January 27, 2023

Volume XIII, Number 27

Advertisement

January 26, 2023

Subscribe to Latest Legal News and Analysis

January 25, 2023

Subscribe to Latest Legal News and Analysis

January 24, 2023

Subscribe to Latest Legal News and Analysis

Maine and North Dakota Are Latest States to Adopt the NAIC Data Security Model Law

Two more state governors, those of Maine and North Dakota, have signed bills into law that adopt the National Association of Insurance Commissioners (NAIC) data security model law (Model Law). Maine and North Dakota join several other states that have already passed similar laws. Hawaii, Idaho, Illinois, Iowa, Minnesota, Rhode Island, and Wisconsin have similar bills pending.

What is the NAIC Model Law and to Whom Does it Apply?

According to the NAIC, the Model Law “seeks to establish standards for regulators and insurers in order to mitigate the potential damage of a data breach. The law applies to insurers, insurance agents and other entities licensed by the state department of insurance.”

What Does the Model Law Require?

The Model Law requires insurers and regulated entities licensed by state insurance departments to develop, implement, and maintain an information security program based on its risk assessment, with a designated employee in charge of the information security program. The Model Law also requires licensees to investigate a cybersecurity event and notify the state insurance commissioner. Licensees are required to implement an incident response plan.

Both the Maine and the North Dakota laws will not take effect right away. Maine’s Model Law is effective January 1, 2022, with one section regarding compliance with third-party service provider arrangements effective January 1, 2023. The North Dakota law takes effect on August 1, 2022, with one section regarding the obligation to document and report cybersecurity events and related incident response activities effective August 1, 2023.

 

Copyright © 2023 Robinson & Cole LLP. All rights reserved.National Law Review, Volume XI, Number 105
Advertisement
Advertisement
Advertisement

About this Author

Our lawyers are knowledgeable about data collection technology, including the use of cookies. We also understand the value of collecting and using data for marketing and other strategic purposes.

We are well versed in data breach response, remediation, coordination, and litigation, including investigations by the U.S. Office of Civil Rights and state AGs.

We actively attend and speak at FTC, state AG, and industry-sponsored workshops and programs on data privacy and security developments, cases, trends, and agendas. We...

401.709.3353
Advertisement
Advertisement
Advertisement