Law / United States / 
Kentucky
Insurance Data Security Law: licensee notice of a cybersecurity event to the Commissioner of Insurance
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Reporting, Breach notice
As of .
What it requires
- If you are an insurer domiciled in Kentucky, an insurance producer whose home state is Kentucky, or a licensee that reasonably believes a cybersecurity event involves nonpublic information of 250 or more Kentucky consumers and requires notice to a governmental body or is reasonably likely to materially harm a consumer or your operations, notify the Commissioner of Insurance of the event as promptly as possible and no later than three business days from your determination that it occurred (KRS 304.3-760(1)).
- Give the Commissioner, in the electronic form it prescribes, the information subsection (2) lists, including the date and discovery of the event, how the information was exposed, the types of information acquired, the period of compromise, the results of your internal review, your remediation efforts, a copy of your privacy policy, and a contact person, and keep updating and supplementing the notice (KRS 304.3-760(2)).
- Comply with KRS 365.732 as applicable (KRS 304.3-760(3)).
- Treat a cybersecurity event in a system maintained by a third-party service provider as you would your own, counting your deadlines from the earlier of the day after the provider notifies you or the day you otherwise have actual knowledge (KRS 304.3-760(4)).
- If you are an assuming insurer with no direct contractual relationship with the affected consumers, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that an event occurred or of receiving notice from your third-party service provider (KRS 304.3-760(6)).
- If you are an insurer and a consumer accessed your services through an independent insurance producer, notify the producers of record at the same time as the affected consumers when you must notify consumers under KRS 365.732, unless you lack the current producer of record information for a consumer (KRS 304.3-760(7)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
KRS 304.99-020(1): the Commissioner of Insurance may impose, in lieu of or in addition to revoking or suspending a license or certificate of authority, a civil penalty of not more than $10,000 per violation for an insurer, fraternal benefit society, nonprofit hospital, medical-surgical, dental and health service corporation or health maintenance organization, $1,000 for an agent, surplus lines broker, rental vehicle agent or reinsurance intermediary, and $2,000 for an adjuster, administrator, life settlement broker or provider, or consultant. The insurer ceiling is recorded as per_violation_amount. KRS 304.3-768 applies KRS 304.99-020 to a violation of KRS 304.3-750 to 304.3-768.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Kentucky Commissioner of Insurance, who may examine and investigate a licensee for a violation of KRS 304.3-756, 304.3-758 or 304.3-760 and may take action necessary or appropriate to enforce them (KRS 304.3-762).
What this law does
Each licensee must notify the commissioner of a cybersecurity event involving nonpublic information in the licensee's possession as promptly as possible, but in no event later than three business days from a determination that a cybersecurity event has occurred, if the licensee is an insurer domiciled in Kentucky and the event has a reasonable likelihood of harming any material part of its normal operations, if the licensee is an insurance producer whose home state is Kentucky, or if the licensee reasonably believes that the nonpublic information relates to 250 or more consumers residing in Kentucky and the event requires notice to a governmental body, self-regulatory agency or other supervisory body or has a reasonable likelihood of materially harming a consumer residing in Kentucky or a material part of the licensee's normal operations.
The notification must be given in an electronic form the commissioner prescribes and must include the date of the event, how the information was exposed, how the event was discovered, the types of information acquired, the period during which the system was compromised, the results of any internal review, a description of the remediation efforts, a copy of the licensee's privacy policy and a contact person, and the licensee has a continuing obligation to update and supplement it.
A licensee must comply with KRS 365.732 as applicable. For an event in a system maintained by a third-party service provider, the licensee treats the event as it would its own, and its deadlines begin on the earlier of the day after the provider notifies it or the day it otherwise has actual knowledge.
An assuming insurer that has no direct contractual relationship with the affected consumers must notify its affected ceding insurers and the commissioner of its state of domicile within three business days. An insurer must notify the producers of record at the same time as affected consumers when it must notify consumers under KRS 365.732, unless it lacks current producer of record information for a consumer.
A licensee with fewer than fifty employees, including independent contractors, is exempt from KRS 304.3-750 to 304.3-768.
A licensee is deemed in compliance with KRS 304.3-750 to 304.3-768 if it is subject to, governed by and compliant with the federal health privacy, security and breach notification rules and maintains nonpublic information in the same manner as protected health information, or is a financial institution compliant with the federal financial privacy, security and breach notification standards, and in either case submits an annual written statement certifying compliance and a copy of the breach notification it gives. The section took effect on .
When LexLint raises it
When your app profile says your app is an insurer.