Law / United States / 
Minnesota
Insurance data security law: retention of documents disclosed to the commissioner about a cybersecurity event
Minn. Stat. § 60A.9855, subd. 4
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- none
As of .
What it requires
- If you are a licensee of the Department of Commerce or the Department of Health, retain and preserve for five years each document, material or information disclosed to the commissioner about a cybersecurity event (section 60A.9855, subdivision 4).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation; sections 60A.9857 and 60A.052 point a violator of the insurance data security sections to it.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The commissioner of commerce or the commissioner of health, who may take action that is necessary or appropriate to enforce sections 60A.985 to 60A.9857.
Settledness
- As of
- Open questions
- Which disclosures to the commissioner does "disclosed to the commissioner under this section" in section 60A.9855, subdivision 4 cover, given that section 60A.9855 itself sets no duty to disclose and the notices and reports are required by other sections?
What it makes you log
Log retention
Subdivision 4 sets five years for the documents disclosed to the commissioner about a cybersecurity event; the sentence states no maximum and does not say from which date the period runs.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Subdivision 4 requires a licensee to retain and preserve for five years any document, material or information disclosed to the commissioner about a cybersecurity event. The sentence names no demand by the commissioner and no field of the record from the closed list, and it does not say from which date the five years run. The duty to maintain records concerning all cybersecurity events for at least five years and to produce them upon the commissioner's demand is in section 60A.9852, subdivision 4, and the commissioner's examination power is in section 60A.9854; neither is cited by this row. The sentence reaches a licensee of the Department of Commerce or the Department of Health.
- Kind
- Explicit
- As of
- Provision
- Minn. Stat. sec. 60A.9855, subd. 4, retention of documents disclosed to the commissioner about a cybersecurity event
- Trigger
- security_incident
What this law does
Under section 60A.9855, subdivision 4, any document, material, or information disclosed to the commissioner under that section about a cybersecurity event must be retained and preserved by the licensee for five years. Subdivision 1 classifies the documents, materials and information a licensee furnishes under the listed sections as confidential, protected nonpublic, or both, and not subject to subpoena.
A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered by the Department of Commerce or the Department of Health under the chapters section 60A.985 lists. A licensee that violates sections 60A.985 to 60A.9856 may be penalized in accordance with section 60A.052. Section 60A.052 lets the commissioner impose a civil penalty as provided for in section 45.027, subdivision 6.
Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation upon a person who violates any law, rule or order related to the commissioner's duties unless a different penalty is specified. The session law that enacted the section makes it effective .
When LexLint raises it
When your app profile says your app is an insurer.