Acquisition and use of Personal Information

Personal information must only be acquired, displayed and used for specific lawful business purposes.

This means that authorized users must:

• Protect prospects’ and customers’ personal information and privacy when corresponding

electronically.

• Adhere to the “Principle of Least Privilege” which means that authorized users must only be able to see the personal information required to perform their job function. Any personal information not required to perform a job function must be omitted or truncated.

• Collect only the amount of personal information which is reasonably necessary to complete the legitimate business transaction for which it is collected.

• Enter personal information into only software applications provided by or authorized by Elaire Insurance.

• Encrypt any mobile and wireless devices such as smartphones, PDAs & tablets that are used for business purposes and ensure they meet the Minimum Specifications for connectivity to the

agency network.

• Not enter personal information of customers or prospects, except for partial birth dates, into third party agency management systems in conjunction with a Book of Business Download.

• Not share personal information with unauthorized users.

 

Storage of Personal Information

Personal information must be properly managed and retained. This means authorized users must:

• Only retain any paper or electronic data that contain personal information for the minimum time

limit deemed necessary for the business purpose or as required by law.

• Maintain documents, files, and records that contain personal information in a locked and secure manner to avoid access by unauthorized persons. For example, file cabinets must be locked when not in use and computers must be password protected with access given only to authorized users.

• Comply with special records retention exceptions, including but not limited to litigation holds and regulatory requirements.