On October 14, the National Association of Insurance Commissioners (NAIC) announced its cybersecurity “bill of rights” which outlines six rights of insurance consumers.   Generally speaking, the bill of rights is divided into three broad categories: (1) standard consumer information, (2) insurer safeguards and actions and (3) post-breach and identity theft protections.  Although most states have data breach laws, the proposed rights exceed what many states require.  Given the current differences in state laws governing how insurance companies must protect consumers’ data, this new bill of rights may spur additional privacy legislation and greater uniformity among state laws.

First, the bill of rights states that consumers have the right to know the information that is collected and stored by insurance companies, their agents or businesses contracting with these insurance companies.  Insurance consumers also have the right to expect that privacy policies be made available on the insurers’ websites and upon request.  Second, the bill of rights provides that insurance companies must take reasonable steps to protect consumers’ personal information.  Third, the bill of rights sets out specific notice requirements in the event of a data breach.  If a breach occurs, insurance consumers have the right to at least one year of identity theft protection paid for by the company or agent involved in the data breach.  Additionally, an insurance consumer whose identity is stolen has a right to, among other things, put a 90-day initial fraud alert on his or her credit report, put a credit freeze on his or her credit report, and obtain copies of documents related to the identity theft.  Continue Reading NAIC Cyber Task Force Adopts Cyber Bill of Rights