Law / United States / 
South Carolina
Insurance Data Security Act, investigation and notice of a cybersecurity event to the director
Insurance Data Security Act cybersecurity event notice, S.C. Code Ann. secs. 38-99-30 and 38-99-40
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a licensee under South Carolina insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of South Carolina, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
- Notify the director of the Department of Insurance no later than seventy-two hours after you determine that a cybersecurity event has occurred, when South Carolina is your state of domicile (insurer) or your home state (producer).
- Give the same notice within seventy-two hours when you reasonably believe the nonpublic information involved is of no less than two hundred and fifty consumers residing in South Carolina and the event requires notice to a governmental body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in South Carolina or a material part of your normal operations.
- Provide the director, in electronic form as the director directs, as much as possible of the 13 listed items, from the date of the event and how the information was exposed to the number of consumers affected, your remediation efforts, a copy of your privacy policy, and a contact person, and keep updating and supplementing the notification.
- Provide the director a copy of the notice sent to consumers when you are required to notify the director.
- Treat a cybersecurity event in a system maintained by a third-party service provider as you would under the notice duty, counting your deadlines from the day after the provider notifies you or you otherwise have actual knowledge, whichever is sooner.
- As an assuming insurer that does not have a direct contractual relationship with the affected consumers, notify your affected ceding insurers and the director of your state of domicile within seventy-two hours of determining that a cybersecurity event has occurred; as an insurer whose consumers accessed your services through an independent producer, notify the producers of record of affected consumers as soon as practicable as the director directs.
- Conduct a prompt investigation when you learn that a cybersecurity event has occurred or may have occurred, and keep records concerning all cybersecurity events for at least five years from the date of the event, producing them on the director's demand.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Director of the Department of Insurance, who may take necessary and appropriate action to enforce the chapter (section 38-99-50).
What this law does
A licensee must notify the director no later than seventy-two hours after determining that a cybersecurity event has occurred when South Carolina is its state of domicile in the case of an insurer, or its home state in the case of a producer.
The licensee must give the same notice when it reasonably believes the nonpublic information involved is of no less than two hundred and fifty consumers residing in South Carolina and the event requires notice to a governmental body, self-regulatory agency or other supervisory body, or has a reasonable likelihood of materially harming a consumer residing in South Carolina or a material part of its normal operations.
The licensee must provide as much as possible of 13 listed items of information, in electronic form as the director directs, and has a continuing obligation to update and supplement its notifications. A licensee must provide the director a copy of the notice sent to consumers when it is required to notify the director. A licensee must treat a cybersecurity event in a system maintained by a third-party service provider as it would an event under the notice subsection.
An assuming insurer that does not have a direct contractual relationship with the affected consumers must notify its affected ceding insurers and the director of its state of domicile within seventy-two hours of making the determination that a cybersecurity event has occurred. A licensee that learns a cybersecurity event has occurred or may have occurred must conduct a prompt investigation.
The licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the event and produce those records upon demand of the director. A licensee that violates a provision of the chapter is subject to the penalties provided in section 38-2-10.
When LexLint raises it
When your app profile says your app is an insurer.