Last week, the Cybersecurity Task Force of the National Association of Insurance Commissioners voted to subject the new "Insurance Data Security Model Law" for public comment during the brief period between now and Wednesday, March 23. The NAIC has also announced that the new model law will be discussed at the Cybersecurity Task Force's meeting during the NAIC's spring meeting in New Orleans, currently scheduled for 2:30 p.m. on Monday, April 4.
The new model act builds on four of the NAIC's previously released works, and then goes further to implement specific practices and penalties. First, the new model law incorporates elements of two prior model laws – the Insurance Information and Privacy Protection Model Act (the Privacy Protection Model Act), currently adopted in approximately one-third of the states, and the Privacy of Consumer Financial and Health Information Regulation, currently adopted in more than two-thirds of the states – both of which are currently under review for amendment. The new model law also builds on the NAIC's previously announced Principles for Effective Cybersecurity: Insurance Regulatory Guidance and the NAIC Roadmap for Cybersecurity Consumer Protections (fka the Cybersecurity Bill of Rights). The new model law is not circumscribed by these prior pronouncements; rather, it addresses specific practices and has a wider scope than earlier models.
Types of information: The scope of the new model law reaches many types of personal information, including "information that the consumer provides...to obtain an insurance product," "information about the consumer resulting from a transaction involving an insurance product or service," or information obtained "in connection with providing an insurance product or service" but all within products or services "used primarily for personal, family or household purposes."
Parties regulated: The new model law specifically applies to licensed insurers and producers, but it also talks about persons "required to be authorized or registered," perhaps signaling an intent to regulate more than just admitted primary insurers. The model law, however, does not stop there. It also requires licensees to contractually mandate that third-party service providers maintain safeguards, notify of breaches and indemnify the licensees against losses due to the breach. Finally, the model law invokes the McCarran-Ferguson Act to pre-empt enforcement of "federal law or regulation regarding data security or investigation or notification of a breach of data security" in regard to licensees. It remains to be seen whether this pre-emption could reach noninsurance members of an insurance holding company system.
What is required of the licensee:
Examination, hearing and penalties: The new model law also provides for examination and investigation of a licensee along with the regulator's power to hold hearings in the event of a violation. Any adversely affected person must be allowed to intervene upon showing good cause. If a violation is found, the commissioner will provide written findings and serve a cease and desist order on the licensee. If no violation is found, the report must be served on those whose rights were allegedly violated. The model law provides for suggested penalties of up to $500 per violation, up to a maximum of $10,000, plus $10,000 per violation of a cease and desist order, up to a maximum of $50,000. The model law provides for judicial review by a court.
Individual remedies: The new model law borrows some individual remedy provisions from the Privacy Protection Model Act, allowing consumers to bring private actions seeking equitable relief for violations of consumer rights. The new model law also permits consumers to recover costs and attorney fees if they should prevail. The new model law does not contain the Privacy Protection Model Act's prohibition on monetary awards exceeding actual damages but does say that there will be no remedy or recovery except as specifically provided.
Confidentiality: Information provided pursuant to the model law is to be protected from FOIA-type disclosure and subpoena of regulators receiving information; however, it is not entirely clear whether such protection would extend to all disclosures required under the model law.
This new model law provides for extensive regulation of insurers and producers, reinforced by examinations and penalties. The new model law is specifically oriented toward mandating security procedures and imposing penalties for breaches and resulting disclosures, whereas the Privacy Protection Model Act has been oriented toward identifying permitted disclosures, and the Privacy of Consumer Financial and Health Information Regulation is oriented toward privacy policies and violations of those policies. Neither of the prior models imposes substantial obligations in regard to the conduct of third parties as the new model law does. The two prior cybersecurity pronouncements of the NAIC, the Roadmap and the Principles, lack the high level of specificity found in the new model law. Given the bold statement about pre-emption of federal law, insurers and producers who believe this new model law would have an unwarranted adverse effect on them are encouraged to comment on or before March 23.
Day Pitney White Paper
On September 20, Susan Huntington presented during an educational call-in discussion, "Insurance and Coverage Risk Management Approaches to Address the Opioid Crisis," for the American Health Lawyers Association (AHLA).
On March 8, Bill Goddard will be speaking on "Lessons Learned from ERM, ORSA and Corporate Governance: Identifying and Remedying Weaknesses in Your Company's Risk and Capital Frameworks" at the 14th National Forum on Insurance Regulation, a conference presented by the American Conference Institute (ACI) to be held in New York.
On February 9, Bill Goddard will be speaking on a panel, titled "You've Got to Come Back with Me to The Future: An Ethics Discussion," at the 2018 International Association of Insurance Receivers (IAIR) Insurance Resolution Workshop to be held in Scottsdale, Arizona.
Day Pitney Alert
Day Pitney Press Release
Day Pitney partner Chase Rogers, former Chief Justice of the Connecticut Supreme Court, was featured in an article, "Retired Judges Establish Fund To Provide Lawyers For Immigrant Families," published by the Hartford Courant.
Chase T. Rogers, former Chief Justice of the Connecticut Supreme Court, was recognized by the Connecticut Council on Freedom of Information (CCFOI) for bringing greater openness to the state's court system.
On May 15, Chase T. Rogers, former Chief Justice of the Connecticut Supreme Court, received the 2018 John M. Bailey Award for Public Service at the Hartford County Bar Association (HCBA) Annual Meeting, which was held at the Bond Ballroom in Hartford, CT.
Day Pitney Press Release