Rhode Island’s new insurance coverage knowledge privateness legislation to come back into impact in 2025

Rhode Island has enacted an insurance coverage knowledge privateness legislation requiring carriers to develop and preserve a complete written data safety program based mostly on a threat evaluation, detailing nonpublic knowledge safeguards.

The legislation, transmitted to the Rhode Island secretary of state by Gov. Dan McKee’s workplace on June 26 with out his signature, will take impact on Jan. 1, 2025.

Underneath the brand new legislation, insurers should notify the insurance coverage commissioner inside three days of discovering a cybersecurity occasion if it requires notification to any authorities physique, self-regulatory company, or different supervisory physique beneath state or federal legislation. Insurers should additionally notify the commissioner if a cyber occasion is more likely to hurt Rhode Island customers or hinder the provider’s capacity to function within the state.

In accordance with a report, notifications should embrace the occasion date, an outline of the info compromise, details about the occasion’s discovery, recoverability of the info, and the variety of customers doubtlessly affected. These necessities additionally apply to cybersecurity incidents at third-party service suppliers holding the provider’s nonpublic data.

Insurers working in Rhode Island should submit an annual assertion certifying compliance with the info privateness legal guidelines. If any a part of a safety plan is discovered missing, the annual report ought to define how the problems will likely be addressed. These statements are as a result of insurance coverage commissioner by April 15 annually.

The legislation additionally mandates that insurers preserve data for 5 years following a cybersecurity occasion and supply them with the state insurance coverage commissioner if requested. Carriers are required to periodically reassess the retention of nonpublic data and contemplate mechanisms to destroy previous, pointless knowledge.

Danger assessment-based cybersecurity plans ought to foresee inside and exterior threats and consider their chance and potential injury. Plans also needs to assess the effectiveness of measures like worker cybersecurity coaching, knowledge transmission and disposal safeguards, and the flexibility to detect and deter cyberattacks.

The legislation requires the institution of incident response plans addressing elements corresponding to the interior course of for responding to an assault, roles and obligations of decision-makers through the occasion, plans for inside and exterior communications, and documentation and reporting of the occasion.

Matthew Gendron, normal counsel and chief of regulatory compliance for the Rhode Island Division of Monetary Companies, said in an e mail that the division appreciates the legislature’s help in enacting this invoice and becoming a member of the 24 states which have adopted this NAIC mannequin legislation. He added that it provides the division higher authority to guard customers.

Gendron stated that the division is making ready a bulletin for the autumn to replace stakeholders and reply generally requested questions.

What are your ideas on this story? Please be at liberty to share your feedback beneath.