Law / United States / 
Wisconsin
Insurance Data Security Law, investigation and notice of a cybersecurity event to the commissioner
Insurance Data Security Law cybersecurity event notice, Wis. Stat. secs. 601.953 and 601.954(1)
In force.
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a licensee under Wisconsin insurance law, which you declare by stating that you are an insurer: a person licensed, authorized, or registered, or required to be, under chapters 600 to 655 of the Wisconsin Statutes, other than a purchasing or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state or jurisdiction.
- Notify the commissioner of Insurance in electronic form, as promptly as possible and no later than 3 business days after you determine that a cybersecurity event involving nonpublic information has occurred, if you are domiciled in Wisconsin and the event has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
- Give the same notice within the same 3 business days if you reasonably believe the event involves the nonpublic information of at least 250 consumers and either requires notice to a government body, self-regulatory agency, or other supervisory entity under state or federal law or has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
- Give the commissioner as much as possible of the ten listed items, from the date and source of the event and how it was discovered to the number of consumers affected, your efforts to address the circumstances, a copy of your privacy policy, and a contact person, and update and supplement them as additional information becomes available.
- Conduct a prompt investigation when you learn that a cybersecurity event has or may have occurred: assess its nature and scope, identify the nonpublic information involved, and take reasonable measures to restore the security of the compromised systems.
- Where the event is in a system maintained by a third-party service provider, comply with the investigation duty or make reasonable efforts to confirm and document that the provider complied or failed to cooperate.
- Keep records concerning a cybersecurity event for at least 5 years from the date of the event and produce them on the commissioner's demand.
- A licensee governed by 45 CFR Parts 160 and 164 that maintains nonpublic information in the same manner as protected health information is exempt from the rest of the subchapter but remains bound by the notice to the commissioner in section 601.954(1).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commissioner of Insurance, who may examine and investigate the affairs of any licensee and take action that is necessary or appropriate to enforce the subchapter (section 601.956).
What this law does
A licensee domiciled in Wisconsin must notify the commissioner that a cybersecurity event involving nonpublic information has occurred if the event has a reasonable likelihood of materially harming a consumer or a material part of the normal operations of the licensee.
Any licensee must also notify the commissioner of a cybersecurity event that it reasonably believes involves the nonpublic information of at least 250 consumers and either requires notice to a government body, self-regulatory agency, or other supervisory entity or has a reasonable likelihood of materially harming a consumer or a material part of its normal operations.
The licensee must give the notice in electronic form and as promptly as possible, but no later than 3 business days from the determination that the cybersecurity event occurred. The notice must give as much as possible of ten listed items of information, from the date and source of the event to the name of a contact person who is familiar with the event and authorized to act for the licensee.
The licensee must update and supplement the information to address material changes as additional information becomes available. A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation. A licensee must maintain records concerning a cybersecurity event for at least 5 years from the date of the event and produce them upon demand of the commissioner.
A licensee that knows an event has or may have occurred in a system maintained by a third-party service provider must comply with the investigation duty or make reasonable efforts to confirm and document that the provider did so or failed to cooperate. The subchapter, except for the notice to the commissioner, does not apply to a licensee that is governed by the federal health privacy and security rules and maintains nonpublic information in the same manner as protected health information.
When LexLint raises it
When your app profile says your app is an insurer.