Law / United States / 
Alabama
Insurance Data Security Law: notice of a cybersecurity event to the Commissioner of Insurance
Insurance Data Security Law, Ala. Code sec. 27-62-6
In force.
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- As an insurance licensee, notify the Commissioner of Insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, where Alabama is your state of domicile (an insurer) or home state (a producer) and the event has a reasonable likelihood of materially harming an Alabama consumer or any material part of your normal operation.
- Give the same notice where you reasonably believe the nonpublic information involves 250 or more Alabama consumers and the event is one you must report to a government body, self-regulatory agency or other supervisory body under state or federal law, or is reasonably likely to materially harm an Alabama consumer or any material part of your normal operation.
- Give the Commissioner, in electronic form as the Commissioner directs, as much as possible of: the date of the event; how the information was exposed, lost, stolen or breached, including the roles of third-party service providers; how it was discovered; whether it was recovered; the source of the event; any police report or notice to regulators or law enforcement; the specific types of information acquired; the period the system was compromised; your best estimate of the number of affected Alabama consumers, updated with each report; the results of your internal review of controls and procedures; your remediation efforts; a copy of your privacy policy and your plan to investigate and notify affected consumers; and a contact person.
- Keep updating and supplementing the notice for material changes to the information you provided.
- Comply with the Alabama Data Breach Notification Act of 2018, as applicable, and give the Commissioner a copy of the notice sent to consumers.
- When the event occurs in a system maintained by a third-party service provider, treat it as your own event unless the provider gives the Commissioner the notice; your deadlines begin the day after the provider notifies you or you otherwise have actual knowledge, whichever is sooner.
- As an assuming insurer, notify your affected ceding insurers and the Commissioner of your state of domicile within three business days of determining that an event occurred or of receiving notice from your third-party service provider; ceding insurers with a direct contractual relationship with affected consumers give the consumer notices under the Alabama Data Breach Notification Act of 2018.
- As an insurer whose consumer reached your services through an independent insurance producer, notify the producers of record of all affected consumers no later than the time you give notice to the consumers, where consumer notice is required by the Alabama Data Breach Notification Act of 2018.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 27-62-10(b): a licensee other than a producer may be subject to suspension or revocation of its license or certificate of authority or, in lieu of that and at the Commissioner's discretion, a fine of up to $10,000 per violation. Section 27-62-10(a) sends an insurance producer to section 27-7-19.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Alabama Commissioner of Insurance, who may examine and investigate any licensee (section 27-62-7(a)) and take action necessary or appropriate to enforce the chapter (section 27-62-7(b)).
What this law does
A licensee is a person licensed, authorized to operate, or registered, or required to be, under Alabama insurance law, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state.
Each licensee must notify the Commissioner of Insurance as promptly as possible, and in no event later than three business days from a determination that a cybersecurity event involving nonpublic information in its possession has occurred, when either of two statutory criteria is met.
Under section 27-62-6(a)(1), the notice duty applies where Alabama is the insurer's state of domicile or the producer's home state and the event has a reasonable likelihood of materially harming an Alabama consumer or a material part of the licensee's normal operation.
Under section 27-62-6(a)(2), the notice duty also applies where the licensee reasonably believes the nonpublic information involves 250 or more Alabama consumers and the event must be reported to a government body or supervisory body under other law or is reasonably likely to materially harm an Alabama consumer or a material part of its operation.
A licensee giving notice under section 27-62-6 must give the Commissioner, in electronic form as the Commissioner directs, as much as possible of a list of items that includes the date of the event, how the information was exposed, and the number of affected Alabama consumers. A licensee must also comply with the Alabama Data Breach Notification Act of 2018, as applicable, and give the Commissioner a copy of the notice sent to consumers under that law.
A licensee that becomes aware of an event in a system maintained by a third-party service provider must treat the event as its own unless the provider gives the Commissioner the notice. A licensee other than a producer that violates the Insurance Data Security Law may be subject to suspension or revocation of its license or certificate of authority or, in lieu of that, a fine of up to $10,000 per violation.
An insurance producer that violates the Insurance Data Security Law may be penalized in accordance with section 27-7-19. The Insurance Data Security Law may not be construed to create or imply a private cause of action for a violation, or to curtail a private cause of action that would otherwise exist.
The Insurance Data Security Law establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, and notification to the Commissioner of Insurance of a cybersecurity event. The Commissioner of Insurance may examine and investigate the affairs of any licensee to determine whether the licensee has engaged in conduct that violates the Insurance Data Security Law.
When LexLint raises it
When your app profile says your app is an insurer.