(a) (1) ORSA-related information, including the ORSA Summary Report, in the possession or control of the Commissioner that is obtained by, created by, or disclosed to the Commissioner or any other person under this title:

(i) is confidential and privileged;

(ii) is not subject to Title 4 of the General Provisions Article;

(iii) is not subject to subpoena; and

(iv) is not subject to discovery or admissible as evidence in any civil action.

(2) Except as provided in subsections (b) and (d) of this section, the Commissioner may not otherwise make ORSA-related information public without prior written consent of the carrier to which it pertains.

(b) The Commissioner may use ORSA-related information in the furtherance of any regulatory or legal action brought as part of the duties of the Commissioner.

(c) The Commissioner, and any person who receives ORSA-related information, through examination or otherwise, while acting under the authority of the Commissioner or with whom ORSA-related information is shared under this title, may not be allowed or required to testify in any private civil action concerning any ORSA-related information that is subject to subsection (a) of this section.

(d) In order to assist in the performance of the Commissioner’s regulatory duties, the Commissioner:

(1) may, on request, share ORSA-related information, including confidential and privileged ORSA-related information that is subject to subsection (a) of this section, with:

(i) other state, federal, and international financial regulatory agencies, including members of any supervisory college;

(ii) the NAIC; and

(iii) any third-party consultants the Commissioner designates.

(2) The Commissioner may share ORSA-related information under paragraph (1) of this subsection if the recipient:

(i) agrees in writing to maintain the confidentiality and privileged status of the ORSA-related information; and

(ii) verifies in writing that it has the legal authority to maintain the confidentiality of the ORSA-related information.

(e) (1) The Commissioner may receive ORSA-related information from:

(i) other state, federal, and international financial regulatory agencies, including members of any supervisory college; and

(ii) the NAIC.

(2) The Commissioner shall maintain as confidential and privileged any ORSA-related information received under paragraph (1) of this subsection that the Commissioner receives with notice or the understanding that it is confidential or privileged under the laws of the jurisdiction that is the source of the ORSA-related information.

(f) (1) The Commissioner shall enter into a written agreement with the NAIC or a third-party consultant governing the sharing and use of information provided under this title, consistent with this section.

(2) The agreement required under paragraph (1) of this subsection shall:

(i) specify procedures and protocols regarding the confidentiality and security of ORSA-related information shared with the NAIC or a third-party consultant under this title, including procedures and protocols for sharing by the NAIC with other state regulators from states in which the insurance group has domiciled carriers;

(ii) specify that the recipient agrees in writing to maintain the confidentiality and privileged status of the ORSA-related information and has verified in writing the legal authority to maintain the confidentiality;

(iii) specify that ownership of the ORSA-related information shared under this title remains with the Commissioner and that the use of the ORSA-related information by the NAIC or a third-party consultant is subject to the direction of the Commissioner;

(iv) prohibit the NAIC or a third-party consultant from storing the ORSA-related information shared under this title in a permanent database after the underlying analysis is completed;

(v) require prompt notice to be given to a carrier whose confidential ORSA-related information in the possession of the NAIC or a third-party consultant under this title is subject to a request or subpoena for disclosure or production;

(vi) require the NAIC or a third-party consultant to consent to intervention by a carrier in any judicial or administrative action in which the NAIC or a third-party consultant may be required to disclose confidential ORSA-related information about the carrier shared with the NAIC or a third-party consultant under this title; and

(vii) in the case of an agreement involving a third-party consultant, provide:

1. that the third-party consultant shall be under the direction and control of the Commissioner and act in a purely advisory capacity;

2. that the third-party consultant is subject to the same confidentiality standards and requirements as the Commissioner;

3. that the third-party consultant shall verify to the Commissioner, with notice to the carrier, that the third-party consultant:

A. is free of any conflict of interest;

B. has internal procedures in place to ensure that it remains free of any conflict of interest; and

C. will comply with the confidentiality standards and requirements of this article;

4. that, before using a carrier’s ORSA-related information in a manner inconsistent with the agreement with the Commissioner or sharing the carrier’s ORSA-related information with a person other than the Commissioner, the third-party consultant shall obtain written consent of the carrier; and

5. for written notification to the carrier.

(g) (1) The sharing of ORSA-related information and documents by the Commissioner under this title may not constitute a delegation of regulatory authority or rulemaking.

(2) The Commissioner is solely responsible for the administration, execution, and enforcement of this title.

(h) A waiver of any applicable privilege or claim of confidentiality in ORSA-related information may not occur as a result of disclosure of the ORSA-related information to the Commissioner under this section or as a result of sharing the ORSA-related information as authorized under this title.

(i) ORSA-related information in the possession or control of the NAIC or a third-party consultant under this title:

(1) is confidential and privileged;

(2) is not subject to Title 4 of the General Provisions Article;

(3) is not subject to subpoena; and

(4) is not subject to discovery or admissible in evidence in any civil action.