Rescission of Bulletin 2009-12

Ohio Department of Insurance Mike DeWine, Governor Jon Husted, Lt. Governor Jillian Froment, Director # BULLETIN 2019-06 # RESCISSION OF BULLETIN 2009-12 Effective October 2, 2019 The purpose of this bulletin is to rescind attached Ohio Department of Insurance Bulletin 2009-12 (Loss of Control of Policyholder Information), the subject matter of which is covered by subsequently enacted statutes and information available on the Department's website. Superintendent of Insurance A handwritten signature in black ink, appearing to read 'Jillian Froment'. Jillian Froment Director Bulletin 2009-12 Loss of Control of Policyholder Information Effective Date: November 2, 2009 Policyholders and applicants are required to provide personal information (“Personal Information”) to insurance companies. As such, this Personal Information is provided with a reasonable expectation that the insurance company will take all prudent and reasonable steps necessary to protect that information. In addition, this information is a valuable asset of the insurance company, and any loss of such information (“Loss of Control”) is a serious matter that could involve considerable cost to the company. Therefore, there is an expectation that an insurance company which has suffered a theft or loss of monetary assets advise the Department. That expectation also applies to the theft or loss of policyholder’s Personal Information. Pursuant to O.R.C. Section 3901.07, all persons or entities holding a license or certificate of authority from the Superintendent of Insurance to conduct business within this state are required to report any Loss of Control of policyholder information within their possession to the Superintendent of Insurance within fifteen calendar days of discovery of such Loss of Control. This reporting requirement shall apply in situations involving the loss of Personal Information of more than 250 residents of Ohio. Such report will be deemed a work paper and treated as required by O.R.C. Section 3901.48. ort any Loss of Control of policyholder information within their possession to the Superintendent of Insurance within fifteen calendar days of discovery of such Loss of Control. This reporting requirement shall apply in situations involving the loss of Personal Information of more than 250 residents of Ohio. Such report will be deemed a work paper and treated as required by O.R.C. Section 3901.48. This reporting obligation extends to any Loss of Control by an agent appointed by such entity pursuant to O.R.C. Section 3905.20. The entity appointing such agent is responsible for educating that agent with respect to this obligation. “Personal Information” means an individual’s name, consisting of the individual’s first name or first initial and last name, in combination with: - a social security number, or - a driver’s license number or state identification number, or - a bank/credit/debit card or account number. “Loss of Control” means the unauthorized access to, unauthorized acquisition of, or disappearance of any Personal Information, including with respect to computerized data the unauthorized access to and/or acquisition of that computerized data that compromises the security or confidentiality of Personal Information. Mary Jo Hudson Mary Jo Hudson Superintendent of Insurance