Section Ins 3702.03 - Standards for Providing Notice(a) When a licensee becomes aware of an incident of unauthorized access to customer information, the licensee shall immediately conduct an investigation to promptly determine the likelihood that the information has been or will be misused.(b) If a licensee determines that misuse of its customer information has occurred or is reasonably likely to occur or if a determination cannot be made, it shall notify: (1) The department as soon as possible; and(2) The affected customer or customers as soon as possible with written notice to each affected customer in no later than 30 days and in compliance with paragraph (c) of this section.(c) The customer notice shall not be issued until the earlier of: (1) Five days after the licensee submits the notice to the department for review; or(2) Receipt from the department of approval of the written notice that has been filed.(d) Customer notice may be delayed if a law enforcement agency determines that notification will interfere with a criminal investigation and provides the licensee with a written request for the delay. However, the licensee shall notify its customer or customers pursuant to (b) above as soon as the law enforcement agency informs the licensee that notification will no longer interfere with the investigation.N.H. Admin. Code § Ins 3702.03
Amended by Volume XXXVI Number 06, Filed February 11, 2016, Proposed by #11015, Effective 1/8/2016, Expires 1/8/2026.