ACT 112, RELATING TO INSURANCE DATA SECURITY

STATE OF HAWAII DAVID Y. IGE GOVERNOR JOSH GREEN LIEUTENANT GOVERNOR DEPARTMENT OF COMMERCE AND CONSUMER AFFAIRS INSURANCE DIVISION 335 MERCHANT STREET, ROOM 213, HONOLULU, HAWAII 96813 P.O. BOX 3614, HONOLULU, HAWAII 96811 Phone Number: (808) 586-2790 Fax Number: (808) 587-6714 insurance.hawaii.gov CATHERINE P. AWAKUNI COLÓN DIRECTOR JO ANN M. UCHIDA TAKEUCHI DEPUTY DIRECTOR COLIN M. HAYASHIDA INSURANCE COMMISSIONER July 12, 2021 MEMORANDUM 2021-10L TO: All Insurers, Licensees, and Registrants FROM: Colin M. Hayashida Insurance Commissioner SUBJECT: ACT 112, RELATING TO INSURANCE DATA SECURITY Act 112, signed into law by Governor David Y. Ige on June 28, 2021, adopts the National Association of Insurance Commissioners’ Insurance Data Security Model Law to establish insurance data security standards for Hawaii insurance licensees. Act 112 applies to all Hawaii insurance licensees, which includes “every licensed insurer, producer, and any other person licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered, under [Hawaii Revised Statutes] chapter 431 or 432, or holding a certificate of authority under chapter 432D.” Pursuant to section 431: -104 of Act 112, certain licensees may be exempt from the requirements of this Act. Part II of Act 112 mandates licensees to develop, implement and maintain a comprehensive written information security program that complies with specified requirements. Additionally, each insurer domiciled in Hawaii must submit an annual certification to the commissioner by March 31, certifying the insurer’s compliance with Part II of Act 112. Part III of Act 112 requires licensees to conduct a prompt investigation of a cybersecurity event. Additionally, licensees must notify the commissioner of a cybersecurity event as promptly as possible, but in any event no later than three business days from a determination that a cybersecurity event impacting 250 or more consumers has occurred. Notification of a cybersecurity event to the commissioner may be done in letter format setting forth all information required under section 431: -302 of Act 112 and may be submitted via email to ins-legal@dcca.hawaii.gov. Memorandum 2021-10L July 12, 2021 Page 2 Although Act 112 takes effect on July 1, 2021, licensees, other than risk retention groups chartered and licensed in Hawaii (“RRGs”), will have until July 1, 2022 to implement sections 431: -201, 431: -202, 431: -203, 431: -204, 431: -206, 431: -207, and 431: -208, and until July 1, 2023 to implement section 431: -205 of Act 112. RRGs will have until July 1, 2023 to implement sections 431: -201, 431: -202, 431: - 203, 431: -204, 431: -206, 431: -207, and 431: -208, and until July 1, 2024 to implement section 431: -205 of Act 112. Questions regarding this memo and Act 112 may be directed to the Legal Branch at inslegal@dcca.hawaii.gov.