The Insurance Data Protection Act bars the Federal Insurance Office and other named federal financial regulators from collecting data directly from insurance companies unless that information cannot be obtained in a timely way from other federal or state agencies or public sources and the agency complies with the Paperwork Reduction Act. It also strips certain subpoena and enforcement powers, narrows the Office of Financial Research’s subpoena reach with respect to insurers, and strengthens confidentiality and privilege protections for data obtained from insurers.
This matters because it reorganizes the information flow that federal regulators rely on for market surveillance and systemic risk analysis. The bill shifts primary collection responsibility toward state insurance regulators and creates procedural gates — coordination requirements and PRA compliance — that could slow or restrict federal access to insurer-level data while codifying nonwaiver of legal privileges and FOIA treatment.
At a Glance
What It Does
The bill requires federal financial regulators to check whether insurer data already exists with other federal or state regulators or public sources before seeking it directly, and if the data is not available, allows direct collection only after compliance with the Paperwork Reduction Act. It removes a statutory subpoena/enforcement paragraph for the Federal Insurance Office and amends the Office of Financial Research’s subpoena scope to exclude insurers.
Who It Affects
Directly affected entities include the Federal Insurance Office, the Office of Financial Research, the SEC, CFTC, federal banking agencies, the Financial Stability Oversight Council, state insurance regulators, and nonbank financial companies that are insurance companies. In practice, insurance company compliance officers and in‑house counsel will see the biggest operational changes.
Why It Matters
By rerouting data flows toward states and requiring administrative steps before federal collection, the bill alters how regulators assemble sector‑wide information and could create delays or gaps in real‑time monitoring. It also formalizes privilege and confidentiality protections, changing litigation posture and disclosure expectations for insurer data.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill inserts a new, narrowly drawn regime into the Dodd‑Frank structure focused on data sourced from insurance companies. It defines a “covered entity” as a nonbank financial company that qualifies as an insurance company under the relevant statute and names the roster of “financial regulators” (SEC, CFTC, Council, federal banking agencies, and the Office of Financial Research).
That definitional scaffolding limits where the new rules apply and ties them to existing statutory meanings rather than creating a broad, free‑standing category.
Before any federal regulator may collect data directly from an insurer, the regulator must do two things: coordinate with relevant federal agencies, state insurance regulators, and other federal or state regulatory bodies and check public sources to see whether the information can be obtained there in a timely fashion; and, if the information is not available, follow the Paperwork Reduction Act’s procedures before collecting it from the insurer. Practically, that means regulators must document an availability determination and — where PRA applies — secure clearance, which introduces a formal administrative timeline before surveys, forms, or direct requests may be sent to insurers.On enforcement and coercive tools, the bill strikes paragraph (6) of 31 U.S.C. 313(e) — removing an enumerated subpoena and enforcement authority tied to the Federal Insurance Office — and amends the Office of Financial Research’s subpoena language so that it does not reach insurance companies as defined.
At the same time the bill tightens confidentiality: data shared by insurers will retain any federal or state privilege it had before sharing, written agreements on privacy continue to bind recipients, and information‑sharing agreements between federal regulators and state insurance regulators must be structured so they do not waive those privileges.Finally, the bill addresses public‑access rules: it specifies that Freedom of Information Act (5 U.S.C. 552) treatment, including statutory exceptions, will apply to information submitted by insurers. That mixes a promise of regulated confidentiality with the procedural reality that some requests or judicial claims can force disclosure under FOIA’s standards.
The bill also makes a technical insertion into the Dodd‑Frank table of contents to reflect the new subtitle.
The Five Things You Need to Know
The bill repeals paragraph (6) of 31 U.S.C. 313(e), removing an explicit subpoena/enforcement authority previously available to the Federal Insurance Office.
It amends 31 U.S.C. 313(e)(5) to expand confidentiality language so sharing nonpublic insurer data among federal agencies, state insurance regulators, or other entities does not automatically waive applicable privileges.
The Office of Financial Research’s subpoena authority (12 U.S.C. 5343(f)(1)) is amended to exclude insurance companies as a category the OFR may subpoena.
The bill adds Subtitle D (section 181) to the Financial Stability Act requiring financial regulators to coordinate with federal agencies, state insurance regulators, and public sources and to comply with the Paperwork Reduction Act before collecting data directly from a covered entity.
Any data a regulator receives from insurers must remain subject to prior federal or state privileges and confidentiality agreements, and information‑sharing agreements with state regulators must not waive those privileges; FOIA (5 U.S.C. 552) still governs agency disclosures with its statutory exceptions.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Remove FIO subpoena/enforcement paragraph
Section 2 strikes paragraph (6) from 31 U.S.C. 313(e). That is a targeted repeal: it removes an enumerated subpoena and enforcement authority tied to the Federal Insurance Office rather than rewriting the Office’s entire statutory role. Operationally, the FIO would lose an express statutory tool to compel documents or testimony under that provision; agencies will need to rely on other existing authorities or on state partners to obtain information previously reachable under the struck language.
Preserve privilege and restrict waiver when sharing insurer data
This amendment inserts language that clarifies sharing nonpublic insurer data among federal agencies, state insurance regulators, or other entities does not constitute a waiver of privilege. It also explicitly preserves prior confidentiality agreements and requires that any intergovernmental information‑sharing agreement must comply with federal law and not waive existing privileges. Practically, this limits downstream legal exposure for insurers by formally insulating shared data from being treated as voluntarily forfeiting protections under state or federal law.
Exclude insurance companies from OFR subpoena scope
The bill narrows the Office of Financial Research’s subpoena reach by adding an exclusion in the statutory text: OFR may not issue subpoenas to an insurance company as defined in section 201(a). This is a categorical carve‑out: OFR retains subpoena power over other financial firms but must look elsewhere for insurer data, which removes one federal avenue for compelled insurer disclosures and shifts reliance toward voluntary sharing, state regulators, or PRA‑cleared collection mechanisms.
Advance coordination, PRA gatekeeping, and FOIA/confidentiality rules for insurer data
This is the substantive operational heart of the bill. It defines key terms (covered entity, financial regulator) and imposes a two‑step collection regime: first, regulators must coordinate with relevant federal and state bodies and check public sources to determine whether the needed data can be obtained there in a timely manner; second, if not available, the regulator may collect directly from the insurer only after following the Paperwork Reduction Act. Section 181 also codifies that any data provided retains preexisting privileges, that prior confidentiality agreements continue to apply, and that FOIA (with its exceptions) governs disclosure, while permitting information‑sharing agreements with state regulators that comply with federal law and preserve privilege.
Table of contents update
The bill inserts the new Subtitle D entry into the Dodd‑Frank Act table of contents. This has no substantive effect aside from placing the new Section 181 in the statutory map so that cross‑references and legal research reflect the addition.
This bill is one of many.
Codify tracks hundreds of bills on Finance across all five countries.
Explore Finance in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Insurance companies — The bill reduces the number of federal avenues for direct data collection and preserves statutory and contract privileges, lowering the risk of compelled disclosure to federal regulators and potential waiver of confidential information.
- In‑house counsel and compliance teams at insurers — They gain clearer protection around privilege and confidentiality when sharing data with regulators and can point to statutory nonwaiver language in negotiations about information requests.
- State insurance regulators — The bill elevates their role as primary custodians and providers of insurer data, increasing their centrality in regulatory data flows and potentially expanding their influence over how and when data is provided to federal authorities.
- Privacy and trade‑secret advocates — By limiting direct federal collection and codifying retention of privilege, the bill reduces pathways for sensitive policyholder or proprietary data to enter federal databases.
Who Bears the Cost
- Federal financial regulators (FIO, OFR, FSOC, SEC, CFTC and federal banking agencies) — They lose a direct, statutory route to compel insurer data and must rely on coordination, state cooperation, or time‑consuming PRA clearances, which could delay analysis and enforcement.
- State insurance regulators — States may face increased demand to compile and deliver data to federal regulators without additional funding or standardization, creating fiscal and operational burdens.
- Regulatory programs monitoring systemic risk — Programs that depend on timely, comprehensive insurer data may face gaps or slower feeds, increasing the cost of assembling cross‑sector views and potentially requiring new memoranda of understanding or technical investments.
- Legal and compliance units across government — Agencies will incur additional legal and administrative work to document availability determinations, negotiate information‑sharing agreements, and defend privilege retention decisions.
Key Issues
The Core Tension
The bill balances two legitimate aims that cut in opposite directions: protecting insurer confidentiality and reinforcing state regulatory primacy versus enabling federal regulators to collect timely, comprehensive data necessary for systemic risk monitoring and coordinated enforcement. Tight confidentiality and procedural gates reduce exposure for insurers but can impede the federal government’s ability to see, aggregate, and act on insurance sector risks quickly.
The bill resolves one problem — insurer confidentiality and state primacy — by pushing data collection responsibilities outward and upward: to state regulators, other federal agencies, or public sources, and by adding the PRA gate when direct federal collection is sought. That approach creates friction.
Reliance on other agencies presumes those actors have the data, can share it in usable form, and can do so quickly. The statutory phrase “in a timely manner” is operationally critical but undefined, leaving sequencing and burden disputes likely.
PRA compliance introduces predictable delays and extra procedural steps; in time‑sensitive situations (market stress or emerging systemic events) those delays could matter.
The bill’s preservation of privilege and continuation of confidentiality agreements reduces legal exposure for insurers but raises oversight questions. If regulators cannot compel insurer records, identifying, investigating, and mitigating cross‑firm contagion may become harder.
Information‑sharing agreements that preserve privilege protect insurers but also limit what federal agencies can disclose publicly or use in enforcement actions. The interaction with FOIA is another wrinkle: the bill subjects submitted data to FOIA with statutory exceptions, but litigation over what qualifies as exempt commercial or privileged information is likely.
Finally, the burden shifts to state regulators, which vary widely in staffing, IT systems, data standards, and willingness to share, creating potential for uneven coverage and regulatory arbitrage.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.