AB147,17,14 (4) Reinsurers. In the event of a cybersecurity event involving nonpublic information, or involving an information system maintained by a 3rd-party service provider, a licensee who is acting as an assuming insurer and who does not have a direct contractual relationship with consumers affected by the cybersecurity event shall notify the ceding insurer and the commissioner of the licensee's state of domicile of the cybersecurity event no later than 3 business days after learning of the cybersecurity event. The licensee shall have no other notice obligations relating to a cybersecurity event or other data breach under this section or any other law of this state. A ceding insurer who has a direct contractual relationship with the affected consumers shall comply with the notification requirements under this section and, if applicable, the requirements under s. 134.98.

AB147,8 Section 8. 601.955 of the statutes is created to read:

AB147,17,19 601.955 Confidentiality. (1) All of the following apply to documents, materials, and other information in the possession or control of the commissioner that are obtained by, created by, or disclosed to the commissioner or any other person under this subchapter:

AB147,17,21 (a) The documents, materials, and other information are considered proprietary and contain trade secrets.

AB147,17,23 (b) The documents, materials, and other information are confidential and privileged, and the privilege may not be constructively waived.

AB147,17,25 (c) The documents, materials, and other information are not open to inspection or copying under s. 19.35 (1).

AB147,18,2 (d) The documents, materials, and other information are not subject to subpoena or discovery and are not admissible as evidence in a private civil action.

AB147,18,5 (e) The commissioner may use the documents, materials, and other information in the furtherance of any regulatory or legal action brought as a part of the commissioner's official duties.

AB147,18,7 (f) The commissioner may not make the documents, materials, or other information public without first obtaining written consent of the licensee.

AB147,18,10 (g) Neither the commissioner nor any person who received the documents, materials, or other information may testify or be required to testify in any private civil action regarding the documents, materials, or other information.

AB147,18,23 (2) Notwithstanding sub. (1), the commissioner may share, upon request, the documents, materials, or other information with other state, federal, and international financial regulatory agencies if the recipient agrees in writing to maintain the confidentiality and privileged status of the documents, materials, or other information and has verified that it has the legal authority to maintain confidentiality. The commissioner may receive documents, materials, or other information related to this subchapter from other state, federal, and international financial regulatory agencies and shall maintain as confidential or privileged any documents, materials, or other information that is treated as confidential or privileged under the laws of the jurisdiction that is the source of the documents, materials, or other information. The sharing of documents under this subsection does not constitute a delegation of regulatory authority and does not act as a waiver of privilege.

AB147,19,3 (3) Notwithstanding sub. (1), the commissioner may share the documents, materials, or other information under this section with a 3rd-party consultant or vendor if the consultant or vendor agrees in writing to maintain the confidentiality and privileged status of the documents, materials, and other information shared under this section.

AB147,19,7 (4) Nothing in this subchapter prohibits the commissioner from releasing final, adjudicated actions that are open to public inspection to a database or other clearinghouse service maintained by the National Association of Insurance Commissioners, its affiliates, or subsidiaries.

AB147,9 Section 9. 601.956 of the statutes is created to read:

AB147,19,15 601.956 Enforcement. The commissioner shall have the power to examine and investigate the affairs of any licensee to determine whether the licensee has engaged in conduct in violation of this subchapter and to take action that is necessary or appropriate to enforce the provisions of this subchapter. This power is in addition to the powers that the commissioner has under subch. IV of this chapter. An investigation or examination under this section shall be conducted under subchs. IV and V of this chapter.

AB147,10 Section 10. Effective date.

AB147,19,18 (1) This act takes effect on the first day of the 4th month beginning after publication.

AB147,19,19 (End)