This is the preview version of the Wisconsin State Legislature site.
Please see http://docs.legis.wisconsin.gov for the production version.
SB160-SSA1,17,2116 (b) Notice to consumer reporting agencies. If, as the result of a single incident,
17a licensee is required under par. (a) to notify 1,000 or more consumers, the licensee
18shall without unreasonable delay notify all consumer reporting agencies that
19compile and maintain files on consumers on a nationwide basis, as defined in 15 USC
201681a
(p), of the timing, distribution, and content of the notices sent to the
21consumers.
SB160-SSA1,17,2422 (c) Exceptions. Notwithstanding pars. (a) and (b), a licensee is not required to
23provide notice of the acquisition of nonpublic information if any of the following
24applies:
SB160-SSA1,18,3
11. The acquisition of nonpublic information does not create a material risk of
2identity theft or fraud to the individual who is the subject of the nonpublic
3information.
SB160-SSA1,18,54 2. The nonpublic information was acquired in good faith by an employee or
5agent of the licensee and is used for a lawful purpose of the licensee.
SB160-SSA1,18,116 (d) Timing and manner of notice; other requirements. 1. Subject to par. (h), a
7licensee shall provide the notice required under par. (a) within a reasonable time, not
8to exceed 45 days after the licensee learns of the acquisition of nonpublic information.
9A determination as to reasonableness under this subdivision shall include
10consideration of the number of notices that the licensee must provide and the
11methods of communication available to the licensee.
SB160-SSA1,18,1812 2. A licensee shall provide the notice required under par. (a) by mail or by a
13method the licensee has previously employed to communicate with the consumer
14who is the subject of the nonpublic information. If a licensee cannot with reasonable
15diligence determine the mailing address of the subject of the nonpublic information,
16and if the licensee has not previously communicated with the subject of the nonpublic
17information, the licensee shall provide notice by a method reasonably calculated to
18provide actual notice to the subject of the nonpublic information.
SB160-SSA1,18,2119 3. Upon written request by a consumer who has received a notice under par.
20(a), the licensee that provided the notice shall identify the nonpublic information
21that was acquired.
SB160-SSA1,18,2322 (e) Notice to commissioner. A licensee shall provide to the commissioner a copy
23of any notice sent under this subsection.
SB160-SSA1,18,2524 (f) Exceptions for certain entities. This subsection does not apply to any of the
25following:
SB160-SSA1,19,4
11. An entity that is subject to, and in compliance with, the privacy and security
2requirements of 15 USC 6801 to 6827, or a person that has a contractual obligation
3to such an entity, if the entity or person has in effect a policy concerning breaches of
4information security.
SB160-SSA1,19,652. An entity that is described in 45 CFR 164.104 (a), if the entity complies with
6the requirements of 45 CFR part 164.
SB160-SSA1,19,87 (g) Effect on civil claims. Failure to comply with this section is not negligence
8or a breach of any duty, but may be evidence of negligence or a breach of a legal duty.
SB160-SSA1,19,169 (h) Request by law enforcement not to notify. A law enforcement agency may,
10in order to protect an investigation or homeland security, ask a licensee not to provide
11a notice that is otherwise required under par. (a) or (i) for any period of time and the
12notification process required under this subsection shall begin at the end of that time
13period. Notwithstanding pars. (a), (d), and (i), if a licensee receives such a request,
14the licensee may not provide notice of or publicize an unauthorized acquisition of
15nonpublic information, except as authorized by the law enforcement agency that
16made the request.
SB160-SSA1,19,2417 (i) Notice to producer of record. If the licensee is an insurer whose services are
18accessed by consumers through an independent insurance producer, the licensee
19shall notify the producer of record of any consumers whose nonpublic information
20has been accessed without authorization or affected by a cybersecurity event no later
21than the date at which notice is provided in par. (d), except that notice is not required
22to a producer of record who is not authorized by law or contract to sell, solicit, or
23negotiate on behalf of the licensee or if the licensee does not have the current
24producer of record information for a consumer.
SB160-SSA1,20,8
1(3) Third-party service providers. If the licensee has knowledge of a
2cybersecurity event involving nonpublic information on an information system
3maintained by a 3rd-party service provider and any of the conditions in sub. (1) (a)
4are met, the licensee shall provide notice to the commissioner no later than 3 days
5after the earlier of the date the 3rd-party service provider notifies the licensee of the
6cybersecurity event or the licensee has actual knowledge of the cybersecurity event.
7The licensee is not required to comply with this subsection if the 3rd-party service
8provider provides notice under sub. (1).
SB160-SSA1,20,19 9(4) Reinsurers. In the event of a cybersecurity event involving nonpublic
10information, or involving nonpublic information on an information system
11maintained by a 3rd-party service provider, a licensee who is acting as an assuming
12insurer and who does not have a direct contractual relationship with the consumers
13affected by the cybersecurity event shall, if any of the conditions in sub. (1) (a) are
14met, notify the ceding insurer and the commissioner of the licensee's state of domicile
15of the cybersecurity event no later than 3 business days after learning of the
16cybersecurity event. The licensee shall have no other notice obligations relating to
17a cybersecurity event or other data breach under this section or any other law of this
18state. A ceding insurer who has a direct contractual relationship with the affected
19consumers shall comply with the notification requirements under this section.
SB160-SSA1,8 20Section 8. 601.955 of the statutes is created to read:
SB160-SSA1,20,24 21601.955 Confidentiality. (1) All of the following apply to documents,
22materials, and other information in the possession or control of the commissioner
23that are obtained by, created by, or disclosed to the commissioner or any other person
24under this subchapter:
SB160-SSA1,21,2
1(a) The documents, materials, and other information are considered
2proprietary and contain trade secrets.
SB160-SSA1,21,43 (b) The documents, materials, and other information are confidential and
4privileged, and the privilege may not be constructively waived.
SB160-SSA1,21,65 (c) The documents, materials, and other information are not open to inspection
6or copying under s. 19.35 (1).
SB160-SSA1,21,87 (d) The documents, materials, and other information are not subject to
8subpoena or discovery and are not admissible as evidence in a private civil action.
SB160-SSA1,21,119 (e) The commissioner may use the documents, materials, and other
10information in the furtherance of any regulatory or legal action brought as a part of
11the commissioner's official duties.
SB160-SSA1,21,1312 (f) The commissioner may not make the documents, materials, or other
13information public without first obtaining written consent of the licensee.
SB160-SSA1,21,1614 (g) Neither the commissioner nor any person who received the documents,
15materials, or other information may testify or be required to testify in any private
16civil action regarding the documents, materials, or other information.
SB160-SSA1,22,4 17(2) Notwithstanding sub. (1), the commissioner may share, upon request, the
18documents, materials, or other information with other state, federal, and
19international financial regulatory agencies if the recipient agrees in writing to
20maintain the confidentiality and privileged status of the documents, materials, or
21other information and has verified that it has the legal authority to maintain
22confidentiality. The commissioner may receive documents, materials, or other
23information related to this subchapter from other state, federal, and international
24financial regulatory agencies and shall maintain as confidential or privileged any
25documents, materials, or other information that is treated as confidential or

1privileged under the laws of the jurisdiction that is the source of the documents,
2materials, or other information. The sharing of documents under this subsection
3does not constitute a delegation of regulatory authority and does not act as a waiver
4of privilege.
SB160-SSA1,22,9 5(3) Notwithstanding sub. (1), the commissioner may share the documents,
6materials, or other information under this section with a 3rd-party consultant or
7vendor if the consultant or vendor agrees in writing to maintain the confidentiality
8and privileged status of the documents, materials, and other information shared
9under this section.
SB160-SSA1,22,13 10(4) Nothing in this subchapter prohibits the commissioner from releasing final,
11adjudicated actions that are open to public inspection to a database or other
12clearinghouse service maintained by the National Association of Insurance
13Commissioners, its affiliates, or subsidiaries.
SB160-SSA1,9 14Section 9. 601.956 of the statutes is created to read:
SB160-SSA1,22,21 15601.956 Enforcement. The commissioner shall have the power to examine
16and investigate the affairs of any licensee to determine whether the licensee has
17engaged in conduct in violation of this subchapter and to take action that is necessary
18or appropriate to enforce the provisions of this subchapter. This power is in addition
19to the powers that the commissioner has under subch. IV of this chapter. An
20investigation or examination under this section shall be conducted under subchs. IV
21and V of this chapter.
SB160-SSA1,10 22Section 10. Effective date.
SB160-SSA1,22,2423 (1) This act takes effect on the first day of the 4th month beginning after
24publication.
Loading...
Loading...