SB 2831 — Insurance Data Security Law; create.

SB2831 (As SentPassed tothe Governor)Senate) - 2019 Regular Session MISSISSIPPI LEGISLATURE Regular Session To:

Senator(s) Carmichael Senate Bill 2831 (As SentPassed tothe Governor)Senate) AN ACT TO ESTABLISH THE INSURANCE DATA SECURITY LAW;

          (i)  "Licensee" means any person licensed, authorized to operate, or registered, or required to be licensed, authorizedauthorized, or registered pursuant to the insurance laws of this state,state but shall not include a purchasing group or a risk-retention group chartered and licensed in a state other than this state or a person whothat is acting as an assuming insurer that is domiciled in another state or jurisdiction.

          (p)  "Third-party service provider" means a person, not otherwise defined as a licensee, whothat contracts with a licensee to maintain, process, store or otherwise is permitted access to nonpublic information through its provision of services to the licensee.

                            (vi)  Modify the information system in accordance with the licensee's information security program;

              (viii) (viii) Regularly Regularly test and monitor systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems;

and               (ii)  Material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, third-party service provider arrangements, results of testing, cybersecurity events or violations and management's responses thereto, and recommendations for changes in the information security program;program.

and               (vii)  The evaluation and revision as necessarynecessary  ofof  thethe  incident response plan following a cybersecurity event.

     (9)  Annually, each insurer domiciled in this state shall submit to the commissionercommissioner, a written statement by February 15, certifying that the insurer is in compliance with the requirements  set forth in this section.  Each insurer shall maintain for examination by the department all records, schedules and data supporting this certificate for a period of five (5) years.  To the extent an insurer has identified areas, systems or processes that require material improvement, updating or redesign, the insurer shall document the identification and the remedial efforts planned and underway to address such areas, systems or processes.

     SECTION 5.  (1)  If the licensee learns that a cybersecurity event has or may have occurred, then the licensee, or an outside vendor and/or service provider designated to act on behalf of the licensee,licensee shall conduct a prompt investigation.

          (f)  Whether the licensee has filed a police report or has notified any regulatory, government or law enforcement agencies and, if so, when such notification was provided;

     (5)  (a)  (i)  In the case of a cybersecurity event involving nonpublic information that is used by the licensee whothat is acting as an assuming insurer or in the possession, custody or control of a licensee whothat is acting as an assuming insurer and that does not have a direct contractual relationship with the affected consumers, the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days of making the determination that a cybersecurity event has occurred.

          (b)  (i)  In the case of a cybersecurity event involving nonpublic information that is in the possession, custody or control of a third-party service provider of a licensee whothat is an assuming insurer, the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days of receiving notice from its third-partythird- party service provider that a cybersecurity event has occurred.

     (6)  In the case of a cybersecurity event involving nonpublic information that is in the possession, custody or control of a licensee whothat is an insurer or its third-party service provider for which a consumer accessed the insurer's services through an independent insurance producer, and for which consumer notice is required under Section 75-24-29, the insurer shall notify the producers of record of all affected consumers of the cybersecurity event no later than the time at which notice is provided to the affected consumers.  The insurer is excused from this obligation for any producers who are not authorized by law or contract to sell, solicit or negotiate on behalf of the insurer, and in for those instances in which the insurer does not have the current producer of record information for any individual consumer.

     SECTION 7.  (1) (1) The commissioner shall have power to examine and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this act.  This power is in addition to the powers which the commissioner has under Section 83-5-201 et seq.  Any such investigation or examination shall be conducted pursuant to Section 83-5-201 et seq.

and           (c)  May share documents, materials or other information subject to subsection (1) of this sectionsection, with a third-party consultant or vendor provided the consultant agrees in writing to maintain the confidentiality and privileged status of the document, material or other information;information.

and           (d)  May enter into agreements governing sharing and use of information consistent with this subsection (3).

or               (iii)  Less than Ten Million Dollars ($10,000,000.00) in year-end total assets;assets.

or               (iv)  Insurance producers and adjusters.

1936, enacted August 21, 1996,1996 (Health Insurance Portability and Accountability Act) that has established and maintains an information security program pursuant to such statutes, rules, regulations, procedures or guidelines established thereunder, will be considered to meet the requirements of Section 4 of this act, provided that the licensee is compliant with, and submits a written statement certifying its compliance with, the same.same;

          (d)  A licensee affiliated with a depository institution that maintains an information security program in compliance with the Interagency Guidelines Establishing Standards for Safeguarding Customer Information as set forth pursuant to Sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C.

6801 and 6805) shall be considered to meet the requirements of Section 4 of this act, provided that the licensee produces, upon request, documentation satisfactory to the commissioner that independently validates the affiliated depository institution's adoption of an information security program that satisfies the Interagency Guidelines.

     SECTION 10.  In the case of a violation of this act, a licensee may be penalized in accordance with Section 83-5-85.