SB54 Alabama 2019 Session

Under existing law, insurers and other entities are required to provide notice to certain persons upon a breach of security resulting in the unauthorized acquisition of sensitive personally identifying information

This bill would require insurers and other entities licensed by the Department of Insurance to develop, implement, and maintain an information security program and report certain cybersecurity events to the Commissioner of Insurance. The bill would provide that information provided to the Commissioner of Insurance pursuant to this act would be confidential and privileged under certain conditions. This bill would also provide civil penalties for violations. The bill is based on the Insurance Data Security Model Law of the National Association of Insurance Commissioners

Relating to insurance; to require insurers and other entities licensed by the Department of Insurance to develop, implement, and maintain an information security program; to provide for reporting to the Commissioner of Insurance, including the reporting of cybersecurity events; to provide that information provided to the commissioner pursuant to this act would be confidential and privileged under certain conditions; to provide for civil penalties under certain conditions; and for this purpose to amend Sections 10A-20-6.16, as corrected by Act 2018-406, the Codification Act, relating to certain nonprofit corporations, and 27-21A-23, Code of Alabama 1975, relating to health maintenance organizations.