Law / United States / 
North Carolina
Customer Information Safeguards Act, insurance licensee information security program
N.C. Gen. Stat. sections 58-39-145 and 58-39-150 (Chapter 58, Article 39, Part 3)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- This binds a licensee: an insurance producer, insurer, MEWA, HMO, or service corporation governed by Chapter 58 of the General Statutes; declare is_insurer if your organization is one. An insurance-support organization, a surplus lines insurer or licensee under Article 21, and a natural-person licensee operating within the scope of employment by or affiliation with an insurer or producer are not licensees.
- Implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information (nonpublic personal information about your applicants and policyholders), appropriate to your size and complexity and the nature and scope of your activities.
- Design the program to ensure the security and confidentiality of customer information, to protect against any anticipated threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Civil penalty the Commissioner may order under section 58-2-70(d) of not less than $100 and not more than $1,000; each day during which a violation occurs is a separate violation.
- Rule
- Per violation only
- As of
- Minimum
- 100
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 1,000
Who enforces it
Enforcement body
The Commissioner, who may hold a hearing under section 58-39-80, issue a cease and desist order under section 58-39-90 and levy a civil penalty under section 58-39-95(a).
What this law does
Each licensee must implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information, appropriate to the size and complexity of the licensee and the nature and scope of its activities.
The program must be designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of the information, and protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.
A licensee is any producer, insurer, MEWA, HMO, or service corporation governed by Chapter 58, and does not include an insurance-support organization, a surplus lines insurer or licensee under Article 21, or a natural-person licensee operating within the scope of employment by or affiliation with an insurer or producer. Customer information is nonpublic personal information about a customer, who is an applicant with or policyholder of a licensee.
The Part states its purpose as establishing standards for administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information, as required by sections 501, 505(b), and 507 of the federal Gramm-Leach-Bliley Act. A violation of section 58-39-145 or section 58-39-150 subjects the violator to Part 2 of the Article. Each licensee was required to establish its program by .
When LexLint raises it
When your app profile says your app is an insurer.