E. Kay Fuller
Walter M. Jones, III
Martin & Seibert, L.C.
Martinsburg, West Virginia
Attorneys for the defendant,
Nationwide Mutual Insurance Company
Sandra M. Murphy
Amy J. Tawney
Bowles Rice McDavid Graff & Love P.L.L.C.
Charleston, West Virginia
Attorneys for Amici Curiae,
West Virginia Bankers Association and
American Bankers Association
JUSTICE ALBRIGHT delivered the opinion of the Court.
2. When a certified question is not framed so that this Court is able to fully address the law which is involved in the question, then this Court retains the power to reformulate questions certified to it under both the Uniform Certification of Questions of Law Act found in W.Va.Code, 51-1A-1, et seq. and W.Va.Code, 58-5-2 , the statute relating to certified questions from a circuit court of this State to this Court. Syl. Pt. 3, Kincaid v. Mangum, 189 W.Va. 404, 432 S.E.2d 74 (1993).
3. Through a judicial process exception, the Gramm-Leach-Bliley Act and the Privacy Rule of the West Virginia Insurance Commission allow the use of any judicial process expressly authorized by statute or court rule, whether by way of discovery or for any other purpose expressly authorized by law, to obtain information relevant to the proceeding to which the judicial process relates from an insurance company that would otherwise fall within the privacy protections under the Act or the Rule. However, trial courts have a right and a duty to fashion protective orders which limit access to necessary information only and uphold such principles of nondisclosure as attorney-client privilege and work product immunity.
4. An insurance company is obliged to release nonpublic personal information in response to discovery pursuant to the judicial process exception of the Privacy Rule and in compliance with court order pursuant to West Virginia Code § 33-11-4(12) (2002) (Repl. Vol. 2003), provided that the insurance company has had the opportunity to inform the court when the information is unnecessary or nondisclosure is warranted on other legal grounds.
This matter involves three certified questions from the Circuit Court of
Harrison County regarding whether applicable state and federal privacy laws allow
dissemination of confidential customer information by an insurance company to an
unaffiliated third party during the adjustment or litigation of an insurance claim.
(See footnote 1)
completing our examination of the record, briefs
(See footnote 2)
and arguments presented in light of the
applicable law, we conclude that nonpublic personal information may be subject to release
pursuant to judicial process.
Upon filing suit in the circuit court, Mr. Martino continued his efforts to
acquire Ms. Barnett's home address from Nationwide. Mr. Martino notified Nationwide of
his intent to depose a Nationwide representative in order to obtain certain factual
information about Ms. Barnett, including her address, so that service of process could
proceed. Nationwide responded by filing a motion for a protective order to enjoin the
deposition. The motion was the subject of a hearing held by the lower court on February 13,
2002, at which both parties agreed the issues the GLBA and Privacy Rule raised regarding
disclosure of customer information were proper to certify to this Court. At a subsequent
hearing on August 26, 2002, the actual questions were formulated, and by order dated
December 6, 2002, the lower court certified those questions to this Court pursuant to West
Virginia Code § 58-5-2 (1998) (Supp. 2003). Upon finding the issues so certified contained
questions of law necessary to the decision in the pending case, were sufficiently precise and
were based on an undisputed factual record,
(See footnote 5)
we agreed to accept the certified questions by
order entered on April 10, 2003.
In developing its response to the first two questions, the lower court noted in its order that the GLBA expressly allows disclosure of personal information to 'comply with Federal, State, or local laws, rules and other applicable legal requirements. . . .' 15 U.S.C. § 6802 (e)(8). The court then reasoned that the West Virginia Rules of Civil Procedure are the type of state rules contemplated by the GLBA and the comparable provisions of the Privacy Rule. Thus, the lower court concluded, information discoverable under the Rules of Civil Procedure is excepted from the GLBA and the Privacy Rule. Moreover, the court below observed a limited purpose or intent for the privacy provisions finding that the legislative history of the GLBA indicates that the Act was passed in order to prohibit the sharing of nonpublic personal information between financial institutions and non-affiliated third parties for marketing purposes (footnote omitted).
We believe that merging the first two questions will allow a more complete
examination of the law with regard to the issues raised. As we have previously said,
[w]hen a certified question is not framed so that this Court is able to fully address the law which is involved in the question, then this Court retains the power to reformulate questions certified to it under both the Uniform Certification of Questions of Law Act found in W.Va.Code, 51-1A-1, et seq. and W.Va.Code, 58-5-2 , the statute relating to certified questions from a circuit court of this State to this Court.
Syl. Pt. 3, Kincaid v. Mangum, 189 W.Va. 404, 432 S.E.2d 74 (1993). Accordingly, we
exercise our discretion by combining the first two questions presented by the court below
into the following single question:
Do the exceptions to the privacy provisions of the GLBA and the West Virginia Privacy Rule allow, attendant to judicial involvement, dissemination by an insurance company to a claimant or a claimant's representative of nonpublic personal information obtained from an insured? Subject to the limitations set forth in the discussion of this question, we answer the question in the affirmative.
(a) . . . . It is the policy of the Congress that each financial
institution has an affirmative and continuing obligation to
respect the privacy of its customers and to protect the security
and confidentiality of those customers' nonpublic personal
(b) FINANCIAL INSTITUTION SAFEGUARDS. _ In furtherance of the policy in subsection (a), each agency or authority described in section 505(a) [15 U.S.C. § 6805(a)] shall establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical and physical safeguards _
(1) to insure the security and confidentiality of customer records and information;
(2) to protect against any anticipated threats or hazards to the security or integrity of such records; and
(3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.
Pub.L.No. 106-102, § 501, 113 Stat. 1338. In furtherance of this purpose, the GLBA sets forth a procedure whereby financial institutions falling within the purview of the Act may not disclose nonpublic personal information without first notifying its clients of the financial institution's disclosure policies and affording them the opportunity to bar any disclosure of such information by opting out. See 15 U.S.C. § 6802 (a) and (b). However, the GLBA provides exceptions to its notification and opt-out procedures, including when it is necessary:
to comply with Federal, State, or local laws, rules, and other applicable legal requirements; to comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities; or to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.
15 U.S.C. § 6802 (e)(8), (hereinafter referred to as Exception 8"). The Act also granted rule-making authority to various federal agencies to implement the provisions of the GLBA. See e.g. 16 C.F.R. §§ 313.1 to 313.18 (Federal Trade Commission); 17 C.F.R. §§ 248.1 to 248.30 (Securities and Exchange Commission). The regulations applicable to Nationwide in the instant case were promulgated by the Federal Trade Commission and contain the following provisions regarding Exception 8:
(a) Exceptions to opt out requirements.
The requirements for initial notice . . . and the opt out . . . and for service providers and joint marketing . . . do not apply when you disclose nonpublic personal information:
. . .
(7)(i) To comply with Federal , State, or local laws, rules and other applicable legal requirements;
(ii) To comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by Federal, State, or local authorities; or
(iii) To respond to judicial process or government regulatory authorities having jurisdiction over you for examination, compliance, or other purpose as authorized by law.
16 C.F.R. § 313.15.
During the process of enacting the GLBA, Congress expressed its hope that State insurance authorities would implement regulations necessary to carry out the purposes of this title and enforce such regulations as provided in this title. H.R. Conf. Rpt. 106-434, at 171 (reprinted in 1999 U.S.C.C.A.N. 245, 265). Thereafter, the West Virginia Legislature enacted legislation providing that [n]o person shall disclose nonpublic personal information contrary to the provisions of Title V of the Gramm-Leach-Bliley Act and without further direction authorized the state insurance commissioner to promulgate rules to reach this aim. W.Va. Code § 33-6F-1 (2001) (Repl. Vol. 2003). (See footnote 7) Accordingly, the Privacy Rule was developed with similar provisions to those contained in the GLBA except that it also applies to disclosure of certain medical information. (See footnote 8) In addition to embracing a similar notification framework as the GLBA, (See footnote 9) the Privacy Rule contains virtually the same Exception 8 language as the relevant federal regulation (16 C.F.R. § 313.15) quoted earlier in this opinion. (See footnote 10)
Due to the similarity of language between the federal law and the Privacy Rule
and lack of any state legislative changes regarding the scope or purpose of the federal Act,
we look initially to federal decisions interpreting the relevant provisions of the GLBA for
guidance with regard to the reformulated question. However, the issue proves to be a novel
one in the country since few courts, federal or state, have addressed the exceptions to the
GLBA, and of those few only one has been in the context of judicial involvement.
(See footnote 11)
Actually, when the case sub judice was argued before this Court in October 2003, no federal
court had addressed whether Exception 8 of the GLBA allows disclosure of nonpublic
personal information to nonaffiliated third parties by financial institutions when the
processes of the court have been invoked.
(See footnote 12)
However, in November 2003, the United States
District Court for the Southern District of West Virginia handed down an opinion in Marks
v. Global Mortgage Group, Inc., 218 F.R.D. 492 (S.D.W.Va. 2003), providing us with
timely and pertinent considerations. Under review in Marks was a federal magistrate's
order compelling discovery of nonpublic personal information of the defendant lender's
customers. Similar to the lower court in the case sub judice, the magistrate determined that
the information was subject to disclosure based on the GLBA exception language which
permits release of otherwise confidential data 'to comply with Federal, State, or local laws,
rules, and other applicable legal requirements.' See 15 U.S.C. § 6802(e)(8). Id. at 495.
The district court did not agree with this reasoning and found that the thrust of the language
directing compliance with other laws and legal demands was tied to regulation of the
financial industry with the limited purpose of the exception being to allow financial
institutions to comply with these various laws and requirements without fear of violating the
GLBA. . . . [This language] does not create an exception for the disclosure of information
in the course of civil discovery. 218 F.R.D. at 496. Nevertheless, the court in Marks went
on to find that Congress did intend to except civil discovery from the general privacy
provisions of the GLBA. In arriving at this conclusion, the Marks court observed that:
[T]he legislative history indicates that the House Bill, which added the privacy protections to the GLBA, envisaged an independent judicial process exception. See H.R. 74, 106th Cong. 93, 108-09, 124 (1999) (discussing a judicial process exception without reference to government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes authorized by law).
Id. The district court reasoned that the Exception 8 language to respond to judicial process, as a wholly independent phrase from to respond to . . . government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law, expressly excepted from the Act's general nondisclosure framework that information requested through the judicial process of discovery. 15 U.S.C. § 6802 (e)(8). The court in Marks also pointed out that even if the language of the GLBA did not provide a judicial process exception, previous federal decisions require more than Congressional silence to give parties to a civil dispute the right to circumvent the discovery process. Marks, 218 F.D.R. at 496. In one of the federal decisions cited in Marks, Freeman v. Seligson, 405 F.2d 1326 (D.C. Cir. 1968), a United States Circuit Court of Appeals examined a statute blocking publication of personal or commercial information about business transactions obtained through investigation of boards of trade by the Secretary of Agriculture. It was decided that even though the statute at issue contained no express exception to the publication ban, it nevertheless posed no bar to the Secretary's compliance with a subpoena for examination of documents sought by a trustee for the purpose of determining whether a bankrupt had a cause of action for losses suffered in commodity exchanges. In this regard the majority in Freeman observed:
The principle favoring full access by the courts and litigants to relevant information, in the absence of strong competing considerations, is an important foundation for the achievement of justice by the courts in individual lawsuits. . . . In the absence of a specific prohibition against disclosure in judicial proceedings, such as Congress set forth in some statutes, clear and strong indication is required before it may be implied that the policy of prohibition is of such force as to dominate the broad objective of doing justice.
Id. at 1348.
While we recognize that the decision of the Marks court does not bind us, we find the reasoning in Marks regarding a judicial process exception to the GLBA very persuasive and compelling, especially in light of Freeman. While the decision by the court in Marks was necessarily limited by the facts before it to discovery, we see no basis for limiting the effect of the exception to discovery as no such limitation to application of the term judicial process appears in the GLBA exception. Consequently, we conclude that the GLBA and the Privacy Rule allow the use of any judicial process expressly authorized by statute or court rule, whether by way of discovery or for any other purpose expressly authorized by law, to obtain information relevant to the proceeding to which the judicial process relates from an insurance company that would otherwise fall within the privacy protections under the Act or the Rule. However, access to the information a claimant may seek is not without restriction. Trial courts have a right and a duty to balance the interests at stake and to fashion protective orders which limit access to necessary information only and uphold such principles of nondisclosure as attorney-client privilege and work product immunity. Again, we look to the sound reasoning of the court in Marks as support of this conclusion.
Although agreeing that exchange of information is inherent in our civil law, the court in Marks cautioned that the judicial process exception to the general privacy purposes of the GLBA does not provide a license to undercut the express interest of Congress in protecting the privacy of consumers' financial information. The court in Marks provides what we consider to be a reasonable, thoughtful and practical approach which prudently respects the legislative and judicial powers at play. Thus we agree with the court in Marks that the expressed congressional strong interest in protecting the privacy of consumers' financial information has to be weighed by the courts when determining whether to issue protective orders and developing the contents of those orders. Marks, 218 F.R.D. at 497.
(a) No person shall disclose any nonpublic personal
information contrary to the provisions of Title V of the
Gramm-Leach-Bliley Act, Pub. L. 106-102 (1999).
(b) On or before the first day of July, two thousand one, the commissioner shall propose rules for legislative approval in accordance with article twenty [§29A-20-1 et seq.], chapter twenty-nine-a of this code necessary to carry out the provisions of Title V of the Gramm-Leach-Bliley Act, Pub. L. 106-102 (1999) and this article.
1. Nonpublic personal financial information about
individuals who obtain or are claimants or beneficiaries of
products or services primarily for personal, family or household
purposes from licensees. This rule does not apply to
information about companies or about individuals who obtain
products or services for business, commercial or agricultural
2. All nonpublic personal health information.
114 C.S.R. 57 § 1.2 (2002).
14.1. The requirements for initial notice to
consumers . . . [and] opting out . . . do not apply when a licensee discloses nonpublic personal financial information: