Delaware Insurance Data Security Act Requirements

TRINIDAD NAVARRO COMMISSIONER STATE OF DELAWARE DEPARTMENT OF INSURANCE # UNIVERSALLY APPLICABLE BULLETIN NO. 5 (UPDATED) TO: ANYONE ENGAGED IN ANY ASPECT OF THE BUSINESS OF INSURANCE IN DELAWARE INCLUDING BUT NOT LIMITED TO INSURERS, INTERMEDIARIES INCLUDING PRODUCERS (AGENTS, BROKERS AND DIRECT WRITERS), AND UNDERWRITERS, AND ANY CONTRACTORS OF THESE ENTITIES RE: DELAWARE INSURANCE DATA SECURITY ACT REQUIREMENTS DATED: August 29, 2019 UPDATED: October 8th, 2020 I. Purpose of the Original Bulletin and of the Update The purpose of the August 29, 2019 version of this Bulletin was to serve as notice that on July 31, 2019, House Bill 174 (H.B. 174), entitled the Delaware Insurance Data Security Act (the Act), was signed into law, and to describe the requirements of the Act. The purpose of the October update is to change the Department's email address to which notices of a data breach are to be sent (see updated Section III) and to require the submission of an annual certification of compliance with the requirements of the Act (see new Section IV). II. Details of the Act The Act is codified at 18 Del.C. Chapter 86, and requires licensees¹ to: - Implement information security programs and conduct risk assessments to try to prevent data breaches and compromising of consumers' nonpublic information and personal data (must be implemented no later than August 1, 2020), including oversight of third party service providers (must be implemented no later than August 1, 2021); - Conduct thorough investigations to determine if a cybersecurity event may have occurred and whose data may have been compromised; - Notify the Department within three (3) business days of determining that a cybersecurity event has occurred; NOTE: This Bulletin is intended solely for informational purposes. It is not intended to set forth legal rights, duties, or privileges, nor is it intended to provide legal advice. Readers should consult applicable statutes and rules and contact the Delaware Department of Insurance if additional information is needed. ◆ INSURANCE.DELAWARE.GOV ◆ 1351 W. NORTH ST., SUITE 101, DOVER, DELAWARE 19904-2465 (302) 674-7300 DOVER ◆ (302) 259-7554 GEORGETOWN ◆ (302) 577-5280 WILMINGTON - Notify all impacted consumers **within sixty (60) days** of the determination that their data has or may have been compromised; and - Offer free credit monitoring services **for one year** to consumers impacted by breaches. “Licensee” is defined in the Act as “a person who is licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of this State,” but a “licensee” is neither of the following: - A purchasing group or risk retention group that is chartered and licensed in a state other than this State; or - A licensee that is acting as an assuming insurer that is domiciled in a state other than this State or another jurisdiction. The Act also empowers the Commissioner to investigate the affairs of any insurer to determine whether they have been engaged in any conduct in violation of this Act and take appropriate action. Accordingly, Universally Applicable Bulletin No. 3, entitled, “Department’s Request that the Department be Notified of a Data Breach or Other Disclosure of Confidential Consumer Information,” is hereby rescinded because it is now superseded by the Act. That said, licensees who mail information to their consumers should continue to do so in closed-faced envelopes. ### III. Notifying the Department of a data breach Licensees who are subject to the Act should submit the required data breach/cyber security event notification to the Department’s dedicated email box, doidatasecurity@delaware.gov. The notice should include the following information in the notice: - When the breach was found; - When the breach occurred; - How the breach occurred; - What information was breached (or as soon as determined); - How many Delaware policyholders may be affected (or as soon as determined); - A list of the Delaware policyholders (or as soon as determined); and - A copy of the notification being sent to affected policyholders. ### IV. Annual Certification An insurer **domiciled in this State who is subject to the Act** shall annually submit the following to the Commissioner at doidatasecurity@delaware.gov, no later than February 15: - A written statement, certifying that the insurer is in compliance with the requirements of the Act; and - The **affidavit** attached to this updated bulletin. 2 Any questions, comments or requests for clarification about this bulletin should be emailed to doidatasecurity@delaware.gov. This Bulletin shall be effective immediately and shall remain in effect unless withdrawn or superseded by subsequent law, regulation or bulletin. Trinidad Navarro Delaware Insurance Commissioner ¹ HB 174 does not apply to either of the following: (1) A licensee with fewer than 15 employees is exempt from § 8604 of this chapter. (2) A licensee subject to the Health Insurance Portability and Accountability Act (P.L. 104-191, as amended) that has established and maintains an information security program under the statutes, rules, regulations, procedures, or guidelines established thereunder, is considered to meet the requirements of 18 Del.C. § 8604 if the licensee is compliant with, and submits a written statement certifying its compliance. Additionally, a licensee's employee, agent, representative, or designee, who is also a licensee, is exempt from 18 Del.C. § 8604 and is not required to develop the employee's, agent's, representative's, or designee's own information security program to the extent that the employee, agent, representative or designee is covered by the other licensee's information security program. 3