Editor's Note: The purpose of this article is to provide background information on the California Consumer Privacy Act, specifically on the exemptions that generally will be applicable to the insurance industry. While developing a compliance plan will require an in-depth analysis of the specific information that an insurance company collects, this article also poses questions that insurance companies should be considering as they finalize their compliance plans.   

As businesses everywhere rush to comply with the California Consumer Privacy Act ("CCPA"), which became effective January 1, 2020, insurance companies find themselves in a particularly precarious position because of the sheer amount of information they collect. All aspects of insurance — from accepting an application to underwriting to handling a claim — involve processing, transferring, and storing consumer information. While life and health insurance companies may collect different information than say property and casualty insurers, the collection and dissemination of consumer information permeates the industry, which makes the CCPA and its extensively broad definition of protected "personal information" troublesome for all insurance businesses.