Is an insurer, in Wisconsin

Insurance Data Security Law cybersecurity event notice, Wis. Stat. secs. 601.953 and 601.954(1) · Read the law's page

• Applies to a licensee under Wisconsin insurance law, which you declare by stating that you are an insurer: a person licensed, authorized, or registered, or required to be, under chapters 600 to 655 of the Wisconsin Statutes, other than a purchasing or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state or jurisdiction.
• A cybersecurity event is an event resulting in unauthorized access to, or disruption or misuse of, an information system or the nonpublic information stored on it, and nonpublic information means electronic information only. It does not include unauthorized acquisition of encrypted nonpublic information when the encryption process or key is not also acquired, released, or used without authorization, or unauthorized acquisition that you determine left the information unused and unreleased and returned to you or destroyed.
• Notify the commissioner of Insurance in electronic form, as promptly as possible and no later than 3 business days after you determine that a cybersecurity event involving nonpublic information has occurred, if you are domiciled in Wisconsin and the event has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
• Give the same notice within the same 3 business days if you reasonably believe the event involves the nonpublic information of at least 250 consumers (individuals who reside in Wisconsin and whose nonpublic information you hold) and either requires notice to a government body, self-regulatory agency, or other supervisory entity under state or federal law or has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
• Give the commissioner as much as possible of the ten listed items, from the date and source of the event and how it was discovered to the number of consumers affected, your efforts to address the circumstances, a copy of your privacy policy, and a contact person, and update and supplement them as additional information becomes available.
• Conduct a prompt investigation when you learn that a cybersecurity event has or may have occurred: assess its nature and scope, identify the nonpublic information involved, and take reasonable measures to restore the security of the compromised systems.
• Where the event is in a system maintained by a third-party service provider, comply with the investigation duty or make reasonable efforts to confirm and document that the provider complied or failed to cooperate.
• If you know of a cybersecurity event involving nonpublic information in a system maintained by a third-party service provider and a notice condition in section 601.954(1)(a) is met, notify the commissioner no later than 3 days after the earlier of the provider telling you of the event or your having actual knowledge of it, unless the provider itself gives notice under section 601.954(1).
• If you act as an assuming insurer with no direct contractual relationship with the affected consumers and a notice condition in section 601.954(1)(a) is met, notify the ceding insurer and the commissioner of your state of domicile no later than 3 business days after learning of the event, whether it is in your systems or a provider's; you have no other notice obligation relating to the event or a data breach under this section or any other Wisconsin law. A ceding insurer with a direct contractual relationship with the affected consumers must comply with the section's notification requirements.
• Give the commissioner a form of any notice you send to consumers, consumer reporting agencies, or producers of record under section 601.954(2).
• Keep records concerning a cybersecurity event for at least 5 years from the date of the event and produce them on the commissioner's demand.
• A licensee governed by 45 CFR Parts 160 and 164 that maintains nonpublic information in the same manner as protected health information is exempt from the rest of the subchapter but remains bound by the notice to the commissioner in section 601.954(1).
• The deemed-compliance routes in section 601.951(2)(a) to (c), for a licensee affiliated with a depository institution, a broker or dealer, or a farm credit entity that maintains a qualifying program, or covered by another licensee's program, also reach this notice duty on their stated conditions; if you stop qualifying you have 180 days to comply.

Insurance Data Security Law information security program, Wis. Stat. sec. 601.952 · Read the law's page

• Applies to a licensee under Wisconsin insurance law, which you declare by stating that you are an insurer: a person licensed, authorized, or registered, or required to be, under chapters 600 to 655 of the Wisconsin Statutes, other than a purchasing or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state or jurisdiction.
• Section 601.951(1) makes this subchapter the exclusive state standard for a licensee's data security, investigation of a cybersecurity event, and notice of a cybersecurity event or unauthorized access to nonpublic information to the state government and consumers.
• Develop, implement, and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical, and physical safeguards for your information systems and nonpublic information; this has applied since November 1, 2022.
• Conduct a risk assessment that identifies reasonably foreseeable internal and external threats, including threats to nonpublic information held by your third-party service providers, and design the program to mitigate them in proportion to your size and complexity, the nature and scope of your activities, and the sensitivity of the nonpublic information.
• Implement the security measures that are appropriate, including access controls, restricted physical access to nonpublic information, encryption or other protection of nonpublic information transmitted over an external network or stored on a portable device, secure development practices for applications you develop in-house, regular testing and monitoring for attacks and intrusions, audit trails, and secure disposal of nonpublic information.
• Designate at least one employee, affiliate, or outside vendor as responsible for the program, assess the effectiveness of your security safeguards at least annually, and give personnel cybersecurity awareness training.
• Monitor, evaluate, and adjust the program as technology, the sensitivity of the nonpublic information, threats, and your business operations, outsourcing arrangements, and information systems change; document any area, system, or process you find needs material improvement, updating, or redesign and your remedial efforts, keep that documentation for at least 5 years, and produce it on the commissioner's demand.
• Develop a written incident response plan to respond to and recover from a cybersecurity event, covering its goals, the internal response process, roles and decision-making authority, communications, remediation of weaknesses, reporting and documentation, and revision after an event.
• Exercise due diligence when selecting a third-party service provider, and make reasonable efforts to require it to protect your information systems and nonpublic information and to report a cybersecurity event under section 601.954; this has applied since November 1, 2023.
• If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement, and maintain the program, and receive a report from management at least annually on the status of the program, material matters, and recommended changes.
• If you are domiciled in Wisconsin, submit to the commissioner by March 1 each year a written certification that you comply with section 601.952, and keep the supporting records for at least 5 years.
• A licensee with less than $10,000,000 in year-end total assets, less than $5,000,000 in gross annual revenue, or fewer than 50 employees (including independent contractors who work at least 30 hours a week) is exempt from this section, and a licensee that stops qualifying must comply within 180 days.
• You are treated as meeting the subchapter if you are affiliated with a depository institution, a broker or dealer, or a farm credit entity that maintains an information security program meeting its own regime (the interagency guidelines under 15 USC 6801 and 6805, the financial industry regulatory authority's requirements, or the farm credit administration's guidance and regulations), and you produce on the commissioner's request documentation satisfactory to the commissioner that independently validates that program. The subchapter also does not apply to a licensee covered by another licensee's program to the extent the other licensee complied on its behalf. If you stop qualifying for any of those exceptions or the federal health privacy exception, you have 180 days to comply.

Disposal of records containing personal information, Wis. Stat. sec. 134.97 · Read the law's page

• Applies to a financial institution (a bank, savings bank, savings and loan association or credit union authorized to do business under state or federal law, any issuer of a credit card, or any investment company), a medical business (any organization, for profit or not, that possesses information other than personnel records about a person's physical or mental health, medical history or medical treatment), and a tax preparation business (a for-profit organization that for a fee prepares or counsels on an individual's tax returns); you declare this by stating that you provide financial services or handle health records.
• Do not dispose of a record containing personal information (a record is any material on which written, drawn, printed, spoken, visual or electromagnetic information is recorded or preserved, regardless of physical form or characteristics, so electronic and other media are covered) unless you, or a person under contract with you, shred the record, erase the personal information, modify the record to make the personal information unreadable, or take actions you reasonably believe will ensure that no unauthorized person has access to the personal information between the record's disposal and its destruction.