Law / United States / 
Minnesota
Insurance data security law: records of cybersecurity events, kept five years and produced on the commissioner's demand
Minn. Stat. § 60A.9852, subd. 4
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a licensee of the Department of Commerce or the Department of Health, maintain records concerning all cybersecurity events for at least five years from the date of the cybersecurity event, and produce those records upon demand of the commissioner (section 60A.9852, subdivision 4).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation; sections 60A.9857 and 60A.052 point a violator of the insurance data security sections to it.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The commissioner of commerce or the commissioner of health, who may take action that is necessary or appropriate to enforce sections 60A.985 to 60A.9857.
What it makes you log
Who may demand the log
Regulator
Log retention
Subdivision 4 sets at least five years from the date of the cybersecurity event; the sentence states no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Subdivision 4 requires a licensee to maintain records concerning all cybersecurity events for at least five years from the date of the cybersecurity event and to produce those records upon demand of the commissioner. The sentence names no field of the record from the closed list, so no contents are taken. The commissioner's demand is the check, and the sentence states no audit schedule and no report. Section 60A.9855, subdivision 4, which keeps the documents disclosed to the commissioner for five years, is a separate row, and the commissioner's examination power is in section 60A.9854, which this row does not cite. The licensee definition in section 60A.985, subdivision 8 reaches a person licensed, authorized or registered by the Department of Commerce or the Department of Health, which sets the hook.
- Kind
- Explicit
- As of
- Provision
- Minn. Stat. sec. 60A.9852, subd. 4, records concerning all cybersecurity events
- Trigger
- security_incident
What this law does
Under section 60A.9852, subdivision 4, a licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event and must produce those records upon demand of the commissioner. A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered by the Department of Commerce or the Department of Health under the chapters section 60A.985 lists.
A licensee that violates sections 60A.985 to 60A.9856 may be penalized in accordance with section 60A.052. Section 60A.052 lets the commissioner impose a civil penalty as provided for in section 45.027, subdivision 6. Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation upon a person who violates any law, rule or order related to the commissioner's duties unless a different penalty is specified. The session law that enacted the section makes it effective .
When LexLint raises it
When your app profile says your app is an insurer.