By

Andrew Holland

06 September 2017

Regulatory Update: NAIC Summer 2017 National Meeting

The National Association of Insurance Commissioners held its Summer 2017 National Meeting in Philadelphia, Pennsylvania from August 6 to 9, 2017. This Sidley Update summarizes the highlights from this meeting. (more…)

SHARE
EmailPrintShare
05 October 2016

Impact of the EU’s General Data Protection Regulation on the Insurance and Reinsurance Industry

After almost four years of negotiations, drafting and discussions, the General Data Protection Regulation (GDPR) entered into force earlier this year. Businesses, including insurance companies, now have until May 25, 2018 to meet the new requirements under the GDPR. The GDPR aims to harmonize data protection legislation across the European Economic Area (EEA), making compliance for (re)insurance companies that operate in multiple EEA jurisdictions easier. However, in order to achieve this, the GDPR introduces a number of new requirements that will have a significant, and sometimes onerous, impact on (re)insurance companies. The GDPR is also likely to still be relevant to (re)insurance companies based in the UK despite Brexit, as the GDPR will become law in May 2018, which may be before the UK withdraws from the European Union, and even after withdrawal, the GDPR will continue to apply to UK companies that process data on EEA residents. Some of the key provisions of the GDPR that are of particular relevance for the insurance and reinsurance industry are summarized below.

(more…)

SHARE
EmailPrintShare
19 September 2016

New York State Department of Financial Services Proposes Regulations Imposing Detailed Cybersecurity Rules on Insurance, Banking and Other Licensed Financial Institutions

On September 13, 2016, the New York State Department of Financial Services (“NYDFS”) proposed regulations outlining minimum requirements for NYDFS-regulated entities to address cybersecurity risk (“Proposed Regulations”). The NYDFS regulates entities and products that are subject to New York insurance, banking and financial services laws. Because the scope of the Proposed Regulations includes any entity “operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the banking law, the insurance law or the financial services law,” the Proposed Regulations will cover a broad range of entities in the banking, insurance and financial services industries, including insurance producers and premium finance companies.

(more…)

SHARE
EmailPrintShare
25 April 2016

Fourth Circuit Affirms Duty to Defend Online Data Breach Allegations

In Travelers Indemnity Company of America v. Portal Healthcare Solutions, LLC, No. 14-1944 (4th Cir. Apr. 11, 2016), the U.S. Court of Appeals for the 4th Circuit affirmed the judgment on the reasoning of the federal district court in Virginia (No. 1:13-cv-00917-GBL-IDD), holding that Travelers had a duty to defend Portal in an underlying class action alleging online publication by Portal of confidential patient medical information pursuant to two commercial general liability (CGL) policies Travelers issued to Portal in 2012 and 2013.

(more…)

SHARE
EmailPrintShare
17 November 2015

New York Department of Financial Services Considers New Cybersecurity Regulations and Seeks to Promote Federal-State Regulatory Convergence – Would Go Well Beyond Protecting Customer Information

In a November 9, 2015 letter to members of the Financial and Banking Information Infrastructure Committee (“FBIIC”), the Acting Superintendent of the New York Department of Financial Services (“NY DFS”) outlined key elements of potential new regulations by the NY DFS addressing cybersecurity risk (“Cybersecurity Proposal”) and encouraged FBIIC members to work with the NY DFS in developing a comprehensive cybersecurity framework for all regulated financial institutions. The NY DFS regulates entities and products that are subject to New York insurance, banking and financial services laws. The FBIIC is composed of state and federal agencies that regulate companies and products in the financial services sector, including the U.S. Securities and Exchange Commission (“SEC”), the Office of the Comptroller of the Currency (“OCC”) and the National Association of Insurance Commissioners (“NAIC”). The stated goal of the NY DFS is to stimulate dialogue among federal and state financial regulators to promote collaboration and, ultimately, regulatory convergence.

(more…)

SHARE
EmailPrintShare
23 October 2015

NAIC Task Force Adopts Cybersecurity “Bill of Rights” for Insurance Consumers

On October 14, 2015, the Cybersecurity Task Force (Cybersecurity Task Force) of the National Association of Insurance Commissioners (NAIC) adopted a cybersecurity “Bill of Rights” that proposes certain rights for insurance consumers relating to the protection of their personal information by insurance companies, insurance producers and other entities regulated by state insurance departments.  The Bill of Rights also outlines specific notices, information and actions that consumers should  expect from such entities, particularly in the event of a data breach.  This Bill of Rights, if adopted by NAIC’s Executive/Plenary Committees, could ultimately be incorporated in NAIC Model Acts and Regulations, and could be adopted by insurance companies on their own initiative.

(more…)

SHARE
EmailPrintShare
13 August 2015

NAIC Drafts Cybersecurity “Bill of Rights” for Insurance Consumers

On July 27, 2015, the Cybersecurity Task Force (Cybersecurity Task Force) of the National Association of Insurance Commissioners (NAIC) released a draft cybersecurity “Bill of Rights” suggesting certain rights for insurance consumers to have their personal information protected by insurance companies, insurance producers and other entities regulated by state insurance departments. Comments on the draft were due by close of business on August 10, 2015 and a final version could be adopted during the NAIC’s upcoming National Meeting in Chicago in mid-August 2015. The Cybersecurity Bill of Rights is one of several insurance regulatory measures designed to safeguard personal information of insurance consumers, which is particularly vulnerable in data breaches because it often contains social security numbers, financial information, addresses and sensitive medical information.  Cybersecurity has become an even higher priority among insurance regulators since the Anthem, Inc. data breach and the NAIC formed the Cybersecurity Task Force to coordinate regulatory efforts in this area.

(more…)

SHARE
EmailPrintShare
02 July 2015

Connecticut Amends Breach Notification Law Regarding Timing and Credit Monitoring; Imposes New Data Security Requirements on Health Insurers and State Contractors

New legislation out of Hartford means that Connecticut joins Massachusetts in imposing strict state requirements for data protection.  S.B. 949. Additionally, the new law amends Connecticut’s data breach notification law, making Connecticut the first in the nation to affirmatively require entities that experience a reportable data breach to offer free credit monitoring to residents affected by the breach. The legislation further imposes significant new requirements on health insurers, as well as contractors that receive confidential information from state agencies, to maintain minimum data security protections. While health insurers have until 2017 to come into full compliance, the requirements for state contractors are effective as of July 1, 2015.

(more…)

SHARE
EmailPrintShare
XSLT Plugin by BMI Calculator