LRBs0050/1
EKL:cdc
2021 - 2022 LEGISLATURE
SENATE SUBSTITUTE AMENDMENT 1,
TO SENATE BILL 160
March 29, 2021 - Offered by Senator
Testin.
SB160-SSA1,1,4
1An Act to create 601.465 (3) (f), subchapter IX (title) of chapter 601 [precedes
2601.95], 601.95, 601.951, 601.952, 601.953, 601.954, 601.955 and 601.956 of the
3statutes;
relating to: imposing requirements related to insurance data
4security and granting rule-making authority.
Analysis by the Legislative Reference Bureau
This bill imposes requirements relating to the protection of nonpublic
information on insurers and other persons regulated by the Office of the
Commissioner of Insurance (licensees). The bill defines “nonpublic information” to
mean nonpublic electronic information in the possession, custody, or control of a
licensee that is either information concerning a Wisconsin resident that can be used
to identify the individual in combination with another data element, such as a Social
Security number, or certain health-related information that can be used to identify
a Wisconsin resident.
Under the bill, a licensee must conduct a risk assessment and develop an
information security program based on the assessment. The risk assessment must
identify and assess reasonably foreseeable threats that could result in unauthorized
access to or transmission, disclosure, misuse, alteration, or destruction of nonpublic
information. The information security program must contain safeguards for the
protection of the licensee's information systems and nonpublic information and be
designed to mitigate threats, commensurate with the size and complexity of the
licensee, the nature and scope of the licensee's activities, and the sensitivity of the
nonpublic information. The bill requires the licensee to take specified risk mitigation
actions and to monitor, evaluate, and adjust the information security program as
appropriate.
The bill also requires that a licensee develop an incident response plan to
promptly respond to, and recover from, a cybersecurity event that compromises the
confidentiality, integrity, or availability of nonpublic information, the licensee's
information systems, or the continuing functionality of the licensee's business or
operations. Under the bill, “cybersecurity event” generally means an event resulting
in the unauthorized access to, or disruption or misuse of, an information system or
nonpublic information stored on an information system.
The bill further requires that a licensee exercise due diligence in selecting
third-party service providers and make reasonable efforts to require that a service
provider implement measures to protect and secure information systems and
nonpublic information and report the occurrence of any cybersecurity event.
Under the bill, the above requirements do not apply to a licensee who has less
than $10 million in year-end total assets, less than $5 million in gross annual
revenue, or fewer than 50 full-time employees. A licensee who is not exempt from
the requirements must annually certify to the commissioner that the licensee has
complied with them.
Additionally, if a licensee knows that a cybersecurity event has or may have
occurred, the bill requires that the licensee conduct a prompt investigation to assess
the nature and scope of the event and take related actions, including the performance
of reasonable measures to restore the security of affected information systems. If the
cybersecurity event involves an information system maintained by a third-party
service provider, the licensee must comply with the investigation requirements or
make reasonable efforts to confirm that the service provider has either complied with
the requirements or failed to cooperate with the investigation.
Under the bill, a licensee must notify the commissioner of a cybersecurity event
involving nonpublic information if either of the following conditions is met:
1. The licensee is domiciled in Wisconsin and the cybersecurity event has a
reasonable likelihood of materially harming a Wisconsin resident or a material part
of the licensee's normal operations.
2. The licensee reasonably believes that the cybersecurity event involves the
nonpublic information of at least 250 Wisconsin residents, and the cybersecurity
event either must be reported to a government entity under federal or state law or
has a reasonable likelihood of materially harming a Wisconsin resident or a material
part of the licensee's normal operations.
The notification must provide specified information about the cybersecurity
event, including details about the event and its discovery, a description of the
accessed nonpublic information, the number of affected Wisconsin residents, and the
licensee's efforts to address the circumstances that allowed the event to occur. The
licensee is required to update the commissioner on material changes to the
information and as additional information becomes available. If the cybersecurity
event involves a third-party service provider, the licensee must notify the
commissioner of the event unless the service provider does so. If the licensee is a
reinsurer, the licensee must notify the ceding issuer and the commissioner of the
licensee's state of domicile.
The bill also requires a licensee to make reasonable efforts to notify consumers
whose nonpublic information in the licensee's possession has been acquired by an
unauthorized person. The notice must be provided within a reasonable time, but no
later than 45 days after the licensee learns of the acquisition. Notification is not
required if the information's acquisition does not create a material risk of identity
theft or fraud or if the information was acquired in good faith by the licensee's
employee or agent and is used for a lawful purpose of the licensee. The insurer must
also notify a producer of record about the affected consumers, provide a copy of any
notice to the commissioner, and notify the consumer reporting agencies of events
requiring notification to at least 1,000 consumers.
The bill provides that failure to comply with any of the notification
requirements is not negligence or a breach of duty, but may be evidence of negligence
or breach of duty.
Under the bill, the commissioner has the power to examine and investigate the
affairs of a licensee to determine whether a violation of any of the above requirements
has occurred. A licensee must generally keep records relating to the requirements
for at least five years and produce them upon demand of the commissioner. Any
documents, materials, and other information from a licensee that are in the
possession or control of the commissioner are confidential and privileged.
The bill provisions do not apply to a licensee that is an employee, agent,
representative, or designee of a licensee and covered by that licensee's information
security program; a licensee affiliated with a depository institution that maintains
an information security program in compliance with the federal interagency
guidelines; or a licensee affiliated with a legal entity established pursuant to the
federal Farm Credit Act that maintains an information security program in
compliance with the federal Farm Credit Administration's guidance and regulations.
Additionally, except for the bill's requirement to notify the commissioner of a
cybersecurity event involving nonpublic information, the bill's provisions do not
apply to a licensee subject to the federal Department of Health and Human Services'
Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.
The people of the state of Wisconsin, represented in senate and assembly, do
enact as follows:
SB160-SSA1,1
1Section
1. 601.465 (3) (f) of the statutes is created to read:
SB160-SSA1,3,32
601.465
(3) (f) All information protected under s. 601.955, which is subject only
3to the confidentiality provisions in s. 601.955.
SB160-SSA1,2
1Section
2. Subchapter IX (title) of chapter 601 [precedes 601.95] of the
2statutes is created to read:
SB160-SSA1,4,44
Subchapter IX
SB160-SSA1,4,55
Insurance data security
SB160-SSA1,3
6Section
3. 601.95 of the statutes is created to read:
SB160-SSA1,4,7
7601.95 Definitions. In this subchapter:
SB160-SSA1,4,10
8(1) “Authorized individual” means an individual who is known to and screened
9by a licensee and whose access to the licensee's information system or nonpublic
10information is determined by the licensee to be necessary and appropriate.
SB160-SSA1,4,12
11(2) “Consumer” means an individual who is a resident of this state and whose
12nonpublic information is in the possession, custody, or control of a licensee.
SB160-SSA1,4,16
13(3) “Cybersecurity event” means an event resulting in the unauthorized access
14to, or disruption or misuse of, an information system or the nonpublic information
15stored on an information system, except that a “cybersecurity event” does not include
16any of the following:
SB160-SSA1,4,1917
(a) The unauthorized acquisition of encrypted nonpublic information if the
18encryption process or key is not also acquired, released, or used without
19authorization.
SB160-SSA1,4,2220
(b) The unauthorized acquisition of nonpublic information if the licensee
21determines that the nonpublic information has not been used or released and has
22been returned to the licensee or destroyed.
SB160-SSA1,4,24
23(4) “Encrypted” means the transformation of data into a form that results in
24a low probability of assigning meaning without the use of a protective process or key.
SB160-SSA1,5,3
1(5) “Information security program” means the administrative, technical, and
2physical safeguards that a licensee uses to access, collect, distribute, process, protect,
3store, use, transmit, dispose of, or otherwise handle nonpublic information.
SB160-SSA1,5,8
4(6) “Information system” means a discrete set of electronic information
5resources organized for the collection, processing, maintenance, use, sharing,
6dissemination, or disposition of nonpublic information, as well as any specialized
7system, including an industrial or process controls system, telephone switching and
8private branch exchange system, and environmental control system.
SB160-SSA1,5,13
9(7) “Licensee” means a person licensed, authorized, or registered, or a person
10required to be licensed, authorized, or registered, under chs. 600 to 655, other than
11a purchasing or risk retention group that is chartered and licensed in another state
12or a person acting as an assuming insurer that is domiciled in another state or
13jurisdiction.
SB160-SSA1,5,15
14(8) “Multifactor authentication” means authentication through verification of
15at least 2 of the following types of authentication factors:
SB160-SSA1,5,1616
(a) Knowledge factor, including a password.
SB160-SSA1,5,1717
(b) Possession factor, including a token or text message on a mobile phone.
SB160-SSA1,5,1818
(c) Inherence factor, including a biometric characteristic.
SB160-SSA1,5,21
19(9) “Nonpublic information” means electronic information in the possession,
20custody, or control of a licensee that is not publicly available information and is any
21of the following:
SB160-SSA1,5,2322
(a) Information concerning a consumer that can be used to identify the
23consumer, in combination with at least one of the following data elements:
SB160-SSA1,5,2424
1. Social security number.
SB160-SSA1,5,2525
2. Driver's license number or nondriver identification card number.
SB160-SSA1,6,1
13. Financial account number or credit or debit card number.
SB160-SSA1,6,32
4. Security code, access code, or password that permits access to a financial
3account.
SB160-SSA1,6,44
5. Biometric records.
SB160-SSA1,6,85
(b) Information or data, other than information or data regarding age or
6gender, in any form or medium created by or derived from a health care provider or
7a consumer that can be used to identify the consumer and that relates to any of the
8following:
SB160-SSA1,6,109
1. The physical, mental, or behavioral health or condition of the consumer or
10a member of the consumer's family.
SB160-SSA1,6,1111
2. The provision of health care to the consumer.
SB160-SSA1,6,1212
3. Payment for the provision of health care to the consumer.
SB160-SSA1,6,16
13(10) “Publicly available information” means information that a licensee has a
14reasonable basis to believe is lawfully made available to the general public from
15federal, state, or local government records, widely distributed media, or disclosures
16required by federal, state, or local law.
SB160-SSA1,6,20
17(11) “Third-party service provider” means a person other than a licensee who
18contracts with a licensee to maintain, process, or store nonpublic information or is
19otherwise permitted access to nonpublic information through its provision of
20services to the licensee.
SB160-SSA1,4
21Section
4. 601.951 of the statutes is created to read:
SB160-SSA1,7,2
22601.951 General provisions.
(1) Exclusive state standards. This
23subchapter establishes the exclusive state standards applicable to licensees for data
24security, the investigation of a cybersecurity event, and notification of a
1cybersecurity event or unauthorized access to nonpublic information to the state
2government and consumers.
SB160-SSA1,7,7
3(2) Exceptions to applicability. (a) This subchapter does not apply to a person
4who is an employee, agent, representative, or designee of a licensee and who is also
5a licensee to the extent that the person is covered by the information security
6program of the other licensee and the other licensee has complied with this
7subchapter on behalf of the person.
SB160-SSA1,7,158
(b) A licensee affiliated with a depository institution that maintains an
9information security program in compliance with the interagency guidelines
10establishing information security standards as set forth pursuant to
15 USC 6801 11and
6805 shall be considered to meet the requirements of this subchapter, provided
12that the licensee produces, upon request of the commissioner, documentation
13satisfactory to the commissioner that independently validates the adoption by the
14affiliated depository institution of an information security program that satisfies the
15interagency guidelines.
SB160-SSA1,7,2416
(c) A licensee affiliated with a legal entity established pursuant to the federal
17farm credit act of 1971,
12 USC 2001, et seq., that maintains an information security
18program in compliance with the farm credit administration's guidance and
19regulations establishing policies and procedures to address data security and
20integrity shall be considered to meet the requirements of this subchapter, provided
21that the licensee produces, upon request of the commissioner, documentation
22satisfactory to the commissioner that independently validates the adoption by the
23affiliated legal entity of an information security program that satisfies the farm
24credit administration's guidance and regulations.