Jun 232022

Kentucky and Maryland Recently Joined Other States in Adopting NAIC Model Data Security Law

Thomas D. Cunningham and Stephen W. McInerney
, ,

Kentucky and Maryland recently continued the trend of state insurance departments adopting some version of the National Association of Insurance Commissioners’ (“NAIC”) Insurance Data Security Model Law.  Kentucky Governor Andy Beshear signed House Bill 474 into law, and Maryland Governor Larry Hogan signed SB 207.

Like the Model Law on which both are based, the laws require licensees of their states to, among other things, maintain a comprehensive written information security program, perform a risk assessment to identify appropriateness of implementing certain technical safeguards such as multifactor authentication and encryption, develop an incident response plan, and require third party service providers to implement security measures.

The laws also require notice of certain cybersecurity events to relevant state insurance commissioners within three business days of a determination that a cybersecurity event has occurred.  “Cybersecurity Event” is defined as an “event resulting in unauthorized access to, disruption or misuse of, an Information System or information stored on such Information System.”  The notification requirements vary slightly; but, generally, notification is required for a Cybersecurity Event if:

  1. the state is the Licensee’s state of domicile or home state or
  2. the Licensee believes the Nonpublic Information involves 250 or more Consumers and either (a) notice is required to any government body or other supervisory body or (b) the Cybersecurity Event has a reasonable likelihood of materially harming (i) any Consumer residing in the State or (ii) any material part of the normal operation of the Licensee.

The new Kentucky law takes effect on January 1, 2023.  Licensees will have one year from its effective date to implement many of its provisions, and two years from that date to implement a full information security program.

The new Maryland law takes effect on October 1, 2022, with certain grace periods for licensees to comply with the law’s requirements for a written information security program (by October 1, 2023) and to implement required service provider oversight (by October 1, 2024).

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.

Thomas D. Cunningham

Chicago

tcunningham@sidley.com

Stephen W. McInerney

Chicago

smcinerney@sidley.com

You might also like
EU AI Act: Are You Prepared for the “AI Literacy” Principle?

The EU AI Act is the world’s first horizontal and standalone law governing the commercialization and use of AI, and a landmark piece of legislation for the EU. Among the various provisions of the EU AI Act, the “AI literacy” principle is an often overlooked but key obligation which requires organizations to ensure that staff who are involved in the operation and use of AI have the necessary skills, knowledge and understanding to adequately assess AI-related risks and opportunities (e.g., through training and hiring staff with the appropriate background and skillset). This obligation – which applies from February 2, 2025 – is one of the few obligations under the EU AI Act that applies to all AI systems i.e., irrespective of the level of risk that the AI system presents. Indeed, by introducing AI literacy as one of the first provisions of the AI Act (Article 4), the EU legislators appear to underscore the significance of this requirement.

Advisor to the CJEU Confirms GDPR Fines For Subsidiary Infringements Should Reflect Group Turnover

On 12 September 2024, Advocate General Medina issued their Opinion in Case C-383/23 (Opinion) in which they confirmed that supervisory data protection authorities (SAs) must, when calculating the fine for a GDPR infringement committed by a subsidiary, take into account the total annual turnover of the entire group—a concept known as parental liability.

DOL Confirms Cybersecurity Guidance Applies to All Employee Benefit Plans

The U.S. Department of Labor (DOL) published Compliance Assistance Release No. 2024-01 on September 6, 2024. The release, titled “Cybersecurity Guidance Update,” clarifies that the cybersecurity guidance the DOL issued in April 2021 applies to all employee benefit plans, including health and welfare plans. The DOL states that since the guidance was published, service providers have told plan fiduciaries and Employee Benefits Security Administration (EBSA) investigators that the guidance applies only to retirement plans.