The notification must provide specified information about the cybersecurity event, including details about the event and its discovery, a description of the accessed nonpublic information, the number of affected Wisconsin residents, and the licensee's efforts to address the circumstances that allowed the event to occur. The licensee is required to update the commissioner on material changes to the information and as additional information becomes available. If the cybersecurity event involves a third-party service provider, the licensee must notify the commissioner of the event unless the service provider does so.

Under the bill, the commissioner has the power to examine and investigate the affairs of a licensee to determine whether a violation of any of the above requirements has occurred. A licensee must generally keep records relating to the requirements for at least five years and produce them upon demand of the commissioner. Any documents, materials, and other information from a licensee that are in the possession or control of the commissioner are confidential and privileged.

For further information see the state fiscal estimate, which will be printed as an appendix to this bill.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB784,1 Section 1. 601.465 (3) (f) of the statutes is created to read:

SB784,3,3 601.465 (3) (f) All information protected under s. 601.955, which is subject only to the confidentiality provisions in s. 601.955.

SB784,2 Section 2 . Subchapter IX (title) of chapter 601 [precedes 601.95] of the statutes is created to read:

SB784,3,6 Chapter 601

SB784,3,7 Subchapter IX

SB784,3,8 Insurance data security

SB784,3 Section 3. 601.95 of the statutes is created to read:

SB784,3,10 601.95 Definitions. In this subchapter:

SB784,3,13 (1) “Authorized individual” means an individual who is known to and screened by a licensee and whose access to the licensee's information system or nonpublic information is determined by the licensee to be necessary and appropriate.

SB784,3,15 (2) “Consumer” means an individual who is a resident of this state and whose nonpublic information is in the possession, custody, or control of a licensee.

SB784,4,2 (3) “Cybersecurity event” means an event resulting in the unauthorized access to, or disruption or misuse of, an information system or the nonpublic information stored on an information system, except that a “cybersecurity event” does not include any of the following:

SB784,4,5 (a) The unauthorized acquisition of encrypted nonpublic information if the encryption process or key is not also acquired, released, or used without authorization.

SB784,4,8 (b) The unauthorized acquisition of nonpublic information if the licensee determines that the nonpublic information has not been used or released and has been returned to the licensee or destroyed.

SB784,4,10 (4) “Encrypted” means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.

SB784,4,13 (5) “Information security program” means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.

SB784,4,18 (6) “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of nonpublic information, as well as any specialized system, including an industrial or process controls system, telephone switching and private branch exchange system, and environmental control system.

SB784,4,23 (7) “Licensee” means a person licensed, authorized, or registered, or a person required to be licensed, authorized, or registered, under chs. 600 to 655, other than a purchasing or risk retention group that is chartered and licensed in another state or a person acting as an assuming insurer that is domiciled in another state or jurisdiction.

SB784,4,25 (8) “Multifactor authentication” means authentication through verification of at least 2 of the following types of authentication factors:

SB784,5,1 (a) Knowledge factor, including a password.

SB784,5,2 (b) Possession factor, including a token or text message on a mobile phone.

SB784,5,3 (c) Inherence factor, including a biometric characteristic.

SB784,5,6 (9) “Nonpublic information” means electronic information in the possession, custody, or control of a licensee that is not publicly available information and is any of the following:

SB784,5,8 (a) Information concerning a consumer that can be used to identify the consumer, in combination with at least one of the following data elements:

SB784,5,9 1. Social security number.