Insurance Data Security Law - Act No. 2019-98

[LOGO] KAY IVEY GOVERNOR JIM L. RIDLING COMMISSIONER STATE OF ALABAMA DEPARTMENT OF INSURANCE 201 MONROE STREET, SUITE 502 POST OFFICE BOX 303351 MONTGOMERY, ALABAMA 36130-3351 TELEPHONE: (334) 269-3550 FACSIMILE: (334) 241-4192 INTERNET: www.aldoi.gov DEPUTY COMMISSIONERS JERRY WORKMAN MARK FOWLER CHIEF EXAMINER RICHARD L. FORD STATE FIRE MARSHAL SCOTT F. PILGREEN GENERAL COUNSEL REYN NORMAN # BULLETIN NO. 2019-05 TO: All Producers and Insurers Licensed or Authorized in Alabama FROM: Jim L. Ridling, Commissioner JLR DATE: June 17, 2019 SUBJECT: Insurance Data Security Law – Act No. 2019-98 On May 1, 2019, the Governor of Alabama signed the “Insurance Data Security Law,” a part of Ala. Act 2019-98. The act will be codified in the Code of Alabama later in 2019. For the present, a copy of Ala. Act 2019-98 can be obtained through the “Legislative Acts” drop-down in the “Records” portion on the home-page banner of the Alabama Secretary of State’s web-site [sos.alabama.gov]. If applicable, the law may impose data security system requirements with respect to nonpublic information; investigatory, notification, and reporting obligations in the event of a cybersecurity event; and record-keeping and certification obligations, penalties, and other things. Though the act containing the law became effective on May 1, 2019, some aspects of the law go into effect either one or two years after May 1, 2019, and some certification obligations may be required as of February 15, 2020. The law broadly defines a “licensee” as any person (which includes an entity) that is licensed or authorized to operate or required to be licensed or authorized to operate pursuant to Alabama insurance laws except a purchasing group or a risk retention group chartered and licensed in a state other than Alabama or a licensee acting as an assuming insurer that is domiciled in a state or jurisdiction other than Alabama. The law can apply to insurance producers and insurance companies. It does, however, contain size and revenue-related exemptions and other exemptions. Each person or entity licensed or authorized to operate in Alabama under Alabama insurance laws is strongly encouraged to review the “Insurance Data Security Law” within Ala. Act 2019-98 and the act in general to determine if the law applies and, if so, what requirements are imposed. JLR/JFM/bc Alabama Department of Insurance Established 1897