Section 675 - [Effective 7/1/2024]A. Every licensee shall notify the Insurance Commissioner without unreasonable delay, but not later than three business days, from a determination that a cybersecurity event involving nonpublic information that is in the possession of a licensee has occurred when either of the following criteria has been met: 1. This state is the state of domicile of the licensee, in the case of an insurer, or this state is the home state of the licensee, in the case of a producer, as those terms are defined in the Oklahoma Producer Licensing Act, Sections 1435.1 through 1435.41 of Title 36 of the Oklahoma Statutes, and the cybersecurity event has a reasonable likelihood of materially harming any material part of the normal operations of the licensee or any consumer residing in this state; or2. The licensee reasonably believes that the nonpublic information involved is of two hundred fifty (250) or more consumers residing in this state and is either of the following:a. a cybersecurity event impacting the licensee of which notice is required to be provided to any government body, self-regulatory agency, or any other supervisory body pursuant to any state or federal law, orb. a cybersecurity event that has a reasonable likelihood of materially harming: (1) any consumer residing in this state, or(2) any material part of the normal operation or operations of the licensee.B. The licensee making the notification required in subsection A of this section shall provide as much of the following information as possible, electronically in the manner and form prescribed by the Commissioner, along with any applicable fees. The licensee shall have a continuing obligation to update and supplement initial and subsequent notifications to the Commissioner regarding material changes to previously provided information relating to the cybersecurity event. The licensee shall provide: 1. Date of the cybersecurity event;2. Description of how the information was exposed, lost, stolen, or breached including, but not limited to, the specific roles and responsibilities of third-party service providers, if any;3. How the cybersecurity event was discovered;4. Whether any lost, stolen, or breached information has been recovered and, if so, how this was done;5. The identity of the source of the cybersecurity event;6. Whether the licensee has filed a police report or has notified any regulatory, government, or law enforcement agencies and, if so, when such notification was provided;7. Description of the specific types of information acquired without authorization. The term "specific types of information" means particular data elements including, but not limited to, types of medical information, financial information, or information allowing identification of the consumer;8. The period during which the information system was compromised by the cybersecurity event;9. The number of total consumers in this state affected by the cybersecurity event. The licensee shall provide the best estimate in the initial report to the Commissioner and update this estimate with each subsequent report to the Commissioner pursuant to this section;10. The results of any internal review identifying a lapse in either automated controls or internal procedures, or confirming that all automated controls or internal procedures were followed;11. Description of efforts being undertaken to remediate the situation which permitted the cybersecurity event to occur;12. A copy of the privacy policy of the licensee and a statement outlining the steps the licensee will take to investigate and notify consumers affected by the cybersecurity event; and13. Name of a contact person who is both familiar with the cybersecurity event and authorized to act for the licensee.C. A licensee shall comply with the procedures of the Security Breach Notification Act, Section 161 et seq. of Title 24 of the Oklahoma Statutes, to notify affected consumers and provide a copy of the notice sent to consumers under that statute to the Commissioner, when a licensee is required to notify the Commissioner under subsection A of this section.D.1. In the case of a cybersecurity event in a system maintained by a third-party service provider, of which the licensee has become aware, the licensee shall treat the event as it would under subsection A of this section unless the third-party service provider provides the notice required under subsection A of this section to the Commissioner and the licensee.2. The computation of deadlines of the licensee shall begin on the day after the third-party service provider notifies the licensee of the cybersecurity event or the licensee otherwise has actual knowledge of the cybersecurity event, whichever is sooner.3. Nothing in this act shall prevent or abrogate an agreement between a licensee and another licensee, a third-party service provider, or any other party to fulfill any of the investigation requirements or notice requirements imposed under this act.E.1. In the case of a cybersecurity event involving nonpublic information that is used by the licensee that is acting as an assuming insurer, or in the possession, custody, or control of a licensee, that is acting as an assuming insurer and that does not have a direct contractual relationship with the affected consumers, the assuming insurer shall notify its affected ceding insurers and the Commissioner of its state of domicile within three (3) business days of making the determination that a cybersecurity event has occurred. The ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under the Security Breach Notification Act, Section 161 et seq. of Title 24 of the Oklahoma Statutes, and any other notification requirements relating to a cybersecurity event imposed under this section.2. In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a third-party service provider of a licensee that is an assuming insurer, the assuming insurer shall notify its affected ceding insurers and the Commissioner of its state of domicile within three (3) business days of receiving notice from its third-party service provider that a cybersecurity event has occurred. The ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under Security Breach Notification Act, Section 161 et seq. of Title 24 of the Oklahoma Statutes, and any other notification requirements relating to a cybersecurity event imposed under this section.F. In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a licensee that is an insurer or its third-party service provider for which a consumer accessed the services of the insurer through an independent insurance producer, and for which consumer notice is required by this act or the Security Breach Notification Act, Section 161 et seq. of Title 24 of the Oklahoma Statutes, the insurer shall notify the producers of record of all affected consumers of the cybersecurity event no later than the time at which notice is provided to the affected consumers. The insurer is excused from this obligation for any producers who are not authorized by law or contract to sell, solicit, or negotiate on behalf of the insurer, and in those instances in which the insurer does not have the current producer of record information for an individual consumer. Any licensee acting as an assuming insurer shall have no other notice obligations relating to a cybersecurity event or other data breach under this section or any other law of this state.Okla. Stat. tit. 36, § 675
Added by Laws 2024, c. 346,s. 6, eff. 7/1/2024.