Are you a Person?
Many of the insurance statutes and regulations in New York use the word “person” to mean a human being. You know, like the person writing this blog. Or the person reading this blog. That kind of person.
If an insurance law is regarding a license, for instance, it spells out that the license must be obtained by a “person, firm, association or corporation.” If the topic is life insurance, the phrase “the person whose life is insured” often pops up, clearly without the implication that a corporation has a “life” that can be insured.
But New York’s much hailed cybersecurity regulation defines Person to mean not just human beings, but any non-governmental entity, such as a corporation or an association. While this is not a unique definition in the financial services industry, I found it unsettling. It leads to a definition of Affiliate in the regulation that starts out with the phrase “any Person that controls, is controlled by or is under common control with another Person.” So does Affiliate include my 14-year-old, who claims he is controlled by me, his junior high science teacher, and his soccer coach?
The definition also gives rise to the phrase, “the ownership of stock of such Person.” I presume this regulation is not trying to revive the loathsome concept of one human owning another.
The use of the defined term Person apparently doesn’t serve particularly well the authors of the regulation, as it’s used in the opening Definitions section, and then again in the closing Exemptions and Severability sections. But nowhere else. When people are referred to in the regulation’s body, the words “individual,” “employee,” or “personnel” are used, as appropriate. These words are clear, despite not being defined.
Mainly the defined term Covered Entity is used throughout the regulation. Covered Entity includes a Person who is a human, a Person who (which?) is a corporation, a Person who (which?) is an association, etc.
While I am a big believer in defining words, whether in contracts or in laws and regs, I want the definition to help clarify, not add to the confusion. I find it slightly confusing, and more than a little distressing, to have to think of an insurance company, a bank, or a brokerage firm as a Person. I am completely comfortable with thinking about them as Covered Entities, however. But now we’re into plurals, which makes them, I believe, into Covered People. But even cybersecurity doesn’t go that far, so neither will I.
