Law / United States / 
Alaska
Insurance Data Security, investigation and notification of a cybersecurity event
Alaska Stat. secs. 21.23.270 and 21.23.280 (Insurance Data Security)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- Applies to a licensee of the Alaska Division of Insurance, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be licensed, authorized or registered, under Title 21 of the Alaska Statutes, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction. The notice duty reaches an insurer domiciled in Alaska and an insurance producer whose home state is Alaska, and any other licensee that reasonably believes a cybersecurity event involves the nonpublic information of 250 or more Alaska consumers and either affects it and must be reported to a government agency under state or federal law or has a reasonable likelihood of materially harming an Alaska consumer or a material part of its normal operation. A licensee subject to the Health Insurance Portability and Accountability Act of 1996 that maintains and complies with a program under that Act and certifies this in writing to the director is outside the article.
- When you become aware that a cybersecurity event has or may have occurred, promptly investigate it, or have an outside vendor or third-party service provider designated to act for you do so, and to the extent possible assess its nature and scope, identify the nonpublic information involved, and restore the security of the compromised information systems; if the event is in a system a third-party service provider maintains, complete those steps or confirm and document that the provider has.
- Keep records concerning all cybersecurity events for at least five years from the date of each event and produce them at the request of the director.
- Notify the director as soon as possible and not later than three business days after you determine that a cybersecurity event has occurred, unless a federal law enforcement official instructs you not to distribute information about it, in the form and format the director prescribes, with the date of the event, how nonpublic information was exposed, how the event was discovered, the number of Alaska consumers affected, the results of your internal review, your remediation efforts, your privacy policy and a contact person, among the other items listed in the section.
- Update and supplement the notice in the form, format and frequency the director prescribes, and give the director a copy of any consumer notice you send under the Alaska Personal Information Protection Act.
- If the event is in an information system a third-party service provider maintains, count your three business days from the day after the provider notifies you or the day after you have actual knowledge of the event, whichever is earlier, unless the provider notifies the director itself.
- If you are an assuming insurer without a direct contractual relationship with an affected consumer, notify your affected ceding insurers and the insurance supervisory official of your state of domicile not later than three business days after you determine that a cybersecurity event has occurred, or after your third-party service provider notifies you of one.
- If you are an insurer, notify each independent insurance producer of record of an affected consumer as soon as possible, in the form and format the director prescribes, where the consumer accessed your services through that producer and you have the current producer of record information.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
AS 21.27.440(a) lets the director impose a civil penalty of not more than $10,000 for each violation, or not more than $25,000 for each violation found wilful, in addition to a civil penalty equal to the compensation promised, paid or to be paid for the violation and denial, nonrenewal, suspension or revocation of a license. The $25,000 figure is the higher tier.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Who enforces it
Enforcement body
The director, who may take necessary or appropriate action to enforce the article (AS 21.23.310(a)).
What this law does
A licensee that becomes aware that a cybersecurity event has or may have occurred must promptly investigate it, or have an outside vendor or third-party service provider designated to act for it do so. A licensee must keep records concerning all cybersecurity events for at least five years from the date of the event and produce them at the request of the director.
A licensee must notify the director as soon as possible and not later than three business days after it determines that a cybersecurity event has occurred, unless a federal law enforcement official instructs it not to distribute information about the event.
The duty applies if the licensee is an insurer domiciled in Alaska, is an insurance producer whose home state is Alaska, or reasonably believes the event involves the nonpublic information of 250 or more consumers residing in Alaska and either affects the licensee and must be reported to a government agency under state or federal law or has a reasonable likelihood of materially harming an Alaska consumer or a material part of the licensee's normal operation.
The notice must include, to the greatest extent possible and in the form and format the director prescribes, the date of the event, how nonpublic information was exposed, how the event was discovered, the number of consumers affected and a contact person, among other listed items. After giving notice, the licensee must update and supplement the information it provided, in the form, format and frequency the director prescribes.
A licensee that is required to notify the director and is also required to give notice under the Alaska Personal Information Protection Act must give the director a copy of the notice sent to consumers. Where a cybersecurity event affects an information system maintained by a third-party service provider, the licensee's time to notify the director begins the day after the provider notifies it or the day after it has actual knowledge of the event, whichever is earlier.
A licensee acting as an assuming insurer that determines that a cybersecurity event has occurred must notify its affected ceding insurers and the insurance supervisory official of its state of domicile not later than three business days after the determination, where the event involves nonpublic information it uses or controls and it has no direct contractual relationship with an affected consumer.
A licensee that is an insurer must notify each independent insurance producer of record of an affected consumer as soon as possible, in the form and format the director prescribes, if the consumer accessed the insurer's services through that producer and the insurer has the current producer of record information.
The article does not apply to a licensee subject to the Health Insurance Portability and Accountability Act of 1996 that maintains and complies with a program under that Act and certifies this to the director in writing. A person who violates the article is subject to the penalties provided under AS 21.27.440.
When LexLint raises it
When your app profile says your app is an insurer.