Law / United States / 
Virginia
Insurance Data Security Act
Officially Insurance Data Security Act: notice of a cybersecurity event to the Commissioner and to consumers
Va. Code Ann. §§ 38.2-625 and 38.2-626
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- If you are a licensee (a person licensed, authorized to operate or registered, or required to be, under the insurance laws of the Commonwealth, other than a purchasing group or a risk retention group chartered in another state or an assuming insurer domiciled elsewhere) and you determine that a cybersecurity event has actually occurred, notify the Commissioner in electronic form as promptly as possible and no later than three business days after the determination if you are a domestic insurance company, or a producer whose home state is Virginia and the event meets the Commission's thresholds, or you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Virginia, or you must notify any government body, self-regulatory agency or supervisory body under federal law or another state's law (section 38.2-625(A)).
- Include in the notice to the Commissioner as much as possible of the date of the event, how the nonpublic information was exposed, how the event was discovered, whether information was recovered, the source, any police report or regulatory notice, the types of information, the period of compromise, the best estimate of the number of Virginia consumers affected, the results of any internal review, the remediation under way, a copy of your consumer privacy policy with a statement of the steps you will take to investigate and notify affected consumers, and a contact person, and keep updating and supplementing the notice (section 38.2-625(B) and (C)).
- Notify affected consumers without unreasonable delay after determining or receiving notice that a cybersecurity event occurred, where consumers' nonpublic information was accessed and acquired (or you reasonably believe it was) by an unauthorized person and the event has a reasonable likelihood of causing or has caused identity theft or other fraud, describing the incident, the type of information, your acts to protect it, a telephone number if one exists, and advice to review account statements and credit reports, and send the Commissioner a copy of the consumer notice (sections 38.2-626(A) and 38.2-625(D)).
- Give notice to consumers in writing to the last known postal address, by telephone or electronically, using substitute notice only where the cost exceeds $50,000, the class exceeds 100,000 consumers or you lack sufficient contact information or consent, and where you notify more than 1,000 consumers at one time, also notify without unreasonable delay all nationwide consumer reporting agencies of the timing, distribution and content of the notice (section 38.2-626(B) and (C)).
- Where the event occurs in a system a third-party service provider maintains, treat it as your own event unless the provider gives notice under the article, counting your deadlines from the day after the provider notifies you or you otherwise have actual knowledge; an assuming insurer must notify affected ceding insurers and the head of its domiciliary supervisory state agency within three business days, and an insurer must notify the producers of record of affected consumers as soon as practicable as the Commissioner directs (sections 38.2-625(E) to (G) and 38.2-626(F)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 38.2-218: a person who knowingly or willfully violates any provision of Title 38.2 is punished for each violation by a penalty of not more than $5,000, and a person who violates a provision without knowledge or intent may be punished for each violation by a penalty of not more than $1,000, with a series of similar violations from the same act limited to $10,000 in the aggregate. The knowing or willful ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Virginia Commissioner of Insurance, who may examine and investigate the affairs of any licensee and take the action that is necessary or appropriate to enforce the article (section 38.2-627).
Settledness
- As of
- Open questions
- Does section 38.2-626, which requires consumer notice only where the event has a reasonable likelihood of causing or has caused identity theft or other fraud, apply to an event that meets the section 38.2-625 threshold of 250 or more Virginia consumers without that likelihood?
What this law does
A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of the Commonwealth. A licensee that has determined that a cybersecurity event has actually occurred must notify the Commissioner no later than three business days after the determination in the cases section 38.2-625(A) lists.
A licensee must notify affected consumers without unreasonable delay where nonpublic information was accessed and acquired by an unauthorized person and the event has a reasonable likelihood of causing or has caused identity theft or other fraud. A licensee that provides notice to more than 1,000 consumers at one time must also notify the nationwide consumer reporting agencies of the timing, distribution and content of the notice.
A licensee subject to Health Insurance Portability and Accountability Act (HIPAA) that has established and maintains an information security program under it, and that investigates a cybersecurity event and notifies consumers in accordance with HIPAA, is considered compliant with sections 38.2-624 and 38.2-626. The article does not create or imply a private cause of action for a violation of its provisions, and does not curtail one that would otherwise exist.
The Commissioner may examine and investigate the affairs of any licensee and take the action necessary or appropriate to enforce the article. The article and the rules adopted under it establish the exclusive state standards applicable to licensees for data security, the security of nonpublic information, and the investigation and notification of cybersecurity events.
Section 38.2-218 of the Code of Virginia punishes a knowing or willful violation of any provision of Title 38.2 by a penalty of not more than $5,000 for each violation. The article took effect on .
When LexLint raises it
When your app profile says your app is an insurer.