Insurance Data Security Law: notification of a cybersecurity event to the commissioner, consumers and producers of record

House Bill 766, assigned Public Chapter Number 345 by the Secretary of State, enacts the Insurance Data Security Law and amends chapter 2 of title 56 of the Tennessee Code.

Section 56-2-1006(a) of the Insurance Data Security Law requires a licensee to notify the commissioner as soon as practicable, and in no event more than three business days, following a determination that a cybersecurity event has occurred, if the licensee is domiciled in this state or this state is its home state and the event has a reasonable likelihood of materially harming a consumer residing in this state or a material part of its normal operations, or if the licensee reasonably believes that the nonpublic information of 250 or more consumers residing in this state is involved and the event must be reported to a government body, self-regulatory agency, or other supervisory body or has a reasonable likelihood of materially harming a consumer or a material part of its normal operations.

Section 56-2-1006(b) of the Insurance Data Security Law requires a licensee that must notify the commissioner to provide, in a format directed by the commissioner, as much as is available of a listed set of information, including the date of the event, how the nonpublic information was exposed, how the event was discovered, the number of total consumers in this state affected, and a copy of the licensee's privacy policy, and to continually provide material updates or supplements.

Section 56-2-1006(c) of the Insurance Data Security Law requires a licensee, following a determination that a cybersecurity event has occurred and has a reasonable likelihood of materially harming a consumer, to notify consumers residing in this state whose nonpublic information has been acquired, or reasonably believed to have been acquired, no later than forty-five days after the determination, unless a longer period is required due to the legitimate needs of law enforcement.

Section 56-2-1006(d) of the Insurance Data Security Law requires a licensee that becomes aware of a cybersecurity event in an information system maintained by a third-party service provider to treat the event as if it occurred in its own system, with its time limits running from when the provider notifies it or it otherwise gains actual knowledge, whichever is sooner.

Section 56-2-1006(e) of the Insurance Data Security Law requires a licensee acting as an assuming insurer that does not have a direct contractual relationship with the affected consumers to notify the affected ceding insurers and the commissioner of the licensee's state of domicile within three business days of determining that a cybersecurity event has occurred.

Section 56-2-1006(f) of the Insurance Data Security Law requires an insurer, where consumer notice is required, to notify the producers of record of all affected consumers, if known, as soon as practicable but not later than when the notice is provided to the affected consumers, and excuses the insurer where it does not have the current producer of record information for an individual consumer.

Section 56-2-1009(a)(1) of the Insurance Data Security Law provides that the part does not apply to a licensee that employs fewer than 25 individuals, has less than $5,000,000 in gross annual revenue, or has less than $10,000,000 in year-end total assets. Section 56-2-1002(b) of the Insurance Data Security Law provides that the part does not create or imply a private cause of action for a violation of the part, and does not limit a private cause of action that otherwise exists.

Section 56-2-1010 of the Insurance Data Security Law provides that the commissioner may seek penalties under section 56-2-305 for a violation of the part. Section 4 of the act that enacted the Insurance Data Security Law provides that, for all purposes other than promulgating rules, the act takes effect July 1, 2021 and applies to breaches that occur or are discovered on or after that date. Public Chapter 345 was signed by the Governor on May 18, 2021.

The House adopted Amendment 1 (HA0155) on April 8, 2021. The Senate adopted Senate Amendment 1 (SA0267) on April 15, 2021, passed the bill as amended on April 19, 2021, and the House concurred in the Senate amendment. Senate Commerce and Labor Amendment 1 to SB0725, which names Senate Bill 725 and House Bill 766, deletes all language after the enacting clause and substitutes the Insurance Data Security Law.

Section 56-2-1009(a)(2) and (3) of the Insurance Data Security Law treat a licensee subject to the federal Health Insurance Portability and Accountability Act (HIPAA) privacy, security and breach notification rules that maintains nonpublic information in the same manner as protected health information, and a licensee subject to Title V of the Gramm-Leach-Bliley Act, as meeting the consumer notice requirement of section 56-2-1006(c) if the licensee is compliant with the federal law and submits a written statement certifying its compliance.

Section 56-2-305 of the Tennessee Code, in the May 2021 archive copy, lets the commissioner, after notice and a contested case hearing, order an insurer, person or entity required to be licensed by the division of insurance that has violated any statute, rule or order to cease and desist, to pay a monetary penalty of not more than $1,000 for each violation up to an aggregate of $100,000, and to suspend or revoke its license, and sets a higher tier for a knowing violation.

Section 56-2-305 of the Tennessee Code, in the May 2021 archive copy, does not apply to individual or business entity insurance producers licensed under chapter 6, part 1 of title 56.