Law / United States / 
Connecticut
Insurance Data Security Law: notice of a cybersecurity event to the Insurance Commissioner
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- If you are a licensee under the Connecticut insurance laws, notify the Insurance Commissioner as promptly as possible, and no later than three business days after you first determine that a cybersecurity event has occurred, when you are an insurer domiciled in Connecticut or a producer whose home state is Connecticut and the event is reasonably likely to materially harm a Connecticut consumer or a material part of your normal operations (section 38a-38(e)(1)(A)).
- Give the same notice when you reasonably believe the nonpublic information involved in a cybersecurity event is of 250 or more Connecticut consumers and state or federal law requires notice to a government body or supervisory body, or the event is reasonably likely to materially harm a Connecticut consumer or a material part of your normal operations (section 38a-38(e)(1)(B)).
- In an electronic form the commissioner prescribes, give as much as possible of the information section 38a-38(e)(2)(A) lists, including the date and discovery of the event, how the information was exposed, the types of information involved, the number of affected Connecticut consumers, the results of an internal review, remediation efforts, a copy of your privacy policy and a contact person, and keep updating and supplementing it (section 38a-38(e)(2)).
- Comply with section 36a-701b on notice to consumers and give the commissioner a copy of the notice you send consumers, if you are required to notify the commissioner (section 38a-38(e)(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 38a-38(f)(3)(B): after a hearing the Insurance Commissioner may, in addition to or in lieu of suspending, revoking or refusing to reissue or renew a license, impose a civil penalty of not more than $50,000 for each violation of section 38a-38, and may bring a civil action to recover it.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
Connecticut Insurance Commissioner, who may examine and investigate a licensee, hold a hearing on thirty days' notice and take any action necessary or appropriate to enforce the section (section 38a-38(f)).
Settledness
- As of
What this law does
Under section 38a-38, a licensee is any person licensed, authorized to operate or registered, or required to be licensed, authorized to operate or registered, under the insurance laws of Connecticut. Each licensee must notify the Insurance Commissioner that a cybersecurity event has occurred as promptly as possible and no later than three business days after first determining that it has occurred, in the circumstances section 38a-38(e)(1) describes.
Under section 38a-38, notice is also due when the licensee reasonably believes the nonpublic information involved is of 250 or more Connecticut consumers and the other conditions of subparagraph (B) are met. Under section 38a-38, a licensee that notifies the commissioner must provide as much as possible of the listed information in an electronic form the commissioner prescribes and has a continuing obligation to update and supplement it.
Under section 38a-38, the licensee must comply with section 36a-701b on notice to consumers and give the commissioner a copy of the consumer notice, if it is required to notify the commissioner. After a hearing the commissioner may impose a civil penalty of not more than $50,000 for each violation of section 38a-38.
Public Act 21-157, effective , changed the deadline in section 38a-38(e)(1) to run from the date on which the licensee first determines that a cybersecurity event has occurred. Public Act 19-196 changed the effective date of section 38a-38, added by Public Act 19-117, from , to .
When LexLint raises it
When your app profile says your app is an insurer.