Amendment SSA1-SB160

Analysis by the Legislative Reference Bureau

This bill imposes requirements relating to the protection of nonpublic information on insurers and other persons regulated by the Office of the Commissioner of Insurance (licensees). The bill defines “nonpublic information” to mean nonpublic electronic information in the possession, custody, or control of a licensee that is either information concerning a Wisconsin resident that can be used to identify the individual in combination with another data element, such as a Social Security number, or certain health-related information that can be used to identify a Wisconsin resident.

Under the bill, a licensee must conduct a risk assessment and develop an information security program based on the assessment. The risk assessment must identify and assess reasonably foreseeable threats that could result in unauthorized access to or transmission, disclosure, misuse, alteration, or destruction of nonpublic information. The information security program must contain safeguards for the protection of the licensee's information systems and nonpublic information and be designed to mitigate threats, commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, and the sensitivity of the nonpublic information. The bill requires the licensee to take specified risk mitigation actions and to monitor, evaluate, and adjust the information security program as appropriate.

The bill also requires that a licensee develop an incident response plan to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information, the licensee's information systems, or the continuing functionality of the licensee's business or operations. Under the bill, “cybersecurity event” generally means an event resulting in the unauthorized access to, or disruption or misuse of, an information system or nonpublic information stored on an information system.

The bill further requires that a licensee exercise due diligence in selecting third-party service providers and make reasonable efforts to require that a service provider implement measures to protect and secure information systems and nonpublic information and report the occurrence of any cybersecurity event.

Under the bill, the above requirements do not apply to a licensee who has less than $10 million in year-end total assets, less than $5 million in gross annual revenue, or fewer than 50 full-time employees. A licensee who is not exempt from the requirements must annually certify to the commissioner that the licensee has complied with them.

Additionally, if a licensee knows that a cybersecurity event has or may have occurred, the bill requires that the licensee conduct a prompt investigation to assess the nature and scope of the event and take related actions, including the performance of reasonable measures to restore the security of affected information systems. If the cybersecurity event involves an information system maintained by a third-party service provider, the licensee must comply with the investigation requirements or make reasonable efforts to confirm that the service provider has either complied with the requirements or failed to cooperate with the investigation.

Under the bill, a licensee must notify the commissioner of a cybersecurity event involving nonpublic information if either of the following conditions is met:

1. The licensee is domiciled in Wisconsin and the cybersecurity event has a reasonable likelihood of materially harming a Wisconsin resident or a material part of the licensee's normal operations.

2. The licensee reasonably believes that the cybersecurity event involves the nonpublic information of at least 250 Wisconsin residents, and the cybersecurity event either must be reported to a government entity under federal or state law or has a reasonable likelihood of materially harming a Wisconsin resident or a material part of the licensee's normal operations.

The notification must provide specified information about the cybersecurity event, including details about the event and its discovery, a description of the accessed nonpublic information, the number of affected Wisconsin residents, and the licensee's efforts to address the circumstances that allowed the event to occur. The licensee is required to update the commissioner on material changes to the information and as additional information becomes available. If the cybersecurity event involves a third-party service provider, the licensee must notify the commissioner of the event unless the service provider does so. If the licensee is a reinsurer, the licensee must notify the ceding issuer and the commissioner of the licensee's state of domicile.

The bill also requires a licensee to make reasonable efforts to notify consumers whose nonpublic information in the licensee's possession has been acquired by an unauthorized person. The notice must be provided within a reasonable time, but no later than 45 days after the licensee learns of the acquisition. Notification is not required if the information's acquisition does not create a material risk of identity theft or fraud or if the information was acquired in good faith by the licensee's employee or agent and is used for a lawful purpose of the licensee. The insurer must also notify a producer of record about the affected consumers, provide a copy of any notice to the commissioner, and notify the consumer reporting agencies of events requiring notification to at least 1,000 consumers.

The bill provides that failure to comply with any of the notification requirements is not negligence or a breach of duty, but may be evidence of negligence or breach of duty.

Under the bill, the commissioner has the power to examine and investigate the affairs of a licensee to determine whether a violation of any of the above requirements has occurred. A licensee must generally keep records relating to the requirements for at least five years and produce them upon demand of the commissioner. Any documents, materials, and other information from a licensee that are in the possession or control of the commissioner are confidential and privileged.

The bill provisions do not apply to a licensee that is an employee, agent, representative, or designee of a licensee and covered by that licensee's information security program; a licensee affiliated with a depository institution that maintains an information security program in compliance with the federal interagency guidelines; or a licensee affiliated with a legal entity established pursuant to the federal Farm Credit Act that maintains an information security program in compliance with the federal Farm Credit Administration's guidance and regulations. Additionally, except for the bill's requirement to notify the commissioner of a cybersecurity event involving nonpublic information, the bill's provisions do not apply to a licensee subject to the federal Department of Health and Human Services' Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB160-SSA1,1 Section 1. 601.465 (3) (f) of the statutes is created to read:

SB160-SSA1,3,3 601.465 (3) (f) All information protected under s. 601.955, which is subject only to the confidentiality provisions in s. 601.955.

SB160-SSA1,2 Section 2. Subchapter IX (title) of chapter 601 [precedes 601.95] of the statutes is created to read:

SB160-SSA1,4,3 Chapter 601

SB160-SSA1,4,4 Subchapter IX

SB160-SSA1,4,5 Insurance data security

SB160-SSA1,3 Section 3. 601.95 of the statutes is created to read:

SB160-SSA1,4,7 601.95 Definitions. In this subchapter:

SB160-SSA1,4,10 (1) “Authorized individual” means an individual who is known to and screened by a licensee and whose access to the licensee's information system or nonpublic information is determined by the licensee to be necessary and appropriate.

SB160-SSA1,4,12 (2) “Consumer” means an individual who is a resident of this state and whose nonpublic information is in the possession, custody, or control of a licensee.

SB160-SSA1,4,16 (3) “Cybersecurity event” means an event resulting in the unauthorized access to, or disruption or misuse of, an information system or the nonpublic information stored on an information system, except that a “cybersecurity event” does not include any of the following:

SB160-SSA1,4,19 (a) The unauthorized acquisition of encrypted nonpublic information if the encryption process or key is not also acquired, released, or used without authorization.

SB160-SSA1,4,22 (b) The unauthorized acquisition of nonpublic information if the licensee determines that the nonpublic information has not been used or released and has been returned to the licensee or destroyed.

SB160-SSA1,4,24 (4) “Encrypted” means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.

SB160-SSA1,5,3 (5) “Information security program” means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.

SB160-SSA1,5,8 (6) “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of nonpublic information, as well as any specialized system, including an industrial or process controls system, telephone switching and private branch exchange system, and environmental control system.

SB160-SSA1,5,13 (7) “Licensee” means a person licensed, authorized, or registered, or a person required to be licensed, authorized, or registered, under chs. 600 to 655, other than a purchasing or risk retention group that is chartered and licensed in another state or a person acting as an assuming insurer that is domiciled in another state or jurisdiction.

SB160-SSA1,5,15 (8) “Multifactor authentication” means authentication through verification of at least 2 of the following types of authentication factors:

SB160-SSA1,5,16 (a) Knowledge factor, including a password.

SB160-SSA1,5,17 (b) Possession factor, including a token or text message on a mobile phone.

SB160-SSA1,5,18 (c) Inherence factor, including a biometric characteristic.

SB160-SSA1,5,21 (9) “Nonpublic information” means electronic information in the possession, custody, or control of a licensee that is not publicly available information and is any of the following:

SB160-SSA1,5,23 (a) Information concerning a consumer that can be used to identify the consumer, in combination with at least one of the following data elements:

SB160-SSA1,5,24 1. Social security number.

SB160-SSA1,5,25 2. Driver's license number or nondriver identification card number.

SB160-SSA1,6,1 3. Financial account number or credit or debit card number.

SB160-SSA1,6,3 4. Security code, access code, or password that permits access to a financial account.

SB160-SSA1,6,4 5. Biometric records.

SB160-SSA1,6,8 (b) Information or data, other than information or data regarding age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify the consumer and that relates to any of the following:

SB160-SSA1,6,10 1. The physical, mental, or behavioral health or condition of the consumer or a member of the consumer's family.

SB160-SSA1,6,11 2. The provision of health care to the consumer.

SB160-SSA1,6,12 3. Payment for the provision of health care to the consumer.

SB160-SSA1,6,16 (10) “Publicly available information” means information that a licensee has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records, widely distributed media, or disclosures required by federal, state, or local law.

SB160-SSA1,6,20 (11) “Third-party service provider” means a person other than a licensee who contracts with a licensee to maintain, process, or store nonpublic information or is otherwise permitted access to nonpublic information through its provision of services to the licensee.

SB160-SSA1,4 Section 4. 601.951 of the statutes is created to read:

SB160-SSA1,7,2 601.951 General provisions. (1) Exclusive state standards. This subchapter establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, and notification of a cybersecurity event or unauthorized access to nonpublic information to the state government and consumers.

SB160-SSA1,7,7 (2) Exceptions to applicability. (a) This subchapter does not apply to a person who is an employee, agent, representative, or designee of a licensee and who is also a licensee to the extent that the person is covered by the information security program of the other licensee and the other licensee has complied with this subchapter on behalf of the person.

SB160-SSA1,7,15 (b) A licensee affiliated with a depository institution that maintains an information security program in compliance with the interagency guidelines establishing information security standards as set forth pursuant to 15 USC 6801 and 6805 shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated depository institution of an information security program that satisfies the interagency guidelines.

SB160-SSA1,7,24 (c) A licensee affiliated with a legal entity established pursuant to the federal farm credit act of 1971, 12 USC 2001, et seq., that maintains an information security program in compliance with the farm credit administration's guidance and regulations establishing policies and procedures to address data security and integrity shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated legal entity of an information security program that satisfies the farm credit administration's guidance and regulations.

SB160-SSA1,8,4 (d) This subchapter, except for s. 601.954 (1), does not apply to a licensee who is subject to and governed by 45 CFR Parts 160 and 164 and who maintains nonpublic information in the same manner as protected health information under 45 CFR Parts 160 and 164.

SB160-SSA1,8,6 (e) If a licensee ceases to qualify for an exception under par. (a) to (d), the licensee shall have 180 days to comply with this subchapter.

SB160-SSA1,8,10 (3) Agreements between parties. Nothing in this subchapter shall prevent or abrogate an agreement between a licensee and another licensee, a 3rd-party service provider, or another party to fulfill any of the requirements under s. 601.953 or 601.954.

SB160-SSA1,8,13 (4) Private cause of action. This subchapter may not be construed to create or imply a private cause of action for violation of its provisions or to curtail a private cause of action that otherwise exists in the absence of this subchapter.

SB160-SSA1,8,15 (5) Rules. The commissioner may promulgate rules that are necessary to carry out the provisions of this subchapter.

SB160-SSA1,5 Section 5. 601.952 of the statutes is created to read:

SB160-SSA1,8,24 601.952 Information security program. (1) Implementation of program. No later than one year after the effective date of this subsection .... [LRB inserts date], a licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment under sub. (2) and consistent with the conditions of sub. (3) (a). The program shall contain administrative, technical, and physical safeguards for the protection of the licensee's information systems and nonpublic information. The licensee shall design the program to do all of the following:

SB160-SSA1,9,2 (a) Protect against threats and hazards to the security and integrity of the information systems and nonpublic information.

SB160-SSA1,9,5 (b) Protect against unauthorized access to and use of nonpublic information and minimize the likelihood of harm to a consumer from the unauthorized access or use.

SB160-SSA1,9,8 (c) Establish and periodically reevaluate a schedule for retention and disposal of nonpublic information and establish a mechanism for the destruction of nonpublic information that is no longer needed.

SB160-SSA1,9,10 (2) Risk assessment. The licensee shall conduct a risk assessment under which the licensee shall do all of the following:

SB160-SSA1,9,14 (a) Identify reasonably foreseeable internal and external threats that could result in unauthorized access to or transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including nonpublic information that is accessible to or held by 3rd-party service providers of the licensee.

SB160-SSA1,9,16 (b) Assess the likelihood and potential damage of the threats identified under par. (a), taking into consideration the sensitivity of the nonpublic information.

SB160-SSA1,9,19 (c) Assess the sufficiency of policies, procedures, information systems, and other safeguards to manage the threats identified under par. (a) in each relevant area of the licensee's operations, including all of the following:

SB160-SSA1,9,20 1. Employee training and management.

SB160-SSA1,9,22 2. Information systems, including the classification, governance, processing, storage, transmission, and disposal of information.

SB160-SSA1,9,24 3. Processes for detecting, preventing, and responding to attacks, intrusions, and other system failures.

SB160-SSA1,10,2 (3) Risk management. Based on the risk assessment under sub. (2), the licensee shall do all of the following:

SB160-SSA1,10,6 (a) Design an information security program to mitigate the identified threats, commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including its use of 3rd-party service providers, and the sensitivity of the nonpublic information.

SB160-SSA1,10,7 (b) Implement the following security measures, as appropriate:

SB160-SSA1,10,8 1. Place access controls on information systems.

SB160-SSA1,10,12 2. Identify and manage the data, personnel, devices, systems, and facilities that enable the licensee to achieve its business purposes, taking into consideration the relative importance of the data, personnel, devices, systems, and facilities to the business objectives and risk strategy of the licensee.

SB160-SSA1,10,14 3. Restrict physical access to nonpublic information to authorized individuals only.

SB160-SSA1,10,17 4. Protect, by encryption or other means, nonpublic information being transmitted over an external network and nonpublic information stored on a portable computer or storage device or media.

SB160-SSA1,10,19 5. Adopt secure development practices for applications that are developed in-house and utilized by the licensee.

SB160-SSA1,10,21 6. Modify information systems in accordance with the licensee's information security program.

SB160-SSA1,10,23 7. Utilize effective controls, which may include multifactor authentication procedures for employees accessing nonpublic information.

SB160-SSA1,10,25 8. Implement regular testing and monitoring of systems and procedures to detect actual and attempted attacks on, or intrusions into, an information system.

SB160-SSA1,11,4 9. Include audit trails within the information security program that are designed to detect and respond to cybersecurity events and to reconstruct material financial transactions sufficient to support the normal operations and obligations of the licensee.

SB160-SSA1,11,7 10. Implement measures to protect against the destruction, loss, or damage of nonpublic information due to environmental hazards, natural and other disasters, and technological failures.

SB160-SSA1,11,9 11. Develop, implement, and maintain practices for the secure disposal of nonpublic information in all formats.

SB160-SSA1,11,11 (c) Designate at least one employee, affiliate, or outside vendor as responsible for the information security program.