Law / United States / 
Iowa
Insurance Data Security Act: notice of a cybersecurity event to the Commissioner of Insurance
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
As of .
What it requires
- As an insurance licensee, notify the Commissioner of Insurance no later than three business days after you confirm a cybersecurity event if you are a domiciled insurer or a producer whose home state is Iowa and a law requires notice to a government body, self-regulatory agency or other supervisory body or the event has a reasonable likelihood of causing material harm to a material part of your normal business, operations or security (Iowa Code 507F.7(1)(a)).
- Notify the Commissioner within the same three business days if you reasonably believe the nonpublic information compromised involves 250 or more consumers and either a law requires notice to a government body, self-regulatory agency or other supervisory body or the event has a reasonable likelihood of causing material harm to a consumer or to a material part of your business, operations or security (507F.7(1)(b)).
- In the notice, give as much as is available of the information 507F.7(2) lists, including the date and time of the event, how the nonpublic information was exposed, the number of consumers affected, the results of any internal review, your remediation efforts, a copy of your privacy policy and your contact person.
- Update and supplement the notice to the Commissioner as material changes to the information occur (507F.7(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 507B.7(1)(a) lets the Commissioner of Insurance, after hearing, order a civil penalty of not more than $1,000 for each act or violation, up to an aggregate of $10,000, or, if the person knew or reasonably should have known of the violation, not more than $5,000 for each act or violation, up to an aggregate of $50,000 in any one six-month period. The Commissioner may also suspend or revoke the license of a person who knew or reasonably should have known of the violation (section 507B.7(1)(b)).
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Iowa Commissioner of Insurance, who may adopt rules to administer chapter 507F and take any enforcement action under the Commissioner's authority (Iowa Code 507F.15).
What this law does
Section 507F.7 of the Iowa Code requires a licensee to notify the commissioner of insurance no later than three business days from the date of the licensee's confirmation of a cybersecurity event if a listed condition applies. Section 507F.7(1)(b) reaches a licensee that reasonably believes that nonpublic information compromised by the cybersecurity event involves 250 or more consumers.
Section 507F.7(2) requires the notice to the commissioner to provide, in the form and manner the commissioner prescribes by rule, as much of the listed information as is available to the licensee at the time of the notification. Section 507F.7(3) gives the licensee a continuing obligation to update and supplement the initial notification to the commissioner as material changes to information previously provided occur.
In chapter 507F, a licensee is a person licensed, authorized to operate, or registered, or required to be licensed, authorized to operate, or registered, under the insurance laws of Iowa.
Section 507F.13 exempts a licensee that is subject to and in compliance with the Health Insurance Portability and Accountability Act, which must annually certify its compliance to the commissioner, and a licensee owned or controlled by a federally insured depository institution that complies with the Gramm-Leach-Bliley Act or comparable federal law. Section 507F.14 subjects a licensee that violates chapter 507F to penalties under section 505.7A and chapter 507B of the Iowa Code.
Section 507F.2 provides that chapter 507F is not to be construed to create or imply a private cause of action for a violation of its provisions. Chapter 79 of the 2021 Acts, House File 719, added chapter 507F, the Insurance Data Security Act, to the Iowa Code.
When LexLint raises it
When your app profile says your app is an insurer.