Monthly LRA Update: March 2021

LEGISLATIVE DEVELOPMENTS

COVID Relief Legislation – American Rescue Plan (HR 1319)

On February 27, the House voted to pass the American Rescue Plan Act of 2021 (HR 1319), which is the Biden administration’s $1.9 trillion stimulus package.

The legislation does not appear to include any provisions that will impact employer-owned life insurance or tax laws applicable to such programs. However, Subtitle H (Pensions) may be of interest to some readers. Pension-related provisions include

• Institution of temporary delay of designation of multi-employer plans as endangered, critical or critical and declining (Section 9701);
• Five year extension of funding and rehabilitation periods for multi-employer plans in critical and endangered status (Section 9702);
• Extended amortization for single employer plans (to 15 years from 7 years) (Section 9705);
• Extension of pension funding stabilization percentages for single employer plans (Section 9706); and
• A freeze on the cost of living adjustment starting in 2030 (Section 9708).

The Senate is expected to pass the stimulus bill through Budget Reconciliation. The House legislation included a section that would raise the Federal minimum wage. On February 25, the Senate parliamentarian ruled that an increase to the minimum wage could not be included in a budget reconciliation process.

Florida Consumer Privacy Bill (HB 969)

On February 15, House Bill 969 was filed in the Florida House. The bill is reported to be similar in scope to California’s Consumer Privacy Act. If enacted, the law is slated to take effect January 1, 2022 and would fall under the oversight of the Attorney General’s office. It has been reported that the legislation has the support of the Governor’s office.

Noteworthy provisions of HB 969:

• Businesses must maintain a privacy policy that includes a list of the categories of personal information the business collects or has collected about consumers;
• Consumers have the right to request disclosure of the categories and specific pieces of personal information that a business collects from or about consumers;
• A business that collects personal information must inform consumers of the categories of personal information that will be collected and the purposes for which the categories will be used;
• A business must provide and follow a retention schedule that prohibits the use and retention of personal information after satisfaction of the initial purpose for collecting such information; and
• Consumers have the right to request that a business delete the consumer’s personal information (exceptions apply).

The legislation also sets forth requirements that must be incorporated into any contract between a business and a service provider, including provisions that prohibit the service provider from selling or sharing the personal information or disclosing it for any purpose other than the business purposes specified in the contract.

The bill includes exceptions similar to the CCPA. Of note, the law does not apply to personal information collected, processed, sold or disclosed pursuant to the Gramm-Leach-Bliley Act.

Similar to California, a “consumer” under this legislation is broadly defined to be largely any natural person who resides in the state.

Virginia Consumer Data Protection Act (SB 1392)

On February 26, the Virginia legislature sent its Consumer Data Protection Act (“CDPA”) (SB 1392) to the Governor. The bill is expected to be enacted.

The CDPA uses a slightly narrower definition of “consumer” than Florida and California. Under the CDPA, a consumer is a natural person who is a resident of the Commonwealth acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.

Consumer rights under the CDPA include

• Confirming whether or not a business is processing the consumer’s personal data and the right to access such personal data;
• Correcting inaccuracies in the data; and
• Requesting deletion of the consumer’s personal data.

This law also sets forth a number of responsibilities for businesses that depend on whether they are a “controller” or a “processor” of personal data. The responsibilities include data security-related considerations.

Additionally, the CDPA appears to expressly not apply to financial institutions or data subject to Title V of the federal Gramm-Leach-Bliley Act (see § 59.1-572(B)(ii)).

Various other states are currently considering privacy legislation. We will continue to monitor this area.

REGULATORY DEVELOPMENTS

OCC Finalizes Rule Clarifying Role of Supervisory Guidance

On February 16, the OCC released a final rule that is substantively the same as a previously proposed rule published in November 2020. This rule reaffirms that supervisory guidance, unlike statutes and regulations, does not have the force and effect of law.

However, the OCC notes that supervisory guidance can outline the OCC’s supervisory expectations or priorities and articulate the OCC’s general views regarding appropriate practices for a given subject area.

Banking Regulators Finalize NSFR Rule

On February 24, the OCC, FRB and FDIC published a final rule that implements the net stable funding ratio (NSFR). The NSFR measures the stability of a covered company’s funding profile over a one-year time horizon and complements the liquidity coverage ratio (LCR).

The final rule will be effective on July 1, 2021. We do not expect this rule to have any direct impact on BOLI/COLI programs.