Law / United States / 
New Hampshire
Insurance Data Security Law: licensee notice of a cybersecurity event to the insurance commissioner
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
As of .
What it requires
- If you are an insurance licensee, notify the insurance commissioner within 3 business days of a determination that a cybersecurity event has occurred, when New Hampshire is your state of domicile as an insurer or your home state as a producer and the event has a reasonable likelihood of materially harming a consumer residing in New Hampshire or a material part of your normal operations (RSA 420-P:6, I(a)).
- Also notify the commissioner within 3 business days when you reasonably believe the nonpublic information involves 250 or more consumers residing in New Hampshire and the event requires notice to a government body, self-regulatory agency or other supervisory body, or has a reasonable likelihood of materially harming a consumer residing in New Hampshire or a material part of your normal operations (RSA 420-P:6, I(b)).
- Give as much as possible of the information RSA 420-P:6, II(a) to (m) lists, in electronic form as the commissioner directs, and update and supplement the notice for material changes (RSA 420-P:6, II).
- Notify consumers by complying with RSA 359-C:20, I(a) and (c), II-IV and VI, and give the commissioner a copy of the consumer notice, when you must notify the commissioner (RSA 420-P:6, III).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
RSA 420-P:12 provides that a licensee which violates the chapter may be penalized in accordance with RSA 400-A:15, III. RSA 400-A:15, III reaches a person who knowingly violates a statute, rule, regulation or order of the commissioner, who may upon hearing be subject to suspension or revocation of a certificate of authority or license, or an administrative fine not to exceed $2,500 per violation. The figure is a ceiling.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
Who enforces it
Enforcement body
New Hampshire Insurance Commissioner (Insurance Department), who may examine and investigate a licensee and take the action necessary or appropriate to enforce the chapter (RSA 420-P:7).
What this law does
Each licensee must notify the commissioner within 3 business days of a determination that a cybersecurity event has occurred when New Hampshire is the licensee's state of domicile as an insurer, or its home state as a producer, and the event has a reasonable likelihood of materially harming a consumer residing in New Hampshire or any material part of the licensee's normal operations.
Each licensee must also notify the commissioner within 3 business days when it reasonably believes that the nonpublic information involves 250 or more consumers residing in New Hampshire and that the event impacts the licensee, in which case notice shall be provided to any government body, self-regulatory agency or other supervisory body, or has a reasonable likelihood of materially harming a consumer residing in New Hampshire or a material part of the licensee's normal operations.
The notice must give as much as possible of the information the paragraph lists, in electronic form as the commissioner directs, and the licensee has a continuing obligation to update it. For a cybersecurity event in a system maintained by a third-party service provider, the licensee treats the event as it would its own unless the provider gives the notice. A licensee that violates the chapter may be penalized in accordance with RSA 400-A:15, III.
Under RSA 400-A:15, III a person who knowingly violates a statute, rule, regulation or order of the commissioner may be subject to an administrative fine not to exceed $2,500 per violation. The chapter shall not be construed to create or imply a private cause of action for violation of its provisions. The chapter took effect on .
When LexLint raises it
When your app profile says your app is an insurer.