PolicyBrief
S. 1544
119th CongressApr 30th 2025
Insurance Data Protection Act
IN COMMITTEE

The Insurance Data Protection Act modifies regulations regarding data collection, confidentiality, and information sharing involving insurance companies and federal financial regulatory bodies, limiting the subpoena power over insurance companies and promoting data sharing among regulators while protecting data confidentiality.

Katie Britt
R

Katie Britt

Senator

AL

LEGISLATION

Insurance Data Bill Slashes Federal Watchdog Powers, Tightens Controls on Insurer Info

The "Insurance Data Protection Act" is set to significantly rework how the federal government keeps an eye on the insurance industry and manages its sensitive data. In a nutshell, this bill proposes to take away the Federal Insurance Office's (FIO) power to issue subpoenas and enforce regulations, as stated in Section 2, and it also blocks the Office of Financial Research (OFR) from subpoenaing insurance companies, a change detailed in Section 4. The core idea seems to be beefing up data confidentiality for insurance companies while changing the playbook for how regulatory bodies get and share this information.

The Watchdogs Get Leashed: What Happens When Key Tools Disappear?

Imagine trying to understand a complex situation without being able to ask tough questions and demand full answers. That's pretty much what Sections 2 and 4 of this bill could mean for two key federal offices. Section 2 specifically repeals the FIO's subpoena and enforcement authority, which is currently listed in section 313(e)(6) of title 31, United States Code. This means the FIO, which monitors the insurance industry, could lose its ability to compel companies to hand over information or enforce certain rules. Think about it: if a new, potentially risky insurance product pops up, or if there are concerns about a company's stability, the FIO might find it much harder to dig deep and get the necessary details quickly if an insurer isn't fully cooperative.

Similarly, Section 4 amends the Financial Stability Act of 2010 to exclude insurance companies (as defined in section 201(a) of that Act) from the OFR's subpoena power. The OFR is tasked with spotting risks to the entire financial system. If it can't subpoena major insurance players, its ability to assess how the insurance sector might contribute to broader financial instability could be seriously hampered. For everyday folks, a less scrutinized insurance sector could mean less warning if big players are taking on risks that might eventually impact policies or even the economy.

The Information Maze: New Rules for Accessing and Protecting Insurer Data

Beyond stripping subpoena powers, the bill also changes how financial regulators can get their hands on insurance company data and how that data is protected. Section 5 lays out a new process: before financial regulators can collect data directly from an insurance company, they must first try to get it from other federal and state agencies, other insurance regulators, or public sources. Only if the info isn't available there can they go to the company, and even then, they have to follow specific procedures under title 44, United States Code, which deals with public printing and documents.

This "check everywhere else first" rule could create significant delays. If regulators need information quickly to assess a developing issue, this extra step could be a roadblock. While the bill, in Section 3 and Section 5, also aims to make it easier for the FIO and other agencies to share nonpublic insurance data amongst themselves while extending legal privilege and confidentiality over that shared information, the overall effect could be a slower, more indirect path to getting fresh information directly from insurers.

For example, Section 3 amends section 313(e)(5) of title 31, United States Code, to ensure that when the FIO shares nonpublic data, any legal privilege isn't waived. This is good for protecting sensitive company information. However, the combination of lost subpoena power and new hurdles for direct data collection means that while data can be shared between agencies under strict confidentiality, the initial pool of data available to regulators for crucial oversight might shrink or be harder to obtain in a timely fashion. While Section 5 notes that FOIA (Section 552 of title 5, United States Code) still applies to data submitted to financial regulators, the question becomes how much crucial data will be proactively sought and obtained by regulators if their primary tools for compelling its production are weakened.