questions certified to it under both the Uniform Certification of Questions of Law Act found in W. Va. Code, 51-1A-1, et seq. and W. Va. Code, 58-5-2 [1967], the statute relating to certified questions from a circuit court of this State to this Court.
Syl. Pt. 3, Kincaid v. Mangum, 189 W. Va. 404, 432 S.E.2d 74 (1993). Accordingly, we exercise our discretion by combining the first two questions presented by the court below into the following single question:
Do the exceptions to the privacy provisions of the GLBA and the West Virginia Privacy Rule allow, attendant to judicial involvement, dissemination by an insurance company to a claimant or a claimant's representative of nonpublic personal information obtained from an insured? Subject to the limitations set forth in the discussion of this question, we answer the question in the affirmative.
IV. Discussion
A. Applicable Statutes and Regulations
Turning to the pertinent legal authorities, we first note that the GLBA was signed into law in November of 1999 with the overall purpose of enhancing "`competition in the financial services industry by providing a prudential framework for the affiliation of banks, securities, firms, insurance companies, and other financial providers. . . .' H.R. Conf. Rep. No. 106-434, at 245 [sic] (1999), reprinted in 1999 U.S.C.C.A.N. 245, 245." Landry v. Union Planters Corp., 2003 WL 21355462, 3 (E.D.La. June 6, 2003). The privacy provisions at issue in this case are contained in Title V of the Act, in which Congress expressed the following privacy obligation policy:
Codified at 15 U.S.C. § 6801.
(a). . . . It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information.
(b) FINANCIAL INSTITUTION SAFEGUARDS. — In furtherance of the policy in subsection (a), each agency or authority described in section 505(a) [ 15 U.S.C. § 6805(a)] shall establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical and physical safeguards —
(1) to insure the security and confidentiality of customer records and information;
(2) to protect against any anticipated threats or hazards to the security or integrity of such records; and
(3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.
Pub.L. No. 106-102, § 501, 113 Stat. 1338. In furtherance of this purpose, the GLBA sets forth a procedure whereby financial institutions falling within the purview of the Act may not disclose nonpublic personal information without first notifying its clients of the financial institution's disclosure policies and affording them the opportunity to bar any disclosure of such information by "opting out." See 15 U.S.C. § 6802 (a) and (b). However, the GLBA provides exceptions to its notification and opt-out procedures, including when it is necessary:
to comply with Federal, State, or local laws, rules, and other applicable legal requirements; to comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities; or to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.
15 U.S.C. § 6802 (e)(8), (hereinafter referred to as "Exception 8"). The Act also granted rule-making authority to various federal agencies to implement the provisions of the GLBA. See e.g. 16 C.F.R. § 313.1 to 313.18 (Federal Trade Commission); 17 C.F.R. § 248.1 to 248.30 (Securities and Exchange Commission). The regulations applicable to Nationwide in the instant case were promulgated by the Federal Trade Commission and contain the following provisions regarding Exception 8:
(a) Exceptions to opt out requirements.
The requirements for initial notice . . . and the opt out . . . and for service providers and joint marketing . . . do not apply when you disclose nonpublic personal information:
. . .
(7)(i) To comply with Federal, State, or local laws, rules and other applicable legal requirements;
(ii) To comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by Federal, State, or local authorities; or
(iii) To respond to judicial process or government regulatory authorities having jurisdiction over you for examination, compliance, or other purpose as authorized by law.
During the process of enacting the GLBA, Congress expressed its hope "that State insurance authorities would implement regulations necessary to carry out the purposes of this title and enforce such regulations as provided in this title." H.R. Conf. Rpt. 106-434, at 171 (reprinted in 1999 U.S.C.C.A.N. 245, 265). Thereafter, the West Virginia Legislature enacted legislation providing that "[n]o person shall disclose nonpublic personal information contrary to the provisions of Title V of the Gramm-Leach-Bliley Act" and without further direction authorized the state insurance commissioner to promulgate rules to reach this aim. W. Va. Code § 33-6F-1 (2001) (Repl. Vol. 2003). Accordingly, the Privacy Rule was developed with similar provisions to those contained in the GLBA except that it also applies to disclosure of certain medical information. In addition to embracing a similar notification framework as the GLBA, the Privacy Rule contains virtually the same Exception 8 language as the relevant federal regulation ( 16 C.F.R. § 313.15) quoted earlier in this opinion.
The entire text of West Virginia Code § 33-6F-1 reads as follows:
(a) No person shall disclose any nonpublic personal information contrary to the provisions of Title V of the Gramm-Leach-Bliley Act, Pub.L. 106-102 (1999).
(b) On or before the first day of July, two thousand one, the commissioner shall propose rules for legislative approval in accordance with article twenty [§ 29A-20-1 et seq.], chapter twenty-nine-a of this code necessary to carry out the provisions of Title V of the Gramm-Leach-Bliley Act, Pub.L. 106-102 (1999) and this article.
Our discussion is strictly limited to nonpublic personal financial information, as release of medical information is not at issue and may well raise other considerations.
The Privacy Rule reads in pertinent part:
1.2. Authority. — W. Va. Code §§ 33-2-10, 33-6F-1 and 33-11A-4.
a. This rule:
1. Requires a licensee to provide notice to individuals about its privacy policies and practices;
2. Describes the conditions under which a licensee may disclose nonpublic personal health information and nonpublic person financial information about individuals to affiliates and nonaffiliated third parties; and
3. Provides methods for individuals to prevent a licensee from disclosing that information.
b. This rule applies to:
1. Nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees. This rule does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes; and
2. All nonpublic personal health information.
114 C.S.R. 57 § 1.2 (2002).
The Privacy Rule Exception 8 provisions state:
14.1. The requirements for initial notice to consumers . . . [and] opting out . . . do not apply when a licensee discloses nonpublic personal financial information:
. . .
l. To comply with federal, state or local laws, rules and other applicable legal requirements;
m. To comply with a properly authorized civil, criminal or regulatory investigation, or subpoena or summons by federal, state or local authorities; or
n. To respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance or other purposes as authorized by law. . . .
114 C.S.R. 57 § 14.1 (2002).
B. Exceptions
Nationwide contends that the privacy provisions of the GLBA are intended to protect consumers from more than the marketing ventures the lower court referenced, and asserts that neither the GLBA nor the Privacy Rule provide an exception which would allow financial institutions to disclose nonpublic personal information of a customer to a non-affiliated third party before a law suit is filed or in a law suit where the insurer is not a named party. Mr. Martino concedes that under the definitions of the GLBA Nationwide is a financial institution and that the information he requests is technically nonpublic personal information of a customer which the Act generally protects from disclosure to nonaffiliated third parties. However, Mr. Martino is in agreement with the circuit court that the GLBA provides an express exception to the withholding of this confidential client information by financial institutions when it is necessary to comply with federal, state or local laws.
Due to the similarity of language between the federal law and the Privacy Rule and lack of any state legislative changes regarding the scope or purpose of the federal Act, we look initially to federal decisions interpreting the relevant provisions of the GLBA for guidance with regard to the reformulated question. However, the issue proves to be a novel one in the country since few courts, federal or state, have addressed the exceptions to the GLBA, and of those few only one has been in the context of judicial involvement. Actually, when the case sub judice was argued before this Court in October 2003, no federal court had addressed whether Exception 8 of the GLBA allows disclosure of nonpublic personal information to nonaffiliated third parties by financial institutions when the processes of the court have been invoked. However, in November 2003, the United States District Court for the Southern District of West Virginia handed down an opinion in Marks v. Global Mortgage Group, Inc., 218 F.R.D. 492 (S.D.W. Va. 2003), providing us with timely and pertinent considerations. Under review in Marks was a federal magistrate's order compelling discovery of nonpublic personal information of the defendant lender's customers. Similar to the lower court in the case sub judice, the magistrate determined that the information was subject to disclosure based on the GLBA exception language which permits release of otherwise confidential data "`to comply with Federal, State, or local laws, rules, and other applicable legal requirements.' See 15 U.S.C. § 6802(e)(8)." Id. at 495. The district court did not agree with this reasoning and found that the thrust of the language directing compliance with other laws and legal demands was tied to regulation of the financial industry with the limited purpose of the exception being "to allow financial institutions to comply with these various laws and requirements without fear of violating the GLBA. . . . [This language] does not create an exception for the disclosure of information in the course of civil discovery." 218 F.R.D. at 496. Nevertheless, the court in Marks went on to find that Congress did intend to except civil discovery from the general privacy provisions of the GLBA. In arriving at this conclusion, the Marks court observed that:
A decision of Supreme Court of Mississippi having relevance to the question before us was released prior the argument in this case, but that opinion was subsequently withdrawn on denial of rehearing on February 5, 2004. Equitable Life Assurance Society v. Irving, 2003 WL 22098021 (Miss. September 11, 2003).
At that time, the two federal courts presented with a question involving the reach of the GLBA exceptions did not focus on the language in Exception 8 or summarily dismissed discussion of the exception because it was irrelevant to the information sought. See Union Planters Bank, N.A. v. Gavel, 2003 WL 1193671 (E.D.La. March 12, 2003) (discussion limited to GLBA exception in 15 U.S.C. § 6802 (e)(3) involving use of personal privacy of financial account to perpetrate fraud); Landry v. Union Planters Corp., 2003 WL 21355462 (E.D.La. June 6, 2003) (discussion of any GLBA exception deemed unnecessary because the material sought to be discovered did not contain personal identification data).
[T]he legislative history indicates that the House Bill, which added the privacy protections to the GLBA, envisaged an independent judicial process exception. See H.R. 74, 106th Cong. 93, 108-09, 124 (1999) (discussing a judicial process exception without reference to "government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes authorized by law").
Id. The district court reasoned that the Exception 8 language "to respond to judicial process," as a wholly independent phrase from "to respond to . . . government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law," expressly excepted from the Act's general nondisclosure framework that information requested through the judicial process of discovery. 15 U.S.C. § 6802 (e)(8). The court in Marks also pointed out that even if the language of the GLBA did not provide a judicial process exception, previous federal decisions require more than Congressional silence to "give parties to a civil dispute the right to circumvent the discovery process." Marks, 218 F.D.R. at 496. In one of the federal decisions cited in Marks, Freeman v. Seligson, 405 F.2d 1326 (D.C. Cir. 1968), a United States Circuit Court of Appeals examined a statute blocking publication of personal or commercial information about business transactions obtained through investigation of boards of trade by the Secretary of Agriculture. It was decided that even though the statute at issue contained no express exception to the publication ban, it nevertheless posed no bar to the Secretary's compliance with a subpoena for examination of documents sought by a trustee for the purpose of determining whether a bankrupt had a cause of action for losses suffered in commodity exchanges. In this regard the majority in Freeman observed:
The principle favoring full access by the courts and litigants to relevant information, in the absence of strong competing considerations, is an important foundation for the achievement of justice by the courts in individual lawsuits. . . . In the absence of a specific prohibition against disclosure in judicial proceedings, such as Congress set forth in some statutes, clear and strong indication is required before it may be implied that the policy of prohibition is of such force as to dominate the broad objective of doing justice.
Id. at 1348.
While we recognize that the decision of the Marks court does not bind us, we find the reasoning in Marks regarding a "judicial process" exception to the GLBA very persuasive and compelling, especially in light of Freeman. While the decision by the court in Marks was necessarily limited by the facts before it to discovery, we see no basis for limiting the effect of the exception to discovery as no such limitation to application of the term "judicial process" appears in the GLBA exception. Consequently, we conclude that the GLBA and the Privacy Rule allow the use of any judicial process expressly authorized by statute or court rule, whether by way of discovery or for any other purpose expressly authorized by law, to obtain information relevant to the proceeding to which the judicial process relates from an insurance company that would otherwise fall within the privacy protections under the Act or the Rule. However, access to the information a claimant may seek is not without restriction. Trial courts have a right and a duty to balance the interests at stake and to fashion protective orders which limit access to necessary information only and uphold such principles of nondisclosure as attorney-client privilege and work product immunity. Again, we look to the sound reasoning of the court in Marks as support of this conclusion.
Although agreeing that exchange of information is inherent in our civil law, the court in Marks cautioned that the judicial process exception to the general privacy purposes of the GLBA does not provide a license to undercut the express interest of Congress in protecting the privacy of consumers' financial information. The court in Marks provides what we consider to be a reasonable, thoughtful and practical approach which prudently respects the legislative and judicial powers at play. Thus we agree with the court in Marks that the expressed congressional "strong interest in protecting the privacy of consumers' financial information" has to be weighed by the courts when determining whether to issue protective orders and developing the contents of those orders. Marks, 218 F.R.D. at 497.
C. Insurer's Duties Under the West Virginia Unfair Trade Practices Act
The remaining question before us poses the issue of whether the Privacy Rule and the GLBA privacy provisions affect the duties of an insurance company under the West Virginia Unfair Trade Practices Act (hereinafter referred to as "UTPA"). W. Va. Code §§ 33-11-1 to 33-11-10 (Repl. Vol. 2003). Mr. Martino asserts that the provisions of UTPA require a free and open exchange of information between a claimant and an insurance company in the area of insurance claim settlement. As a result, Mr. Martino contends, state law requires disclosure of otherwise protected information because release of such information "[t]o comply with Federal, State or local laws" is an exception under the Privacy Rule and the GLBA. 16 C.F.R. § 313.15(7)(i), 15 U.S.C. § 6802(e)(8). This argument overlooks the following express provision of the UTPA regarding treatment of consumer information by insurer's:
(12) Failure to maintain privacy of consumer financial and health information. — Any licensee who violates any provision of the commissioner's rule relating to the privacy of consumer financial and health information shall be deemed to have violated the provisions of this article: Provided, That any licensee who complies with the provisions of this subsection, a commissioner's rule, or a court order shall not be deemed to be in violation of any other provisions of sections three [§ 33-11-3] and four [§ 33-11-4] of this article by their compliance with this subsection, the rule or court order. For purposes of this subsection, "licensee" means all licensed insurers, producers and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered pursuant to this chapter.
W. Va. Code § 33-11-4 (2002) (Repl. Vol. 2003). The standards of the Privacy Rule, as discussed earlier in this opinion, limit disclosure of otherwise protected information to specific exceptions, which include compliance with judicial process. West Virginia Code § 33-11-4(12) makes it explicit that compliance with court orders is an additional exemption to those encompassed within the Privacy Rule. When presented with such clear legislative intent, this Court is duty-bound to apply the statute as written. Syl. Pt. 5, State of West Virginia v. General Daniel Morgan Post No. 548, V.F.W., 144 W. Va. 137, 107 S.E.2d 353 (1959). Thus, an insurance company is obliged to release nonpublic personal information in response to discovery pursuant to the judicial process exception of the Privacy Rule and in compliance with court order pursuant to West Virginia Code § 33-11-4(12), provided that the insurance company has had the opportunity to inform the court when the information is unnecessary or nondisclosure is warranted on other legal grounds.
IV. Conclusion
In summary, we answer the reformulation of the first two questions and the third certified question of the Circuit Court of Harrison County as follows:
1. Do the exceptions to the privacy provisions of the GLBA and the West Virginia Privacy Rule allow, attendant to judicial involvement, the dissemination by an insurance company to a claimant or a claimant's legal representative of nonpublic personal information obtained from an insured?
Answer: Yes, but subject to judicial protective orders and similar safeguards.
2. To what degree do the West Virginia Privacy Rule and GLBA provisions restricting dissemination by an insurance company of "nonpublic personal information" regarding an insured or any other person control an insurance company's duties under the West Virginia Unfair Trade Practices Act, W. Va. Code § 33-11-1 et seq.?
Answer: The duties of insurance companies under the West Virginia Unfair Trade Practices Act are subject to the provisions of the Privacy Rule and GLBA to the extent that West Virginia Code § 33-11-4(12) directs the release of nonpublic personal financial information must comply with the Privacy Rule, other rule of the insurance commissioner or court order.
Certified questions answered.