What entity is proposing model data security laws for insurance? the Cybersecurity Task Force (Task Force) of the National Association of Insurance Commissioners (NAIC)
Is it final? No, its a revised draft after taking into account stakeholder positions
What issues are covered in the model act draft?
- Require licensees to create a “comprehensive written information security program”
- Required Data Security programs will detail the:
- administrative,
- technical, &
- physical safeguards for the protection of personal information
- Require licensees to contract only with 3rd service providers who are “capable of maintaining appropriate safeguards for personal information.”
- Creates standards for investigations of a data breach, including:
- When a data breach occurs
- That the licensee must properly investigate the breach
- Assessing the nature and scope of the breach
- Identifying the personal information that may have been involved
- Determining if the personal information had been acquired without authorization
- Taking reasonable measures to restore the security of the systems compromised in the breach.
To comment: Email Sara Robben at srobben@naic.org by close of business on Friday, September 16, 2016.
Lexology | Mayer Brown | NAIC Issues Revised Insurance Data Security Model Law