Law / United States / 
Connecticut
Insurance Data Security Law: records of each cybersecurity event kept five years and produced on demand
Conn. Gen. Stat. § 38a-38(d)(4)
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a licensee under the Connecticut insurance laws and learn that a cybersecurity event has, or may have, occurred, maintain records concerning each cybersecurity event for at least five years from the date of the event (section 38a-38(d)(4)).
- Produce those cybersecurity event records to the Insurance Commissioner upon the commissioner's demand (section 38a-38(d)(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 38a-38(f)(3)(B): after a hearing the Insurance Commissioner may, in addition to or in lieu of suspending, revoking or refusing to reissue or renew a license, impose a civil penalty of not more than $50,000 for each violation of section 38a-38, and may bring a civil action to recover it.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
Connecticut Insurance Commissioner, who may examine and investigate a licensee under section 38a-38(f).
What it makes you log
Who may demand the log
Regulator
Log retention
Subdivision (d)(4) sets a period of at least five years from the date of the cybersecurity event and states no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Subdivision (d)(4) requires each licensee subject to subsection (d) to maintain records concerning each cybersecurity event for at least five years from the date of the event, and to produce them to the Insurance Commissioner upon demand. The subdivision names no field of the record from the closed list. The duty follows an investigation duty that starts when a licensee learns that an event has, or may have, occurred. Subsection (e), cited by a separate row, adds notice duties and keeps no record of its own.
- Kind
- Explicit
- As of
- Provision
- Conn. Gen. Stat. sec. 38a-38(d)(4), records of each cybersecurity event
- Trigger
- security_incident
What this law does
Section 38a-38(d)(4) requires each licensee subject to subsection (d) to maintain records concerning each cybersecurity event for a period of at least five years from the date of the event. The licensee must produce those records to the Insurance Commissioner upon demand by the commissioner.
Subsection (d) applies when a licensee learns that a cybersecurity event has, or may have, occurred, and it requires a prompt investigation by the licensee or by an outside vendor or service provider designated to act on its behalf. Under section 38a-38, a licensee is any person licensed, authorized to operate or registered, or required to be licensed, authorized to operate or registered, under the insurance laws of Connecticut.
The Insurance Commissioner has power to examine and investigate into the affairs of a licensee to determine whether the licensee is, or has been, engaged in conduct in this state that violates section 38a-38. After a hearing the commissioner may impose a civil penalty of not more than $50,000 for each violation of section 38a-38. Public Act 19-196 changed the effective date of section 38a-38, added by Public Act 19-117, from , to .
When LexLint raises it
When your app profile says your app is an insurer.