ANALYSIS: Data Security Mandates Expanding for Insurance Sector

Come October 1st, Connecticut will join a growing of number of states to have codified data security provisions specifically applicable to the insurance industry. So far, eight states have adopted a model law drafted by the National Association of Insurance Commissioners (NAIC), but thanks to staggered implementation periods, compliance obligations are currently in force in only one state—South Carolina. But other deadlines are approaching.

In a nutshell, the NAIC’s model law establishes data security standards for entities licensed under state insurance laws, and it requires licensees to notify the state insurance regulator in the wake of a breach. It shares ...