SB54 Alabama 2019 Session

Sponsors

Session

Regular Session 2019

Title

Insurance Data Security Law, Insurance Commissioner to regulate, reports to Insurance Dept., licensee to implement information security programs, oversight of third-party providers, reports re cybersecurity events, criminal penalties, Secs. 10A-20-6.16, 27-21A-23 am'd.

Description

<p class="bill_description"> Under existing law, insurers and other entities are required to provide notice to certain persons upon a breach of security resulting in the unauthorized acquisition of sensitive personally identifying information</p><p class="bill_description"> This bill would require insurers and other entities licensed by the Department of Insurance to develop, implement, and maintain an information security program and report certain cybersecurity events to the Commissioner of Insurance. The bill would provide that information provided to the Commissioner of Insurance pursuant to this act would be confidential and privileged under certain conditions. This bill would also provide civil penalties for violations. The bill is based on the Insurance Data Security Model Law of the National Association of Insurance Commissioners</p><p class="bill_entitled_an_act"> Relating to insurance; to require insurers and other entities licensed by the Department of Insurance to develop, implement, and maintain an information security program; to provide for reporting to the Commissioner of Insurance, including the reporting of cybersecurity events; to provide that information provided to the commissioner pursuant to this act would be confidential and privileged under certain conditions; to provide for civil penalties under certain conditions; and for this purpose to amend Sections 10A-20-6.16, as corrected by Act 2018-406, the Codification Act, relating to certain nonprofit corporations, and 27-21A-23, Code of Alabama 1975, relating to health maintenance organizations. </p>

Subjects

Insurance Department