Model law for Insurance Data Security is here. Like a Valentine + Birthday Wish Wrapped in a Rainbow.

What entity is proposing model data security laws for insurance?  the Cybersecurity Task Force (Task Force) of the National Association of Insurance Commissioners (NAIC)

Is it final? No, its a revised draft after taking into account stakeholder positions

What issues are covered in the model act draft?

  • Require licensees to create a “comprehensive written information security program”
  • Required Data Security programs will detail the:
    • administrative,
    • technical, &
    • physical safeguards for the protection of personal information
  • Require licensees to contract only with 3rd service providers who are “capable of maintaining appropriate safeguards for personal information.”
  • Creates standards for investigations of a data breach, including:
    •  When a data breach occurs
    • That  the licensee must properly investigate the breach
    • Assessing the nature and scope of the breach
    • Identifying the personal information that may have been involved
    • Determining if the personal information had been acquired without authorization
    • Taking reasonable measures to restore the security of the systems compromised in the breach.

To comment: Email Sara Robben at srobben@naic.org by close of business on Friday, September 16, 2016.

Lexology | Mayer Brown | NAIC Issues Revised Insurance Data Security Model Law

Business Trend. Banks Fight Cyber Crime. 3 Keys to Informed Intel.

Which banks are invloved? The 8 largest banks are joining forces. This includes Bank of America, JP Morgan, and Goldman Sachs.

What will the 8 banks do to protect against cuber crime? Share intel and conduct war games to improve data security.

Why did they form? The large banks issues are similar unlike the data security efforts among all financial institutions and the large banks share information with the federal governmet but believe they get little information in return.

Wall Street Journal | Big Banks Team Up to Fight Cyber Crime

Data Regulation of Marijuana. 3 Key Pieces Informed Intel.

Which state included data regulation of marijuana? Colorado

What is the goal of data regulation of marijuana legalization? safely and securely control the flow of the drug across the state

What state agency houses this data center? Marijuana Enforcement Division (MED) in the state’s Department of Revenue

Governing | Managing Marijuana: the Role of Data-Driven Regulation

2017. Southern State Pushing Forward on Student Data Protection.

The state: Alabama

The legislation: A State agency to track student data from early education through entering the workforce

What‘s the background? In 2015, the Governor issued an executive order to create a  longitudinal data system to track studnt data. This executive order requires legislation to fund it.

The projected cost to track student data? $1.6 million

What did the Governor’s Executive Order do?

  • Created an advisory board
  • “Developed a state talent pipeline capable of ensuring that all Alabama students graduate from school being college and career ready, improving decision-making on educational programs, making decisions based upon validated and objective measures of student outcomes, and permitting qualified researchers to collaboratively evaluate the success of state programs.”

Times Daily | Collins will bring back student data bill

2017. The Feds Have Weakened Student Data Privacy. Here's what groups want the states to do:

The Electronic Privacy Information Center (EPIC.org) wants states to pass bills that:

  • No Targeted Ads. prohibit K-12 mobile and online service operators from using student information to target advertisements to students;
  • No Profiling Students. prohibit online service providers from creating K-12 student profiles for commercial purposes; 
  • No Selling Info. forbid companies from selling student information;
  • All Students (K-16) extend protection to all students, including college and post-graduate students;
  •  Enforcement. strong enforcement mechanisms, including a private right of action against private companies that abuse student data;
  •  Limit Data Collection. limiting the type of data that companies and schools collect (e.g., Social Security numbers, biometric information, social media information);
  • Transparency. publishing the types of information companies and schools collect, the purposes for which the information will be used, and the security practices in place;
  •  Data Retention Policies. data retention limitations that require companies to delete student data after the data is no longer needed;
  • Student and Parental Control over Info. permitting students to delete & correct certain student information;
  • Notification. data breach notification; and
  • Schools Can’t Disclose Students. prohibiting schools from disclosing “directory information,” including student name and home address.

EPIC.org | State Student Privacy Policy

EPIC.org | EPIC Urges Wisconsin Legislature to Safeguard Student Privacy

TREND. Data Security. Political Campaigns. 3 Points Informed Intel about Campaign Internal Controls.

The Democratic National Committee this week announced a new cybersecurity advisory board. 

The intel to keep you informed about the future of campaigns and data security:

  • Created by new DNC Chair Donna Brazille
  • Composed of security experts, including:
    • National Security. Rand Beers, former Department of Homeland Security acting secretary
    • Lawyer. Nicole Wong, former deputy chief technology officer of the U.S. and a former technology lawyer for Google and Twitter
    • Tech Expert. Aneesh Copra, co-founder of Hunch Analytics and former chief technology officer of the U.S.
    • Lawyer. Michael Sussmann, a partner in privacy and data security at the law firm Perkins Coie and a former Justice Department cybercrime prosecutor.
  • The DNC is active in providing notification in those impacted by data breaches.

Politico | DNC creates cybersecurity advisory board following hack

The Hill | DNC creates cybersecurity board

3 Reasons Hackers Target Health Care Data.

What type of healthcare data? Medical records and wearable data from heart monitors to implanted devices to fitbits

What is crucial about protecting health care data? It must be protected as the information moves from device to cloud storage to medical records end point at a physician or hospital

What makes health records more valuable? 

  • Unlike financial information, health data or changes to social security numbers are not quickly identifiable
  • The release of health records includes social stigma that isn’t tied to financial records.
  • Health records are personal and private, therefore the release is stigmatizing. 

Data Informed | Why Hackers Attack Healthcare Data, and How to Protect It

INTERIM. TREND. Data Security. Businesses. 3 Regulatory Points from a Texas White Hat Hacker.

Why are businesses not securing all online information? Its profitable to not secure the data. The penalties for not securing data are not impactful.

What legislation or regulatory reform is crucial? Not government specifics on security but rather strong enforcement and meaningful fines from regulatory enforcement.

What’s the future in hacking? Its not buying and selling information, but rather modification of the data that is out there already.

Business insider | A security expert who in his spare time discovers data breaches affecting millions explains why he does it