Topic: Privacy/Data Security/Cyber Risk

The Privacy Protections (H) Working Group of the National Association of Insurance ‎Commissioners (“NAIC”) met on Wednesday June 12, 2024, to consider which proposed path ‎forward to pursue as it considers a new NAIC privacy model presumably for all licensed ‎insurance entities and insurance lines of business. Readers will recall that last month, the ‎working group posed to the public a two-part question should the working group: (i) continue its ‎work on a combined unitary draft Model 674‎ ‎which would replace Models 670‎ ‎and 672‎‎ as a ‎unitary model applicable to all licensees and lines of business? or (ii) revise one or both of the ‎preexisting Models 670 and 672? In a twist, a consortium of trade associations offered a revised ‎version of Model 672, which they referred to as 672+, as an option for public comment. In a ‎close vote, the working group decided to revise Model 672, effectively abandoning last year’s ‎work on draft Model 674, while also not embracing the trades’ proposed Model 672+.‎

Yesterday, the Privacy Protections (H) Working Group of the National Association of Insurance Commissioners (“NAIC”) held its first meeting since the Spring National Meeting in March. The working group seeks public comment on its path forward as it reconsiders its options for revising the NAIC’s existing privacy framework. Multiple options are being considered.

Over the last few years, the work of the Cybersecurity (H) Working Group of the National Association of Insurance Commissioners (“NAIC”) has focused on cybersecurity risk to insurance licensees such as insurance carriers, insurance intermediaries, and third-party service providers to insurance licensees. This year the working group’s work will consist of two parallel tracks: the traditional cybersecurity risk, and a new emphasis on cyber insurance coverage. In her discussion of proposed topics for the 2024 work plan, the Chair highlighted cyber coverage questions specific to ransomware, D&O, and whether or not cyber insurance products are providing the coverage that policyholders expect.

The NAIC’s Privacy Protections (H) Working Group met over the weekend as part of the NAIC’s Summer National Meeting. The working group announced that later in the year it will seek an extension on its efforts to create a unified privacy model act (#674) which will likely push back final adoption into sometime next year. Multiple states have publicly announced that they will not support the current proposed Version 1.2, and at least one state referred to it as fundamentally flawed. The opposed states do not want to move forward with the current version. The Chair announced that the working group will continue to receive public comments while it digests comments previously received and continues the direct one-on-one outreach to companies and trades.