Law / United States / 
Pennsylvania
Insurance Data Security: records of cybersecurity events and of the annual certification, kept five years
40 Pa.C.S. §§ 4516(b), 4517(d)
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a licensee under Pennsylvania insurance law, maintain records concerning all cybersecurity events for at least five years from the date of each event (section 4517(d)).
- Produce those cybersecurity event records upon the Insurance Commissioner's demand (section 4517(d)).
- If you are an insurer domiciled in Pennsylvania, maintain all records, schedules and data supporting your annual certification for five years and make that information available for examination by the Insurance Department (section 4516(b)(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 4522(4): a penalty of not more than $5,000 for each violation that a licensee knew or reasonably should have known was a violation, not to exceed $100,000 in a single calendar year. Section 4522(5): not more than $1,000 for each violation the licensee did not know nor reasonably should have known was a violation, not to exceed $20,000 in a single calendar year. The commissioner may also suspend or revoke, or refuse to issue or renew, the license, authorization or registration, and issue a cease and desist order.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 100,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Pennsylvania Insurance Commissioner (Insurance Department), who may examine and investigate a licensee under section 4521 and, after notice and hearing, impose the section 4522 penalties.
What it makes you log
Who may demand the log
Regulator
Log retention
Section 4517(d) sets at least five years from the date of the cybersecurity event and section 4516(b)(1) sets five years for the records supporting the certification; neither states a maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Section 4517(d) requires a licensee to maintain records concerning all cybersecurity events for at least five years from the date of the event and to produce them upon the Commissioner's demand. Section 4516(b)(1) separately has an insurer keep the records, schedules and data supporting its annual certification for five years and make them available for examination by the Department. The clauses name no field of the record from the closed list. Section 4532(a) exempts a licensee meeting its size criteria from sections 4512 through 4516, which takes in section 4516(b) and leaves section 4517(d) in place. Section 4518, cited by a separate row, carries the notice duties.
- Kind
- Explicit
- As of
- Provision
- 40 Pa.C.S. sec. 4517(d), records of all cybersecurity events, with sec. 4516(b)(1) (records supporting the annual certification)
- Trigger
- security_incident
What this law does
Section 4517(d) requires a licensee to maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event. The licensee must produce those records upon demand of the commissioner. Section 4517(a) requires a licensee that discovers that a cybersecurity event has or may have occurred to conduct, or to have a designated outside vendor or service provider conduct, a prompt investigation.
Section 4516(a) requires each insurer domiciled in this Commonwealth to submit to the commissioner a written statement certifying that the insurer is in compliance. Section 4516(b)(1) requires each insurer to maintain all records, schedules and data supporting the certification for a period of five years and to make that information available for examination by the department.
Section 4502 defines a licensee to include a person that is or is required to be licensed, authorized to operate or registered under the insurance laws of this Commonwealth. Section 4532(a) exempts a licensee with fewer than 10 employees, less than $5,000,000 in gross revenue or less than $10,000,000 in year-end total assets from sections 4512 through 4516, a range that includes section 4516 but not section 4517.
Section 4521(a) gives the commissioner the powers of Article IX of The Insurance Department Act of 1921 to examine and investigate an insurer to determine whether it has violated section 4512, 4513, 4514, 4515 or 4516. Section 4521(b)(1) gives the commissioner the power to examine and investigate a licensee not subject to Article IX of that act to determine whether the licensee has violated the chapter.
Section 4522 lets the commissioner impose a penalty of not more than $5,000 for each violation that a licensee knew or reasonably should have known was a violation, not to exceed $100,000 in a single calendar year. Section 4522 lets the commissioner impose a penalty of not more than $1,000 for each violation that a licensee did not know nor reasonably should have known was a violation, not to exceed $20,000 in a single calendar year. Chapter 45 of Title 40 was added on by Act 2 of 2023, effective in 180 days.
When LexLint raises it
When your app profile says your app is an insurer.