SECURITY BREACH DISCLOSURE FOR INSURERS

House Bill 5275 (reported from committee as H-2)

Sponsor:  Rep. Tom Cochran

Committee:  Insurance

Complete to 2-26-18

SUMMARY:

House Bill 5275 would amend Chapter 4 of the Insurance Code (Authorization of Insurer and General Requirements) to require an additional report to be sent to the director of the Department of Insurance and Financial Services (DIFS) if an insurer has a security breach.

Currently under the Code, an insurer must prepare and deposit an annual statement concerning its affairs in a form and manner as prescribed by the director of DIFS; the statement is due each March 1.

In addition to the annual statement, the bill would require that an insurer transacting business in Michigan that was required to provide notice of a security breach to a Michigan resident under Section 12 of the Identity Theft Prevention Act (MCL 445.72) must submit a report to the director that discloses the security breach. The report would be due on or before March 1 of the year following the security breach and submitted in a form prescribed by the director.

(Section 12 of the Identity Theft Prevention Act requires entities to notify affected Michigan residents when the security of a database containing personal information maintained by that entity is breached and creates a protocol for the notification.)

Under the bill, security breach would mean that term as defined in Section 3 of the Identity Theft Prevention Act: an unauthorized access and acquisition of data that compromises the security or confidentiality of personal information maintained by a person or agency as part of a database of personal information regarding multiple individuals. The term would not include unauthorized access to data by an employee or other individual if the employee or individual acted in good faith in accessing the data, the access was related to the activities of the person or agency, and the employee or individual did not misuse any personal information or disclose any personal information to an unauthorized person.

MCL 500.438

BRIEF DISCUSSION:

According to supporters, the bill is intended to provide an additional layer of oversight for insurers in an area that has increasingly become a concern: data hacking and breaches of personal information. While Michigan law already requires notification of a security breach to affected residents, there is no requirement for insurers to notify the state in the event of a breach. The bill will increase transparency surrounding security breaches and allow DIFS to communicate directly with insurers on this issue.

FISCAL IMPACT:

House Bill 5275 would not have a fiscal impact on the Department of Insurance and Financial Services or on other units of state or local government.

POSITIONS:

A representative of the Department of Insurance and Financial Services indicated a neutral position regarding the bill. (2-15-18)

                                                                                        Legislative Analyst:   Patrick Morris

                                                                                                Fiscal Analyst:   Marcus Coffin

■ This analysis was prepared by nonpartisan House Fiscal Agency staff for use by House members in their deliberations, and does not constitute an official statement of legislative intent.