Law / United States / 
Oklahoma
Insurance Data Security Act
Officially Insurance Data Security Act: notification of a cybersecurity event to the Insurance Commissioner
Insurance Data Security Act, notice to the Insurance Commissioner, Okla. Stat. tit. 36, Sec. 675
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.oklegislature.gov/cf_pdf/2023-24%20ENR/SB/SB543%20ENR.PDFIn force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- If you are a licensee under Title 36, notify the Insurance Commissioner without unreasonable delay, but not later than three business days, from a determination that a cybersecurity event involving nonpublic information in your possession has occurred, when either criterion in section 675(A) is met (section 675(A) of Title 36).
- Provide as much of the information listed in section 675(B) as possible, electronically in the manner and form the Commissioner prescribes, along with any applicable fees (section 675(B) of Title 36).
- Update and supplement your notifications to the Commissioner about material changes to previously provided information relating to the cybersecurity event (section 675(B) of Title 36).
- If you are an assuming insurer, notify your affected ceding insurers and the Commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred, or of receiving notice from your third-party service provider that one has occurred (section 675(E) of Title 36).
- If a cybersecurity event occurs in a system maintained by a third-party service provider and you are aware of it, notify the Commissioner as you would for any other event unless the provider has given the Commissioner and you the required notice, counting your deadlines from the day after the provider notifies you or you otherwise have actual knowledge of the event, whichever is sooner (section 675(D) of Title 36).
- If you are an insurer and a cybersecurity event in your possession or your third-party service provider's possession affects a consumer who accessed your services through an independent insurance producer, and consumer notice is required, notify the producers of record of all affected consumers no later than the time you notify the affected consumers (section 675(F) of Title 36).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Insurance Commissioner, who may examine and investigate any licensee and take the action that is necessary or appropriate to enforce the Insurance Data Security Act.
What this law does
Section 1 of Enrolled Senate Bill 543 provides that the act may be cited as the Insurance Data Security Act. Licensee means any person licensed, authorized to operate, or registered, or required to be licensed, authorized to operate, or registered, pursuant to Title 36 of the Oklahoma Statutes, other than a purchasing group or risk retention group chartered and licensed in another state or a person acting as an assuming insurer domiciled in another state or jurisdiction.
Every licensee must notify the Insurance Commissioner without unreasonable delay, but not later than three business days, from a determination that a cybersecurity event involving nonpublic information in the possession of the licensee has occurred when either of two criteria is met.
The first criterion is that this state is the licensee's state of domicile (for an insurer) or home state (for a producer) and the cybersecurity event has a reasonable likelihood of materially harming any material part of the normal operations of the licensee or any consumer residing in this state.
The second criterion is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in this state and that the event either requires notice to a government body or supervisory body under state or federal law or has a reasonable likelihood of materially harming a consumer residing in this state or a material part of the licensee's operations.
The notifying licensee must provide as much of the listed information as possible, electronically in the manner and form the Commissioner prescribes, and has a continuing obligation to update and supplement its notifications about material changes. An assuming insurer must notify its affected ceding insurers and the Commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.
The act is the exclusive state law for licensees subject to the jurisdiction of the Insurance Commissioner for data security, the investigation of a cybersecurity event, and notification to the Commissioner. The act does not create or imply a private cause of action for violations of its provisions.
The Insurance Commissioner may examine and investigate the affairs of any licensee to determine whether it is engaged in conduct in violation of the act, and may take action that is necessary or appropriate to enforce the act when the Commissioner has reason to believe a licensee is engaged in violating conduct. A licensee with less than $5,000,000 in gross annual revenue is exempt from the act. Section 11 of Enrolled Senate Bill 543 provides that the act becomes effective .
In the case of a violation of the act, a licensee may be penalized in accordance with any applicable sections of the Insurance Code, including section 908 of Title 36, or any other provision providing for penalties that the licensee is subject to under its license or permit. Nothing in the act is to be construed to impose any civil liability for any violation of the act or omission to act by the licensee or employees of the licensee.
When LexLint raises it
When your app profile says your app is an insurer.