Relating to standards for data security, and investigations and notifications of cybersecurity events, for certain licensees under the jurisdiction of the commissioner of insurance, making penalties applicable, and including effective date provisions

This bill relates to the exclusive state standards for data security, and investigations and notifications of cybersecurity events, for certain licensees under the jurisdiction of the commissioner of insurance. The bill is based on the national association of insurance commissioners’ (NAIC) insurance data security model law. “Licensee” is defined in the bill as a person licensed, authorized to operate, or registered, or required to be licensed, authorized to operate, or registered pursuant to the insurance laws of this state. “Licensee” does not include a purchasing group or a risk retention group chartered and licensed in a state other than this state, or a person acting as an assuming insurer that is domiciled in another state or jurisdiction. The bill does not create or imply a private cause of action for a violation of its provisions, and does not curtail a private cause of action that would otherwise exist in the absence of the bill. The bill requires licensees to develop, implement, and maintain a comprehensive written information security program (program) based on the licensee’s risk assessment (assessment) conducted pursuant to the bill. Licensees must comply with the program requirements no later than January 1, 2023. The program must safeguard the licensee’s nonpublic information and information system. “Information system” is defined in the bill as a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic nonpublic information, and any specialized system such as an industrial or process controls system, a telephone switching and private branch exchange system, or an environmental control system. “Nonpublic information” is also defined in the bill. Certain licensees and other persons are exempt from the program requirement as detailed in the bill. The bill requires a licensee’s program to protect the security and confidentiality of nonpublic information and the security of the information system, to protect against threats or hazards to the security or integrity of nonpublic information and the information system, to protect against unauthorized access to or the use of nonpublic information, to minimize the likelihood of harm to consumers, and to define and periodically reevaluate a schedule for the retention and destruction of nonpublic information. A licensee’s assessment must designate one or more employees, an affiliate, or an outside vendor to act on behalf of the licensee and to have responsibility for the program; identify reasonably foreseeable internal or external threats that may result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including nonpublic information that is accessible to, or held by, a third-party service provider; assess the probability of and the potential damage caused by identified threats; and assess the sufficiency of policies, procedures, information systems, and other safeguards in place to manage identified threats. The assessment must include consideration of threats identified in each relevant area of the licensee’s operations. Based on a licensee’s assessment, the bill requires the licensee to design the program to mitigate identified risks, to determine and implement appropriate security measures, to include cybersecurity risks in the licensee’s enterprise-wide risk management process, to maintain knowledge and understanding of emerging threats or vulnerabilities, to utilize reasonable security measures when sharing information, and to provide the licensee’s personnel with cybersecurity awareness training. If a licensee has a board of directors, the bill directs the board to require the licensee’s executive management or its delegates to develop, implement, and maintain the licensee’s program, and to provide an annual report to the board that documents the information specified in the bill. If a licensee’s executive management delegates any of its responsibilities, it must oversee the delegate’s development, implementation, and maintenance of the licensee’s program. As part of a licensee’s program, the bill requires the licensee to establish a written incident response plan (plan) designed to respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in the licensee’s possession or information systems; or that compromises the continuing functionality of the licensee’s operations. The plan must address all criteria specified in the bill. “Cybersecurity event” is defined in the bill as an event resulting in unauthorized access to, or the disruption or misuse of, an information system or of nonpublic information stored on an information system. “Cybersecurity event” does not include the unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization; or an event for which a licensee has determined that the nonpublic information accessed by an unauthorized person has not been used or released, and the nonpublic information has been returned or destroyed. Insurers domiciled in this state must submit an annual certification to the commissioner that the insurer is in compliance with the plan requirements. The bill requires a licensee to exercise due diligence in the selection of a third-party service provider (provider), to conduct oversight of all provider arrangements, and to require all providers to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider. Licensees must comply with these requirements no later than January 1, 2024. “Third-party service provider” is defined in the bill as a person that is not a licensee that contracts with a licensee to maintain, process, store, or is otherwise permitted access to nonpublic information through the person’s provision of services to the licensee. If a licensee discovers that a cybersecurity event has occurred, or that a cybersecurity event may have occurred, the licensee, or the outside vendor or provider the licensee has designated to act on behalf of the licensee, must conduct a prompt investigation of the event as detailed in the bill. If a licensee learns that a cybersecurity event has occurred, or may have occurred, in an information system maintained by a provider of the licensee, the licensee must complete the same type of investigation, or confirm and document that the provider has completed such an investigation. A licensee must maintain all records and documentation related to the licensee’s investigation for a minimum of five years from the date of the cybersecurity event. A licensee is required to notify the commissioner no later than three business days from the date of the licensee’s confirmation of a cybersecurity event if the licensee is an insurer who is domiciled in this state, or is a producer whose home state is this state, and the laws of this state or federal law requires notice to a government body, self-regulatory agency, or other supervisory body. A licensee must also notify the commissioner if the cybersecurity event has a reasonable likelihood of causing material harm to a consumer, or to a material part of the normal business, operations, or security of the licensee; or the licensee reasonably believes that nonpublic information compromised by the cybersecurity event involves 250 or more consumers and state or federal law requires notice to a government body, self-regulatory agency, or other supervisory body. The licensee must provide the commissioner with the information specified in the bill and has a continuing obligation to update and supplement the information as material changes to the information occur. In the event of a cybersecurity event involving nonpublic information, the licensee must notify consumers as detailed in the bill. The bill also details the requirements for cybersecurity event notifications related to providers, reinsurers, and producers of record. The bill details confidentiality and privilege as applied to documents, materials, or other information furnished by a licensee, or that are obtained by the commissioner pursuant to an investigation or examination, and that are in the control or possession of the commissioner. The bill details which documents, materials, or other information do not constitute a public record under Code chapter 22; are not subject to subpoena and discovery; and are not admissible in a private civil action. The bill also describes how the documents, materials, and other information may be shared or used by the commissioner. The bill does not apply to a licensee that is subject to, and in compliance with, the Health Insurance Portability and Accountability Act of 1996 (HIPAA); or to a licensee that is owned or controlled by a federally insured depository institution that is subject to, and in compliance with, the Gramm-Leach-Bliley Act (GLBA) or comparable federal law and corresponding regulations. The licensee must submit an annual written certification to the commissioner of the licensee’s compliance with HIPAA or GLBA.7A and Code chapter 507B. The commissioner may adopt rules to administer the bill and may take any enforcement action under the commissioner’s authority to enforce compliance with the bill. If any provision of the bill, or its application to any person or circumstance is held invalid, the invalidity does not affect other provisions or applications of the bill which can be given effect without the invalid provision or application. The bill takes effect January 1, 2022.