Law / United States / 
Illinois
Insurance Data Security Law, investigation and notification of a cybersecurity event
Insurance Data Security Law, 215 ILCS 215/15 and 215/20
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a licensee under Illinois insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Illinois, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
- Notify the Director of Insurance as promptly as possible, and no later than 3 business days after you determine that a cybersecurity event has occurred, when Illinois is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming any consumer residing in Illinois or any material part of your normal operations.
- Notify the Director within the same 3 business days when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Illinois and the event requires notice to a government body, self-regulatory agency or other supervisory body under state or federal law or has a reasonable likelihood of that harm.
- Give the Director as much as possible of the 13 listed items of information, in electronic form as the Director directs, and keep updating and supplementing the notification as material changes occur.
- Conduct a prompt investigation when you learn that a cybersecurity event has occurred or may have occurred, and keep records of every cybersecurity event for at least 5 years from the date of the event, producing them on the Director's demand.
- Give the Director a copy of the notice sent to consumers under the Personal Information Protection Act when you must notify the Director.
- Treat a cybersecurity event in a system maintained by a third-party service provider as you would one in your own system, unless the provider gives the Director the notice; as an assuming insurer, notify your affected ceding insurers and the Director of your state of domicile within 3 business days.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Director of Insurance, who may take any action necessary or appropriate to enforce the Act when the Director has reason to believe a licensee has violated it (section 25(b)).
What this law does
Section 20 of the Insurance Data Security Law requires a licensee to notify the Director as promptly as possible but no later than 3 business days after a determination that a cybersecurity event has occurred when either of two criteria is met.
The first criterion is that Illinois is the licensee's state of domicile, in the case of an insurer, or home state, in the case of an insurance producer, and the cybersecurity event has a reasonable likelihood of materially harming any consumer residing in Illinois or any material part of the normal operations of the licensee.
The second criterion is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in Illinois and the event requires notice to a government body, self-regulatory agency, or other supervisory body under state or federal law or has a reasonable likelihood of materially harming a consumer or a material part of the licensee's normal operations.
A licensee must provide as much as possible of 13 listed items of information, from the date of the cybersecurity event to the name of a contact person who is familiar with the event and authorized to act for the licensee. A licensee has a continuing obligation to update and supplement initial and subsequent notifications to the Director regarding material changes to previously provided information.
A licensee must conduct a prompt investigation if it learns that a cybersecurity event has occurred or may have occurred. A licensee must maintain records concerning all cybersecurity events for a period of at least 5 years from the date of the cybersecurity event and produce those records upon demand of the Director. A licensee must provide the Director a copy of the notice sent to consumers under the Personal Information Protection Act when the licensee is required to notify the Director.
A licensee that becomes aware of a cybersecurity event in a system maintained by a third-party service provider must treat the event as it would under the notification subsection unless the provider gives the Director the notice. A violation of the Act may be penalized in accordance with the provisions of the Illinois Insurance Code, including Section 403A of the Illinois Insurance Code. The Act takes effect .
When LexLint raises it
When your app profile says your app is an insurer.