Last week, the Cybersecurity Task Force of the National Association of Insurance Commissioners voted to subject the new "Insurance Data Security Model Law" for public comment during the brief period between now and Wednesday, March 23. The NAIC has also announced that the new model law will be discussed at the Cybersecurity Task Force's meeting during the NAIC's spring meeting in New Orleans, currently scheduled for 2:30 p.m. on Monday, April 4.
The new model act builds on four of the NAIC's previously released works, and then goes further to implement specific practices and penalties. First, the new model law incorporates elements of two prior model laws – the Insurance Information and Privacy Protection Model Act (the Privacy Protection Model Act), currently adopted in approximately one-third of the states, and the Privacy of Consumer Financial and Health Information Regulation, currently adopted in more than two-thirds of the states – both of which are currently under review for amendment. The new model law also builds on the NAIC's previously announced Principles for Effective Cybersecurity: Insurance Regulatory Guidance and the NAIC Roadmap for Cybersecurity Consumer Protections (fka the Cybersecurity Bill of Rights). The new model law is not circumscribed by these prior pronouncements; rather, it addresses specific practices and has a wider scope than earlier models.
Types of information: The scope of the new model law reaches many types of personal information, including "information that the consumer provides...to obtain an insurance product," "information about the consumer resulting from a transaction involving an insurance product or service," or information obtained "in connection with providing an insurance product or service" but all within products or services "used primarily for personal, family or household purposes."
Parties regulated: The new model law specifically applies to licensed insurers and producers, but it also talks about persons "required to be authorized or registered," perhaps signaling an intent to regulate more than just admitted primary insurers. The model law, however, does not stop there. It also requires licensees to contractually mandate that third-party service providers maintain safeguards, notify of breaches and indemnify the licensees against losses due to the breach. Finally, the model law invokes the McCarran-Ferguson Act to pre-empt enforcement of "federal law or regulation regarding data security or investigation or notification of a breach of data security" in regard to licensees. It remains to be seen whether this pre-emption could reach noninsurance members of an insurance holding company system.
What is required of the licensee:
Examination, hearing and penalties: The new model law also provides for examination and investigation of a licensee along with the regulator's power to hold hearings in the event of a violation. Any adversely affected person must be allowed to intervene upon showing good cause. If a violation is found, the commissioner will provide written findings and serve a cease and desist order on the licensee. If no violation is found, the report must be served on those whose rights were allegedly violated. The model law provides for suggested penalties of up to $500 per violation, up to a maximum of $10,000, plus $10,000 per violation of a cease and desist order, up to a maximum of $50,000. The model law provides for judicial review by a court.
Individual remedies: The new model law borrows some individual remedy provisions from the Privacy Protection Model Act, allowing consumers to bring private actions seeking equitable relief for violations of consumer rights. The new model law also permits consumers to recover costs and attorney fees if they should prevail. The new model law does not contain the Privacy Protection Model Act's prohibition on monetary awards exceeding actual damages but does say that there will be no remedy or recovery except as specifically provided.
Confidentiality: Information provided pursuant to the model law is to be protected from FOIA-type disclosure and subpoena of regulators receiving information; however, it is not entirely clear whether such protection would extend to all disclosures required under the model law.
This new model law provides for extensive regulation of insurers and producers, reinforced by examinations and penalties. The new model law is specifically oriented toward mandating security procedures and imposing penalties for breaches and resulting disclosures, whereas the Privacy Protection Model Act has been oriented toward identifying permitted disclosures, and the Privacy of Consumer Financial and Health Information Regulation is oriented toward privacy policies and violations of those policies. Neither of the prior models imposes substantial obligations in regard to the conduct of third parties as the new model law does. The two prior cybersecurity pronouncements of the NAIC, the Roadmap and the Principles, lack the high level of specificity found in the new model law. Given the bold statement about pre-emption of federal law, insurers and producers who believe this new model law would have an unwarranted adverse effect on them are encouraged to comment on or before March 23.
On January 12, in its Stamford office, Day Pitney held a 2-part, complimentary CLE program on cybersecurity issues facing the insurance industry.
Day Pitney Alert
On November 17 – 18, Michael Mullins will speak at the ARIAS U.S. Fall Conference and Annual Meeting at the New York Marriott Marquis.
Dan FitzMaurice authored an article, "Cyber Security and Data Security: What are the risks for insurance and reinsurance arbitrations," for ARIAS•U.S. Quarterly-Q3 2016.
Jonathan Handler and David Lieberman wrote an article, "Citizenship of LLCs and Subject Matter Jurisdiction in the Federal Courts: A Serious Concern Begging for Resolution," for Bloomberg BNA's Securities Regulation & Law Report. The article is about how many practitioners fail to understand a key legal distinction between LLCs and corporations as it relates to their state of citizenship.
On January 5, Day Pitney hosted a speech by Robert L. Capers, the U.S. Attorney for the Eastern District of New York, to the White Collar Crime Committee of the American Bar Association's Business Law Section (WCCC) at the firm's New York City office.
Eric Fader was quoted in an article, "Unknown Future of ACA Puts Blues Plans In an Uncomfortable Spot Heading Into '17," published in The AIS Report on Blue Cross and Blue Shield Plans.
Bill Goddard was quoted in an article, "4 Key Battles To Watch Over NAIC's Cyber Model Law," in Law360. The article is about the National Association of Insurance Commissioners draft of a model law outlining how insurers must safeguard consumers' information and respond in the event of a data breach.
John McLafferty was quoted in an article,"New pay equity law offers fertile ground for litigation," in Massachusetts Lawyers Weekly.
Bill Goddard and Susan Huntington were mentioned in an article, "Fewer exchange options could increase health premiums," in The Hartford Business Journal.