The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB160,1 Section 1. 601.465 (3) (f) of the statutes is created to read:

SB160,3,3 601.465 (3) (f) All information protected under s. 601.955, which is subject only to the confidentiality provisions in s. 601.955.

SB160,2 Section 2 . Subchapter IX (title) of chapter 601 [precedes 601.95] of the statutes is created to read:

SB160,3,6 Chapter 601

SB160,3,7 Subchapter IX

SB160,3,8 Insurance data security

SB160,3 Section 3. 601.95 of the statutes is created to read:

SB160,3,10 601.95 Definitions. In this subchapter:

SB160,3,13 (1) “Authorized individual” means an individual who is known to and screened by a licensee and whose access to the licensee's information system or nonpublic information is determined by the licensee to be necessary and appropriate.

SB160,3,15 (2) “Consumer” means an individual who is a resident of this state and whose nonpublic information is in the possession, custody, or control of a licensee.

SB160,4,2 (3) “Cybersecurity event” means an event resulting in the unauthorized access to, or disruption or misuse of, an information system or the nonpublic information stored on an information system, except that a “cybersecurity event” does not include any of the following:

SB160,4,5 (a) The unauthorized acquisition of encrypted nonpublic information if the encryption process or key is not also acquired, released, or used without authorization.

SB160,4,8 (b) The unauthorized acquisition of nonpublic information if the licensee determines that the nonpublic information has not been used or released and has been returned to the licensee or destroyed.

SB160,4,10 (4) “Encrypted” means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.

SB160,4,13 (5) “Information security program” means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.

SB160,4,18 (6) “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of nonpublic information, as well as any specialized system, including an industrial or process controls system, telephone switching and private branch exchange system, and environmental control system.

SB160,4,23 (7) “Licensee” means a person licensed, authorized, or registered, or a person required to be licensed, authorized, or registered, under chs. 600 to 655, other than a purchasing or risk retention group that is chartered and licensed in another state or a person acting as an assuming insurer that is domiciled in another state or jurisdiction.

SB160,4,25 (8) “Multifactor authentication” means authentication through verification of at least 2 of the following types of authentication factors:

SB160,5,1 (a) Knowledge factor, including a password.

SB160,5,2 (b) Possession factor, including a token or text message on a mobile phone.

SB160,5,3 (c) Inherence factor, including a biometric characteristic.

SB160,5,6 (9) “Nonpublic information” means electronic information in the possession, custody, or control of a licensee that is not publicly available information and is any of the following:

SB160,5,8 (a) Information concerning a consumer that can be used to identify the consumer, in combination with at least one of the following data elements:

SB160,5,9 1. Social security number.

SB160,5,10 2. Driver's license number or nondriver identification card number.

SB160,5,11 3. Financial account number or credit or debit card number.

SB160,5,13 4. Security code, access code, or password that permits access to a financial account.