Law / United States / 
Minnesota
Insurance data security law: notification of a cybersecurity event to the commissioner and to consumers
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- If you are a licensee of the Department of Commerce or the Department of Health, notify the commissioner who regulates you without unreasonable delay and no later than five business days from a determination that a cybersecurity event has occurred, when this state is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a Minnesota consumer or part of your normal operations, or when you reasonably believe the nonpublic information involved is of 250 or more Minnesota consumers and the event must be reported to another government or supervisory body or has a reasonable likelihood of that harm.
- Give the commissioner, in electronic form and as completely as possible, the information section 60A.9853, subdivision 2 lists (date of the event, how it happened and was discovered, the types of information acquired, the number of Minnesota consumers affected, the remediation under way and a contact person), and update and supplement the notice as material changes occur.
- If you are required to report to the commissioner, notify each Minnesota consumer whose nonpublic information was or is reasonably believed to have been acquired by an unauthorized person where there is a reasonable likelihood of material harm, in the most expedient time possible and without unreasonable delay, and send the commissioner a copy of the notice.
- Treat a cybersecurity event in a system maintained by a third-party service provider, of which you have become aware, as you would under subdivision 1 unless the provider gives the notice, counting your deadlines from the day after the provider notifies you or you otherwise have actual knowledge.
- If you are an assuming insurer with no direct contractual relationship with the affected consumers, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation; sections 60A.9857 and 60A.052 point a violator of the insurance data security sections to it.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The commissioner of commerce or the commissioner of health, who may take action that is necessary or appropriate to enforce sections 60A.985 to 60A.9857.
What this law does
Section 60A.9853 requires each licensee to notify the commissioner of commerce or commissioner of health, whichever otherwise regulates the licensee, without unreasonable delay and no later than five business days from a determination that a cybersecurity event has occurred when the section's criteria are met.
One of the criteria is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in Minnesota and that the event is one of which notice must be given to a government or supervisory body, or has a reasonable likelihood of materially harming a consumer or normal operations.
A licensee required to report to the commissioner must notify any consumer residing in Minnesota whose nonpublic information was or is reasonably believed to have been acquired by an unauthorized person where there is a reasonable likelihood of material harm, in the most expedient time possible and without unreasonable delay.
A licensee must treat a cybersecurity event in a system maintained by a third-party service provider, of which it has become aware, as it would under subdivision 1 unless the third-party service provider provides the notice. An assuming insurer must notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event involving nonpublic information has occurred.
A licensee is a person licensed, authorized to operate or registered, or required to be, by the Department of Commerce or the Department of Health under the chapters the section lists. A licensee subject to and in compliance with Health Insurance Portability and Accountability Act (HIPAA) is considered to comply with section 60A.9853, subdivisions 3 to 5 if it submits a written statement certifying its compliance with HIPAA. A licensee that violates sections 60A.985 to 60A.9856 may be penalized in accordance with section 60A.052.
Section 60A.052 lets the commissioner impose a civil penalty as provided for in section 45.027, subdivision 6. Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation upon a person who violates any law, rule or order related to the commissioner's duties unless a different penalty is specified. The session law that enacted the section makes it effective .
When LexLint raises it
When your app profile says your app is an insurer.