Law / United States / 
Pennsylvania
Insurance Data Security: notification of a cybersecurity event to the Insurance Commissioner
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
As of .
What it requires
- If you are an insurer, insurance producer or other licensee under Pennsylvania insurance law, notify the Insurance Commissioner as promptly as possible, and no later than five business days from your determination that a cybersecurity event involving nonpublic information in your possession has occurred, when the event has a reasonable likelihood of materially harming a consumer residing in Pennsylvania or a material part of your normal operations and Pennsylvania is your state of domicile (insurer) or home state (producer), or when you reasonably believe the information involves 250 or more Pennsylvania consumers and the event triggers a notice to another governmental or supervisory body or has that reasonable likelihood of harm.
- Give the commissioner as much as possible of the thirteen listed items of information, in electronic form, including the date of the event, how the information was exposed, the types of information involved, the number of Pennsylvania consumers affected, your remediation efforts, a copy of your privacy policy and a contact person, and update and supplement the notice as material changes occur.
- Whenever you must notify the commissioner, comply with section 3 of the Breach of Personal Information Notification Act as applicable and give the commissioner a copy of the notice you send consumers.
- If the event occurs in a system maintained by a third-party service provider, treat it as you would an event under section 4518(a) unless the provider notifies the commissioner directly; your deadlines run from the day after the provider notifies you or you otherwise have actual knowledge.
- If you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 4522(4): a penalty of not more than $5,000 for each violation that a licensee knew or reasonably should have known was a violation, not to exceed $100,000 in a single calendar year. Section 4522(5): not more than $1,000 for each violation the licensee did not know nor reasonably should have known was a violation, not to exceed $20,000 in a single calendar year. The commissioner may also suspend or revoke, or refuse to issue or renew, the license, authorization or registration, and issue a cease and desist order.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 100,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Pennsylvania Insurance Commissioner (Insurance Department), who may examine and investigate a licensee under section 4521 and, after notice and hearing, impose the section 4522 penalties.
What this law does
Section 4518(a) requires a licensee to notify the commissioner as promptly as possible, but in no event later than five business days from a determination that a cybersecurity event involving nonpublic information in the licensee's possession has occurred, when either of two criteria is met.
The first criterion in section 4518(a) is a cybersecurity event with a reasonable likelihood of materially harming a consumer residing in this Commonwealth or any material part of the licensee's normal operations, where this Commonwealth is the insurer's state of domicile or the insurance producer's home state.
The second criterion in section 4518(a) is the licensee's reasonable belief that the nonpublic information involves 250 or more consumers residing in this Commonwealth and that the event either requires notice to a governmental body, self-regulatory agency or other supervisory body under federal or state law or has a reasonable likelihood of materially harming a consumer or a material part of the licensee's normal operations.
Section 4518(b) requires the licensee to provide as much as possible of thirteen listed items of information about the event in electronic form, beginning with the date of the event and ending with the name of a contact person. Section 4518(c) gives the licensee a continuing obligation to update and supplement its notifications to the commissioner regarding material changes to previously provided information.
Section 4518(d) requires a licensee that must notify the commissioner to comply with section 3 of the Breach of Personal Information Notification Act and to provide the commissioner a copy of the notice sent to consumers. Section 4518(f) requires an assuming insurer to notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.
Section 4502 defines a licensee to include a person that is or is required to be licensed, authorized to operate or registered under the insurance laws of this Commonwealth. Section 4532(a) exempts a licensee with fewer than 10 employees, less than $5,000,000 in gross revenue or less than $10,000,000 in year-end total assets from sections 4512 through 4516, which do not include section 4518.
Section 4532(b) deems a licensee governed by the federal health privacy, security and breach notification rules, and that maintains nonpublic information in the same manner as protected health information, to comply with the chapter except for the notification requirements of section 4518(a), (b) and (c).
Section 4522 lets the commissioner, after notice and hearing, suspend or revoke a licensee's license, authorization to operate or registration, refuse to issue or renew it, or issue a cease and desist order. Section 4522 lets the commissioner impose a penalty of not more than $5,000 for each violation that a licensee knew or reasonably should have known was a violation, not to exceed $100,000 in a single calendar year.
Section 4522 lets the commissioner impose a penalty of not more than $1,000 for each violation that a licensee did not know nor reasonably should have known was a violation, not to exceed $20,000 in a single calendar year. Section 4534(a) provides that nothing in the chapter creates or implies a private cause of action for a violation of the chapter. Chapter 45 of Title 40 was added on by Act 2 of 2023, effective in 180 days.
When LexLint raises it
When your app profile says your app is an insurer.