Law / United States / 
Minnesota
Minnesota Insurance Data Security Act, notification of a cybersecurity event to the commissioner
Minn. Stat. section 60A.9853 (Minnesota Insurance Data Security Act)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds a licensee of the Minnesota Department of Commerce or Department of Health under the insurance chapters; declare is_insurer if your organization is one. A licensee subject to and in compliance with Health Insurance Portability and Accountability Act (HIPAA) is treated as compliant with subdivisions 3 to 5 if it files a written statement certifying that compliance.
- Notify the commissioner of commerce or commissioner of health, whichever regulates you, without unreasonable delay and no later than five business days after you determine that a cybersecurity event has occurred, when Minnesota is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a Minnesota consumer or part of your normal operations, or when you reasonably believe the nonpublic information of 250 or more Minnesota consumers is involved and notice is owed to a government or supervisory body or the event has a reasonable likelihood of that harm (60A.9853, subd. 1).
- Give the commissioner, in electronic form and as completely as you can, the information subdivision 2 lists, and keep updating the notice as material facts change (60A.9853, subd. 2).
- If you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred (60A.9853, subd. 5).
- Treat a cybersecurity event in a system a third-party service provider maintains as your own event unless the provider gives the notice, counting your deadlines from the day after the provider notifies you or you otherwise know of it (60A.9853, subd. 4).
These lines are LexLint's reading of the law's text, as of .
What this law does
A licensee must notify the commissioner of commerce or commissioner of health, whichever regulates it, without unreasonable delay and no later than five business days from a determination that a cybersecurity event has occurred when either of two criteria is met.
The first criterion is that Minnesota is the licensee's state of domicile, for an insurer, or home state, for a producer, and the event has a reasonable likelihood of materially harming a consumer residing in Minnesota or any part of the licensee's normal operations.
The second criterion is that the licensee reasonably believes the nonpublic information of 250 or more consumers residing in Minnesota is involved and either notice is owed to a government or supervisory body or the event has a reasonable likelihood of materially harming a Minnesota consumer or part of the licensee's normal operations.
A licensee has a continuing obligation to update and supplement its notifications to the commissioner concerning material changes to previously provided information. An assuming insurer must notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.
A licensee required to report to the commissioner must also notify a Minnesota consumer whose nonpublic information was or is reasonably believed to have been acquired by an unauthorized person where there is a reasonable likelihood of material harm.
When LexLint raises it
When your app profile says your app is an insurer.