Law / United States / 
Delaware
Insurance Data Security Act: notification of a cybersecurity event
Del. Code Ann. tit. 18, § 8606
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
As of .
What it requires
- If you are a licensee under the Delaware Insurance Code, notify the Insurance Commissioner as promptly as possible, and no later than 3 business days after you determine that a cybersecurity event has occurred, where you are an insurer domiciled in Delaware or a producer whose home state is Delaware and the event results in a reasonable likelihood of materially harming a consumer or a material part of your normal operation or you must give notice to a government body, self-regulatory agency or other supervisory body under state or federal law, or where you reasonably believe the nonpublic information involved is about 250 or more consumers and the event requires such notice or has a reasonable likelihood of materially harming a consumer or a material part of your operations.
- Give the Commissioner the notice in the form the Commissioner directs, update and supplement it for material changes, and provide as much as possible of the information section 8606(b)(2) lists, including the date and cause of the event, the types of information acquired, the number of consumers in Delaware affected, the results of your internal review, your remediation efforts, a copy of your privacy policy and a statement of the steps you will take to investigate and notify consumers.
- Where the event has a reasonable likelihood of materially harming a consumer and you must notify the Commissioner, notify each affected consumer without unreasonable delay and no later than 60 days after you determine that the event occurred, subject to the exceptions in section 8606(c)(1), and send the Commissioner a copy of the notice.
- If the event includes a Social Security number, offer each consumer whose nonpublic information was breached, or is reasonably believed to have been breached, credit monitoring services at no cost for 1 year, with the information needed to enroll and on how to place a credit freeze, unless an appropriate investigation reasonably shows the event is unlikely to result in harm to the consumer.
- Treat an event in a system a third-party service provider maintains as your own event unless the provider notifies the Commissioner, with your deadline running from the first business day after the provider notifies you or you otherwise have actual knowledge of the event.
- If you are an assuming insurer and the event involves nonpublic information you use or hold without a direct contractual relationship with the affected consumer, notify your affected ceding insurers and the Commissioner of your state of domicile within 3 business days of determining that an event has occurred. If you are an insurer and consumer notice is required for an event involving a consumer who reached you through an independent producer, notify the producers of record reasonably concurrently with the consumer notice.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 8610 makes a licensee that violates the chapter subject to penalties under section 329 of title 18. Under section 329 the Commissioner may, after notice and hearing, impose an administrative penalty that is reasonable and appropriate, not exceeding $50,000 per violation for insurance companies, insurance holding companies and all other persons licensed under the title, and $15,000 per violation for those licensed under chapter 17.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
Insurance Commissioner of Delaware, who may examine and investigate a licensee and take necessary or appropriate action to enforce the chapter (18 Del. C. section 8607).
What this law does
A licensee must notify the Insurance Commissioner as promptly as possible, and no later than 3 business days after determining that a cybersecurity event has occurred, if either of the two criteria in section 8606(a) has been met. The second criterion in section 8606(a) of title 18 is met where the licensee reasonably believes the nonpublic information involved is about 250 or more consumers and the event meets one of two further conditions.
A licensee must notify each affected consumer without unreasonable delay and no later than 60 days after determining that the event occurred, where the event has a reasonable likelihood of materially harming a consumer and is one for which notice to the Commissioner is required. If a cybersecurity event includes a Social Security number, the licensee must offer each affected consumer credit monitoring services at no cost for a period of 1 year.
A licensee acting as an assuming insurer must notify its affected ceding insurers and the Commissioner of its state of domicile within 3 business days of determining that a cybersecurity event has occurred, where the event involves nonpublic information the assuming insurer uses or holds without a direct contractual relationship with the affected consumer.
Chapter 86 of title 18 establishes the exclusive state standards for data security and for the investigation of, and notification to, the Commissioner and consumers when a cybersecurity event involving a licensee occurs. Chapter 86 of title 18 may not be construed to create or imply a private cause of action for a violation of its provisions. A licensee that violates chapter 86 of title 18 may be subject to penalties under section 329 of title 18.
The Insurance Commissioner may impose an administrative penalty of up to $50,000 per violation on an insurance company or other person licensed under title 18 of the Delaware Code that violates a provision of that title.
When LexLint raises it
When your app profile says your app is an insurer.