The bill also requires a licensee to make reasonable efforts to notify consumers whose nonpublic information in the licensee's possession has been acquired by an unauthorized person. The notice must be provided within a reasonable time, but no later than 45 days after the licensee learns of the acquisition. Notification is not required if the information's acquisition does not create a material risk of identity theft or fraud or if the information was acquired in good faith by the licensee's employee or agent and is used for a lawful purpose of the licensee. The insurer must also notify a producer of record about the affected consumers, provide a copy of any notice to the commissioner, and notify the consumer reporting agencies of events requiring notification to at least 1,000 consumers.

The bill provides that failure to comply with any of the notification requirements is not negligence or a breach of duty, but may be evidence of negligence or breach of duty.

Under the bill, the commissioner has the power to examine and investigate the affairs of a licensee to determine whether a violation of any of the above requirements has occurred. A licensee must generally keep records relating to the requirements for at least five years and produce them upon demand of the commissioner. Any documents, materials, and other information from a licensee that are in the possession or control of the commissioner are confidential and privileged.

The bill provisions do not apply to a licensee that is an employee, agent, representative, or designee of a licensee and covered by that licensee's information security program; a licensee affiliated with a depository institution that maintains an information security program in compliance with the federal interagency guidelines; or a licensee affiliated with a legal entity established pursuant to the federal Farm Credit Act that maintains an information security program in compliance with the federal Farm Credit Administration's guidance and regulations. Additionally, except for the bill's requirement to notify the commissioner of a cybersecurity event involving nonpublic information, the bill's provisions do not apply to a licensee subject to the federal Department of Health and Human Services' Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB160-SSA1,1 Section 1. 601.465 (3) (f) of the statutes is created to read:

SB160-SSA1,3,3 601.465 (3) (f) All information protected under s. 601.955, which is subject only to the confidentiality provisions in s. 601.955.

SB160-SSA1,2 Section 2. Subchapter IX (title) of chapter 601 [precedes 601.95] of the statutes is created to read:

SB160-SSA1,4,3 Chapter 601

SB160-SSA1,4,4 Subchapter IX

SB160-SSA1,4,5 Insurance data security

SB160-SSA1,3 Section 3. 601.95 of the statutes is created to read:

SB160-SSA1,4,7 601.95 Definitions. In this subchapter:

SB160-SSA1,4,10 (1) “Authorized individual” means an individual who is known to and screened by a licensee and whose access to the licensee's information system or nonpublic information is determined by the licensee to be necessary and appropriate.

SB160-SSA1,4,12 (2) “Consumer” means an individual who is a resident of this state and whose nonpublic information is in the possession, custody, or control of a licensee.

SB160-SSA1,4,16 (3) “Cybersecurity event” means an event resulting in the unauthorized access to, or disruption or misuse of, an information system or the nonpublic information stored on an information system, except that a “cybersecurity event” does not include any of the following:

SB160-SSA1,4,19 (a) The unauthorized acquisition of encrypted nonpublic information if the encryption process or key is not also acquired, released, or used without authorization.

SB160-SSA1,4,22 (b) The unauthorized acquisition of nonpublic information if the licensee determines that the nonpublic information has not been used or released and has been returned to the licensee or destroyed.

SB160-SSA1,4,24 (4) “Encrypted” means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.

SB160-SSA1,5,3 (5) “Information security program” means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.

SB160-SSA1,5,8 (6) “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of nonpublic information, as well as any specialized system, including an industrial or process controls system, telephone switching and private branch exchange system, and environmental control system.

SB160-SSA1,5,13 (7) “Licensee” means a person licensed, authorized, or registered, or a person required to be licensed, authorized, or registered, under chs. 600 to 655, other than a purchasing or risk retention group that is chartered and licensed in another state or a person acting as an assuming insurer that is domiciled in another state or jurisdiction.

SB160-SSA1,5,15 (8) “Multifactor authentication” means authentication through verification of at least 2 of the following types of authentication factors:

SB160-SSA1,5,16 (a) Knowledge factor, including a password.

SB160-SSA1,5,17 (b) Possession factor, including a token or text message on a mobile phone.

SB160-SSA1,5,18 (c) Inherence factor, including a biometric characteristic.

SB160-SSA1,5,21 (9) “Nonpublic information” means electronic information in the possession, custody, or control of a licensee that is not publicly available information and is any of the following:

SB160-SSA1,5,23 (a) Information concerning a consumer that can be used to identify the consumer, in combination with at least one of the following data elements: