Oklahoma 2023 Regular Session

Oklahoma Senate Bill SB543 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1	1
2	2
3		-	SB543 HFLR Page 1
4		-	BOLD FACE denotes Committee Amendments. 1
	3	+	ENGR. S. B. NO. 543 Page 1 1
5	4		2
6	5		3
7	6		4
8	7		5
9	8		6
10	9		7
11	10		8
12	11		9
13	12		10
14	13		11
15	14		12
16	15		13
17	16		14
18	17		15
19	18		16
20	19		17
21	20		18
22	21		19
23	22		20
24	23		21
25	24		22
26	25		23
27	26		24
28	27
29		-	HOUSE OF REPRESENTATIVES - FLOOR VERSION
30		-
31		-	STATE OF OKLAHOMA
32		-
33		-	1st Session of the 59th Legislature (2023)
34		-
35		-	COMMITTEE SUBSTITUTE
36		-	FOR ENGROSSED
37		-	SENATE BILL NO. 543 By: Montgomery of the Senate
	28	+	ENGROSSED SENATE
	29	+	BILL NO. 543 By: Montgomery of the Senate
38	30
39	31		and
40	32
41	33		Sneed of the House
42	34
43	35
44	36
45		-
46		-
47		-	COMMITTEE SUBSTITUTE
48	37
49	38		An Act relating to insurance data security; creating
50	39		the Insurance Data Security A ct; providing short
51	40		title; establishing act jurisdi ction; construing
52	41		provision; defining terms; requiring licensees to
53	42		develop data security program with certain
54	43		inclusions; establishing intent of security programs
55	44		created pursuant to act; directing licensee to
56	45		conduct risk assessment; directing licensee t o take
57	46		certain action following risk assessment result;
58	47		requiring certain su pervising boards to take certain
59	48		actions to implement program; requiring licensee to
60	49		contract with third-party service provider subject to
61	50		certain conditions; requiring licensee to maintain
62	51		updates and revisions to program; requiring licensee
63	52		develop incident response plan; requiring certain
64	53		reports be submitted to the Insurance Commissioner;
65	54		requiring insurer to maintain certain records for
66	55		specific time period; requiring investiga tion after
67	56		certain cybersecurity event; establishing
68	57		investigation process; requiring notification of
69	58		certain event to the Commissioner; requiring
70	59		compliance with certain state laws; providing for
71	60		certain exemption; providing for the Commissioner to
72	61		investigate certain license es for certain violations;
73	62		providing for confidentialit y of certain information
74	63		relating to cybersecurity event; allowing
75	64		Commissioner to share certain data with national
	65	+	association; construing provision; providing for rule
	66	+	promulgation; providing certain exceptions to act;
	67	+	establishing penalties; amending 51 O.S. 2021,
	68	+	Section 24A.3, as last amended by Section 1, Chapter
	69	+	402, O.S.L. 2022 (51 O. S. Supp. 2022, Section 24A.3),
	70	+	which relates to the Oklahoma Open Records Act;
	71	+	modifying definition; updating statutory language;
	72	+	providing for codification; and providing a n
	73	+	effective date.
76	74
77		-	~~SB543 HFLR Page 2~~
78		-	~~BOLD FACE denotes Committee Amendments.~~ 1
	75	+
	76	+	ENGR. S. B. NO. 543 Page 2 1
79	77		2
80	78		3
81	79		4
82	80		5
83	81		6
84	82		7
85	83		8
86	84		9
87	85		10
88	86		11
89	87		12
90	88		13
91	89		14
92	90		15
93	91		16
94	92		17
95	93		18
96	94		19
97	95		20
98	96		21
99	97		22
100	98		23
101	99		24
102	100
103		-	association; construing provision; providing for rule
104		-	promulgation; providing certain exceptions to act;
105		-	establishing penalties; amending 51 O.S. 2021,
106		-	Section 24A.3, as last amended by Section 1, Chapter
107		-	402, O.S.L. 2022 (51 O.S. Supp. 2022, Section 24A.3),
108		-	which relates to the Oklahoma Open Records Act;
109		-	modifying definition; updating statutory language;
110		-	providing for codification; and providing a n
111		-	effective date.
112		-
113	101
114	102
115	103
116	104
117	105		BE IT ENACTED BY THE PEOPLE OF THE STATE OF OKLAHOMA:
118	106		SECTION 1. NEW LAW A new section of law to be codified
119	107		in the Oklahoma Statutes as Section 670 of Title 36, unless there is
120	108		created a duplication in numb ering, reads as follows:
121	109		This act shall be known and may be cited as the “Insurance Data
122	110		Security Act”.
123	111		SECTION 2. NEW LAW A new section of law to be codified
124	112		in the Oklahoma Statutes as Section 671 of Title 36, unless there is
125	113		created a duplication in numb ering, reads as follows:
126	114		A. Notwithstanding any other provision o f law, the provisions
127	115		of this act shall be the exclusive state law for licensees subject
128	116		to the jurisdiction of the Insurance Commissioner for data security,
129	117		the investigation of a cybersecurity event, and notification to the
130	118		Commissioner.
131	119		B. This act shall not be construed to creat e or imply a private
132	120		cause of action for violations of its provisions.
	121	+	SECTION 3. NEW LAW A new section of law to be codified
	122	+	in the Oklahoma Statutes as Section 672 of Title 36, unless there is
	123	+	created a duplication in numbering, reads as follows:
	124	+	As used in this act:
	125	+	1. “Authorized individual” means an individual known to and
	126	+	screened by the licensee and determined to be necessary and
133	127
134		-	SB543 HFLR Page 3
135		-	BOLD FACE denotes Committee Amendments. 1
	128	+	ENGR. S. B. NO. 543 Page 3 1
136	129		2
137	130		3
138	131		4
139	132		5
140	133		6
141	134		7
142	135		8
143	136		9
144	137		10
145	138		11
146	139		12
147	140		13
148	141		14
149	142		15
150	143		16
151	144		17
152	145		18
153	146		19
154	147		20
155	148		21
156	149		22
157	150		23
158	151		24
159	152
160		-	SECTION 3. NEW LAW A new section of law to be codified
161		-	in the Oklahoma Statutes as Section 672 of Title 36, unless there is
162		-	created a duplication in numbering, reads as follows:
163		-	As used in this act:
164		-	1. “Authorized individual” means an individual known to and
165		-	screened by the licensee and determined to be necessary and
166	153		appropriate to have access to the nonpublic information held by the
167	154		licensee and its inform ation systems;
168	155		2. “Commissioner” means the Insurance Commissioner;
169	156		3. “Consumer” means an individual, including but not limited to
170	157		applicants, policyholders, insureds, beneficiaries, claimants, and
171	158		certificate holders, who is a resident of this state and whose
172	159		nonpublic information is in the possession, custody, or control of a
173	160		licensee;
174	161		4. “Cybersecurity event” means an event resulting in
175	162		unauthorized access to or disruption or misuse of an information
176	163		system or nonpublic information stored on the information system.
177	164		The term cybersecurity event shall not include the unauthorized
178	165		acquisition of encrypted nonpublic information if the encryption,
179	166		process, or key is not also acquired, released , or used without
180	167		authorization. Cybersecurity event shall not include an event in
181	168		which the licensee has determined tha t the nonpublic info rmation
182	169		accessed by an unauthorized person has not been used or released and
183	170		has been returned or destroyed ;
	171	+	5. “Department” means the Insurance Department;
	172	+	6. “Encrypted” means the transformation of data into a form
	173	+	which results in a low probability of assigning meaning without the
	174	+	use of a protective process or key;
	175	+	7. “Information security program ” means the administrative,
	176	+	technical, and physical safeguards that a licensee u ses to access,
184	177
185		-	SB543 HFLR Page 4
186		-	BOLD FACE denotes Committee Amendments. 1
	178	+	ENGR. S. B. NO. 543 Page 4 1
187	179		2
188	180		3
189	181		4
190	182		5
191	183		6
192	184		7
193	185		8
194	186		9
195	187		10
196	188		11
197	189		12
198	190		13
199	191		14
200	192		15
201	193		16
202	194		17
203	195		18
204	196		19
205	197		20
206	198		21
207	199		22
208	200		23
209	201		24
210	202
211		-	5. “Department” means the Insurance Department;
212		-	6. “Encrypted” means the transformation of data into a form
213		-	which results in a low probability of assigning meaning without the
214		-	use of a protective process or key;
215		-	7. “Information security program ” means the administrative,
216		-	technical, and physical safeguards that a licensee u ses to access,
217	203		collect, distribute, process, protect, st ore, use, transmit, dispose
218	204		of, or otherwise handle nonpublic information;
219	205		8. “Information system” means a discrete set of electro nic
220	206		information resources organized for the collection, processing,
221	207		maintenance, use, sharing, dissemination or disposi tion of nonpublic
222	208		information, as well as any specialized system such as industrial or
223	209		process controls systems, telephone switching and private branch
224	210		exchange systems, and environmental control systems;
225	211		9. “Licensee” means any person licensed, authorized to o perate,
226	212		or registered, or required to be licensed, authorized to operate, or
227	213		registered, pursuant to Title 36 of the Oklahoma Statutes; provided,
228	214		however, that it shall not include a purchasing group or a risk
229	215		retention group chartered and licensed in a st ate other than this
230	216		state or a person that is acting as an assuming insurer that is
231	217		domiciled in another state or jurisdiction;
232	218		10. “Multi-factor authentication” means authentication through
233	219		verification of at least two (2) of the following types of
234	220		authentication factors:
	221	+	a. knowledge factors, such as a password ,
	222	+	b. possession factors, such as a token or text message on
	223	+	a mobile phone, or
	224	+	c. inherence factors, such as a biometric characteristic;
	225	+	11. “Nonpublic information” means electronic information th at
	226	+	is not publicly available and is:
235	227
236		-	SB543 HFLR Page 5
237		-	BOLD FACE denotes Committee Amendments. 1
	228	+	ENGR. S. B. NO. 543 Page 5 1
238	229		2
239	230		3
240	231		4
241	232		5
242	233		6
243	234		7
244	235		8
245	236		9
246	237		10
247	238		11
248	239		12
249	240		13
250	241		14
251	242		15
252	243		16
253	244		17
254	245		18
255	246		19
256	247		20
257	248		21
258	249		22
259	250		23
260	251		24
261	252
262		-	a. knowledge factors, such as a password ,
263		-	b. possession factors, such as a token or text message on
264		-	a mobile phone, or
265		-	c. inherence factors, such as a biometric characteristic;
266		-	11. “Nonpublic information” means electronic information th at
267		-	is not publicly available and is:
268	253		a. business related information of a licensee, of which
269	254		the tampering with or unauthorized disclosure, acce ss,
270	255		or use of would cause a material adverse impact to the
271	256		business, operations, or security of the licensee ,
272	257		b. any information concerning a consumer that, because of
273	258		name, number, personal mark, or other identifier, can
274	259		be used to identify him or her, in co mbination with
275	260		any one or more of the following data elements:
276	261		(1) social security number,
277	262		(2) driver license number or nondriver identification
278	263		card number,
279	264		(3) financial account number, credit card number, or
280	265		debit card number,
281	266		(4) any security code, access code , or password that
282	267		would permit access to a consumer’s financial
283	268		account, or
284	269		(5) biometric records, or
	270	+	c. any information or data, except age or gender, in any
	271	+	form or medium created by or derived from a health
	272	+	care provider or a consumer that can be used to
	273	+	identify a particular consumer and that relates to:
	274	+	(1) the past, present, or future physical, men tal, or
	275	+	behavioral health or condition of any consumer or
	276	+	a member of the family of the consumer,
285	277
286		-	SB543 HFLR Page 6
287		-	BOLD FACE denotes Committee Amendments. 1
	278	+	ENGR. S. B. NO. 543 Page 6 1
288	279		2
289	280		3
290	281		4
291	282		5
292	283		6
293	284		7
294	285		8
295	286		9
296	287		10
297	288		11
298	289		12
299	290		13
300	291		14
301	292		15
302	293		16
303	294		17
304	295		18
305	296		19
306	297		20
307	298		21
308	299		22
309	300		23
310	301		24
311	302
312		-	c. any information or data, except age or gender, in any
313		-	form or medium created by or derived from a health
314		-	care provider or a consumer th at can be used to
315		-	identify a particular consumer and that relates to:
316		-	(1) the past, present, or future physical, men tal, or
317		-	behavioral health or condition of any consumer or
318		-	a member of the family of the consumer,
319	303		(2) the provision of health care to any consumer , or
320	304		(3) payment for the provision of health care to any
321	305		consumer;
322	306		12. “Person” means any individual or any nongovernmental
323	307		entity including but not limited to any nongovernmental
324	308		partnership, corporation, branch, agency, or association;
325	309		13. “Publicly available information” means any information that
326	310		a licensee has reasonable basis to believe is lawfully made
327	311		available to the gener al public from federal, state, or local
328	312		government records, widely distributed media, or disclosures to the
329	313		general public that are required to be made by federal, state, or
330	314		local law. For the purposes of this definition, a licensee has a
331	315		reasonable basis to believe that information is lawfully made
332	316		available to the general public if the licensee has taken steps to
333	317		determine:
334	318		a. that the information is of the type that is available
335	319		to the general public, and
	320	+	b. whether a consumer can direct that the information not
	321	+	be made available to the general public and, if so,
	322	+	that such consumer has not done so; and
	323	+	14. “Third-party service provider” means a person, not
	324	+	otherwise defined as a licensee, that contracts with a licensee to
	325	+	maintain, process, store, or otherwise is permitted access to
336	326
337		-	SB543 HFLR Page 7
338		-	BOLD FACE denotes Committee Amendments. 1
	327	+	ENGR. S. B. NO. 543 Page 7 1
339	328		2
340	329		3
341	330		4
342	331		5
343	332		6
344	333		7
345	334		8
346	335		9
347	336		10
348	337		11
349	338		12
350	339		13
351	340		14
352	341		15
353	342		16
354	343		17
355	344		18
356	345		19
357	346		20
358	347		21
359	348		22
360	349		23
361	350		24
362	351
363		-	b. whether a consumer can direct that the information not
364		-	be made available to the general public and, if so,
365		-	that such consumer has not done so; and
366		-	14. “Third-party service provider” means a person, not
367		-	otherwise defined as a licensee, that contracts with a licensee to
368		-	maintain, process, store, or otherwise is permitted access to
369	352		nonpublic information through its provision of services to the
370	353		licensee.
371	354		SECTION 4. NEW LAW A new section of law to be codified
372	355		in the Oklahoma Statutes as Section 673 of Title 36, unless there is
373	356		created a duplication in numbering, reads as follows:
374	357		A. Each licensee in this state shall develop, implement, and
375	358		maintain a comprehensive written information security program based
376	359		on the risk assessment of the licensee provided for in t his act and
377	360		that contains administrative, technical, and physical safeguards for
378	361		the protection of nonpublic in formation and the information systems
379	362		of the licensee. The program shall be commensurate with the size and
380	363		complexity of the licensee, the nature and scope of the activities
381	364		of the licensee, including its use of third-party service providers,
382	365		and the sensitivity of the nonpublic information used by the
383	366		licensee or in the possession, custody, or control of the licensee.
384	367		B. An information security program of a license e shall be
385	368		designed to:
	369	+	1. Protect the security and confidentialit y of nonpublic
	370	+	information and the security of the information systems;
	371	+	2. Protect against any threats or hazards to the security or
	372	+	integrity of nonpublic information and the information systems;
	373	+	3. Protect against unauthorized access to or use of nonpu blic
	374	+	information, and minimize the likelihood o f harm to any consumer;
	375	+	and
386	376
387		-	SB543 HFLR Page 8
388		-	BOLD FACE denotes Committee Amendments. 1
	377	+	ENGR. S. B. NO. 543 Page 8 1
389	378		2
390	379		3
391	380		4
392	381		5
393	382		6
394	383		7
395	384		8
396	385		9
397	386		10
398	387		11
399	388		12
400	389		13
401	390		14
402	391		15
403	392		16
404	393		17
405	394		18
406	395		19
407	396		20
408	397		21
409	398		22
410	399		23
411	400		24
412	401
413		-	1. Protect the security and confidentialit y of nonpublic
414		-	information and the security of the information systems;
415		-	2. Protect against any threats or hazards to the security or
416		-	integrity of nonpublic information and the information systems;
417		-	3. Protect against unauthorized access to or use of nonpu blic
418		-	information, and minimize the likelihood o f harm to any consumer;
419		-	and
420	402		4. Define and periodically reevaluate a schedule for retention
421	403		of nonpublic information and a mechanism for its destruction when no
422	404		longer needed.
423	405		C. The licensee shall:
424	406		1. Designate one or more employees, an affiliate, or an outside
425	407		vendor designated to act on behalf of the licensee who is
426	408		responsible for the information security program;
427	409		2. Identify reasonably foreseeable internal or external threats
428	410		that could result in unauthorized access, transmission, disclosure,
429	411		misuse, alteration, or destruction of nonpublic information
430	412		including, but not limited to, the security of information systems
431	413		and nonpublic information that are accessible to, or held by, third-
432	414		party service providers;
433	415		3. Assess the likelihood and potential damage of these threats,
434	416		taking into consideration the sensitivity of the nonpublic
435	417		information;
	418	+	4. Assess the sufficiency of policies, procedures, information
	419	+	systems, and other safeguards in place to manage these threats,
	420	+	including consideration of threats in each relevant area of the
	421	+	operations of the licensee, including:
	422	+	a. employee training and management,
	423	+	b. information systems, including, but not limited to,
	424	+	network and software design, as well as information
436	425
437		-	SB543 HFLR Page 9
438		-	BOLD FACE denotes Committee Amendments. 1
	426	+	ENGR. S. B. NO. 543 Page 9 1
439	427		2
440	428		3
441	429		4
442	430		5
443	431		6
444	432		7
445	433		8
446	434		9
447	435		10
448	436		11
449	437		12
450	438		13
451	439		14
452	440		15
453	441		16
454	442		17
455	443		18
456	444		19
457	445		20
458	446		21
459	447		22
460	448		23
461	449		24
462	450
463		-	4. Assess the sufficiency of policies, procedures, information
464		-	systems, and other safeguards in place to manage these threats,
465		-	including consideration of threats in each relevant area of the
466		-	operations of the licensee, including:
467		-	a. employee training and management,
468		-	b. information systems, including, but not limited to,
469		-	network and software design, as well as information
470	451		classification, governance, processing, storage,
471	452		transmission, and disposal, and
472	453		c. detecting, preventing, and responding to attacks,
473	454		intrusions, or other systems failures; and
474	455		5. Implement information safeguards to manage the threats
475	456		identified in its ongoing assessment, and no less than annuall y,
476	457		assess the effectiveness of the key cont rols, systems, and
477	458		procedures of the safeguards.
478	459		D. Based on the results of the risk assessment, the licensee
479	460		shall:
480	461		1. Design its information security program to mitigate the
481	462		identified risks, commensurate with the size and complexity of the
482	463		licensee, the nature and scope of the a ctivities of the licensee
483	464		including its use of third-party service providers, and the
484	465		sensitivity of the nonpublic information used by the licensee or in
485	466		the possession, custody, or control of the licensee;
	467	+	2. Determine and implement security measures deemed
	468	+	appropriate, including:
	469	+	a. place access controls on information systems
	470	+	including controls to authenticate and permit access
	471	+	only to authorized individuals to protect against the
	472	+	unauthorized acquisition of nonpublic information,
	473	+	b. identify and manage the data, personnel, devices,
	474	+	systems, and facilities that enable the organization
486	475
487		-	SB543 HFLR Page 10
488		-	BOLD FACE denotes Committee Amendments. 1
	476	+	ENGR. S. B. NO. 543 Page 10 1
489	477		2
490	478		3
491	479		4
492	480		5
493	481		6
494	482		7
495	483		8
496	484		9
497	485		10
498	486		11
499	487		12
500	488		13
501	489		14
502	490		15
503	491		16
504	492		17
505	493		18
506	494		19
507	495		20
508	496		21
509	497		22
510	498		23
511	499		24
512	500
513		-	2. Determine and implement security measures deemed
514		-	appropriate, including:
515		-	a. place access controls on information systems
516		-	including controls to authenticate and permit access
517		-	only to authorized individuals to protect against the
518		-	unauthorized acquisition of nonpublic information,
519		-	b. identify and manage the data, personnel, devices,
520		-	systems, and facilities that enable the organization
521	501		to achieve business purposes in acco rdance with their
522	502		relative importance to business objectives and the
523	503		risk strategy of the organization,
524	504		c. restrict physical access to nonpublic information to
525	505		authorized individuals only,
526	506		d. protect by encryption or other appropriate means, all
527	507		nonpublic information while being transmitted over an
528	508		external network and all nonpublic information stored
529	509		on a laptop computer or other portable computing or
530	510		storage device or media,
531	511		e. adopt secure development practices for in-house
532	512		developed applications utilized by the licensee,
533	513		f. modify the information system in accordance with the
534	514		information security program of the licensee,
	515	+	g. utilize effective controls, which may include multi-
	516	+	factor authentication procedures for any authorized
	517	+	individual accessing nonpublic information,
	518	+	h. regularly test and monitor systems and procedures to
	519	+	detect actual and attempted attacks on, or intrusions
	520	+	into, information systems,
	521	+	i. include audit trails within the information security
	522	+	program designed to detect and respond to
	523	+	cybersecurity events and designed to reconstruct
535	524
536		-	SB543 HFLR Page 11
537		-	BOLD FACE denotes Committee Amendments. 1
	525	+	ENGR. S. B. NO. 543 Page 11 1
538	526		2
539	527		3
540	528		4
541	529		5
542	530		6
543	531		7
544	532		8
545	533		9
546	534		10
547	535		11
548	536		12
549	537		13
550	538		14
551	539		15
552	540		16
553	541		17
554	542		18
555	543		19
556	544		20
557	545		21
558	546		22
559	547		23
560	548		24
561	549
562		-	g. utilize effective controls, which may include multi-
563		-	factor authentication procedures for any authorized
564		-	individual accessing nonpublic information,
565		-	h. regularly test and monitor systems and procedures to
566		-	detect actual and attempted attacks on, or intrusions
567		-	into, information systems,
568		-	i. include audit trails within the information security
569		-	program designed to detect and respond to
570		-	cybersecurity events and designed to reconstruct
571	550		material financial transactions sufficient to support
572	551		normal operations and obligations of the licensee,
573	552		j. implement measures to protect against destruction,
574	553		loss, or damage of nonpublic information due to
575	554		environmental hazards such as fire and water damage or
576	555		other catastrophic events or technological failures,
577	556		and
578	557		k. develop, implement, and maintain procedures for the
579	558		secure disposal of nonpublic information in any format;
580	559		3. Include cybersecurity risks in the enterprise risk management
581	560		process of the licensee;
582	561		4. Stay informed regarding emerging threats or vulnerabilities
583	562		and utilize reasonable security measures when sharing information
584	563		relative to the character of the sharing and the type of information
585	564		shared; and
	565	+	5. Provide its personnel with cybersecurity awareness training
	566	+	that is updated as necessary to reflect risks identified by the
	567	+	licensee in the risk assessment.
	568	+	E. If the licensee has a board of directors, the board or an
	569	+	appropriate committee of the board , at a minimum, within one year of
	570	+	the effective date of thi s act, shall:
	571	+	1. Require the executive management of the licensee or its
	572	+	delegates to develop, implement, and maintain the information
	573	+	security program of the licensee;
586	574
587		-	SB543 HFLR Page 12
588		-	BOLD FACE denotes Committee Amendments. 1
	575	+	ENGR. S. B. NO. 543 Page 12 1
589	576		2
590	577		3
591	578		4
592	579		5
593	580		6
594	581		7
595	582		8
596	583		9
597	584		10
598	585		11
599	586		12
600	587		13
601	588		14
602	589		15
603	590		16
604	591		17
605	592		18
606	593		19
607	594		20
608	595		21
609	596		22
610	597		23
611	598		24
612	599
613		-	5. Provide its personnel with cybersecurity awareness training
614		-	that is updated as necessary to reflect risks identified by the
615		-	licensee in the risk assessment.
616		-	E. If the licensee has a board of directors, the board or an
617		-	appropriate committee of the board , at a minimum, within one year of
618		-	the effective date of thi s act, shall:
619		-	1. Require the executive management of the licensee or its
620		-	delegates to develop, implement, and maintain the information
621		-	security program of the licensee;
622	600		2. Require the executive management of the licensee or its
623	601		delegates to report to the Insurance Commissioner in writing, at
624	602		least annually, the following information:
625	603		a. the overall status of the information security program
626	604		and the compliance of the licensee with this act, and
627	605		b. material matters related to the information security
628	606		program, addressing issues such as risk asses sment,
629	607		risk management and control decisions, third-party
630	608		service provider arrangements, results of testing,
631	609		cybersecurity events or violations and responses of
632	610		the management to those events or violations, and
633	611		recommendations for changes in the informatio n
634	612		security program; and
635	613		3. If executive management delegates any of its
636	614		responsibilities, it shall oversee the development, implementation ,
	615	+	and maintenance of the information security program of the licensee
	616	+	prepared by the delegate or delegates and shall receive a report
	617	+	from the delegate or delegates complying with the requirements of
	618	+	the report to the board.
	619	+	F. A licensee shall exercise due diligence in selecting its
	620	+	third-party service provider and shall require t he provider to
	621	+	implement appropriate a dministrative, technical, and physical
	622	+	measures to protect and secure the information systems and nonpublic
637	623
638		-	SB543 HFLR Page 13
639		-	BOLD FACE denotes Committee Amendments. 1
	624	+	ENGR. S. B. NO. 543 Page 13 1
640	625		2
641	626		3
642	627		4
643	628		5
644	629		6
645	630		7
646	631		8
647	632		9
648	633		10
649	634		11
650	635		12
651	636		13
652	637		14
653	638		15
654	639		16
655	640		17
656	641		18
657	642		19
658	643		20
659	644		21
660	645		22
661	646		23
662	647		24
663	648
664		-	and maintenance of the information security program of the licensee
665		-	prepared by the delegate or delega tes and shall receive a report
666		-	from the delegate or delegates complying with the requirements of
667		-	the report to the board.
668		-	F. A licensee shall exercise due diligence in selecting its
669		-	third-party service provider and shall require t he provider to
670		-	implement appropriate administrative, technical, and physical
671		-	measures to protect and secure the information systems and nonpublic
672	649		information that are accessible to, or held by, the third-party
673	650		service provider.
674	651		G. The licensee shall monito r, evaluate, and adjust, as
675	652		appropriate, the information security program consistent with any
676	653		relevant changes in technology, the sensitivity of its nonpublic
677	654		information, internal o r external threats to information and the
678	655		changing business arrangements o f the licensee, such as mergers and
679	656		acquisitions, alliances and joint ventures, outsourcing
680	657		arrangements, and changes to information systems.
681	658		H. As part of its information s ecurity program, each licensee
682	659		shall establish a written incident response plan de signed to
683	660		promptly respond to, and re cover from, any cybersecurity event that
684	661		compromises the confidentiality, integrity, or availability of
685	662		nonpublic information in its possession, the information systems of
686	663		the licensee, or the continuing functionality of any aspect of the
687	664		business or operations of the licensee.
	665	+	The incident response plan shall addres s the following areas:
	666	+	1. The internal process for responding to a cybersecurity
	667	+	event;
	668	+	2. The goals of the incident response plan;
	669	+	3. The definition of cl ear roles, responsibilities , and levels
	670	+	of decision-making authority;
	671	+	4. External and internal com munications and information
	672	+	sharing;
688	673
689		-	SB543 HFLR Page 14
690		-	BOLD FACE denotes Committee Amendments. 1
	674	+	ENGR. S. B. NO. 543 Page 14 1
691	675		2
692	676		3
693	677		4
694	678		5
695	679		6
696	680		7
697	681		8
698	682		9
699	683		10
700	684		11
701	685		12
702	686		13
703	687		14
704	688		15
705	689		16
706	690		17
707	691		18
708	692		19
709	693		20
710	694		21
711	695		22
712	696		23
713	697		24
714	698
715		-	The incident response plan shall addres s the following areas:
716		-	1. The internal process for responding to a cybersecurity
717		-	event;
718		-	2. The goals of the incident response plan;
719		-	3. The definition of clear roles, responsibili ties, and levels
720		-	of decision-making authority;
721		-	4. External and internal com munications and information
722		-	sharing;
723	699		5. Identification of requirements for the remediation of any
724	700		identified weaknesses in information systems and associated
725	701		controls;
726	702		6. Documentation and re porting regarding cybersecurity events
727	703		and related incident res ponse activities; and
728	704		7. The evaluation and revision as necessary of the incident
729	705		response plan following a cybersecurity event.
730	706		I. Annually, each insurer domiciled in this state shall submit
731		-	to the Commissioner a written statement by ~~April 15~~, certifying that
	707	+	to the Commissioner a written statement by March 1, certifying that
732	708		the insurer complies with the requirements set forth in this section.
733	709		Each insurer shall maintain, for examination by the Insurance
734	710		Department, all records, schedules, and data supporting this
735	711		certificate for a period of five (5) years. To the extent an
736	712		insurer has identified areas, systems, or processes that require
737	713		material improvement, updating, or redesign, the insurer shall
738	714		document the identification and the remedial efforts planned and
	715	+	underway to address such areas, systems, or processes. The
	716	+	documentation shall be available for inspection by the Commissioner
	717	+	upon request.
	718	+	SECTION 5. NEW LAW A new section of law to be codified
	719	+	in the Oklahoma Statutes as S ection 674 of Title 36, unless there is
	720	+	created a duplication in numbering, reads as follows:
	721	+	A. If the licensee learns that a cybersecurity event has or
	722	+	may have occurred, the licensee, or an outside vendor or service
739	723
740		-	SB543 HFLR Page 15
741		-	BOLD FACE denotes Committee Amendments. 1
	724	+	ENGR. S. B. NO. 543 Page 15 1
742	725		2
743	726		3
744	727		4
745	728		5
746	729		6
747	730		7
748	731		8
749	732		9
750	733		10
751	734		11
752	735		12
753	736		13
754	737		14
755	738		15
756	739		16
757	740		17
758	741		18
759	742		19
760	743		20
761	744		21
762	745		22
763	746		23
764	747		24
765	748
766		-	underway to address such areas, systems, or processes. The
767		-	documentation shall be available for inspection by the Commissioner
768		-	upon request.
769		-	SECTION 5. NEW LAW A new section of law to be codified
770		-	in the Oklahoma Statutes as Section 674 of Title 36, unless there is
771		-	created a duplication in numbering, reads as follows:
772		-	A. If the licensee learns that a cybersecurity event has or
773		-	may have occurred, the licensee, or an outside vendor or service
774	749		provider designated to act on behalf of the licensee, shall conduct
775	750		a prompt investigation.
776	751		B. During the investigation, the licensee, or an outside vendor
777	752		or service provider des ignated to act on behalf of the licensee,
778	753		shall, at a minimum:
779	754		1. Determine whether a cybersecurity event has o ccurred;
780	755		2. Assess the nature and scope of the cybersecurity eve nt;
781	756		3. Identify any nonpublic information that may have been
782	757		involved in the cybersecurity event; and
783	758		4. Perform or oversee r easonable measures to restore the
784	759		security of the information sy stems compromised in the cybersecurity
785	760		event in order to prevent further unauthorized acquisition, release,
786	761		or use of nonpublic information in th e possession, custody, or
787	762		control of the licensee .
788	763		C. If the licensee learns that a cybersecurity event has or may
789	764		have occurred in a syst em maintained by a third-party service
	765	+	provider, the licensee shall complete the steps listed in subsection
	766	+	B of this section or confirm and document that the third -party
	767	+	service provider has completed those steps.
	768	+	D. The licensee shall maintain records concerning all
	769	+	cybersecurity events for a period of at least five (5) years from
	770	+	the date of the cybersecurity event and shall produce those records
	771	+	upon request by the Insurance Commissioner.
790	772
791		-	SB543 HFLR Page 16
792		-	BOLD FACE denotes Committee Amendments. 1
	773	+	ENGR. S. B. NO. 543 Page 16 1
793	774		2
794	775		3
795	776		4
796	777		5
797	778		6
798	779		7
799	780		8
800	781		9
801	782		10
802	783		11
803	784		12
804	785		13
805	786		14
806	787		15
807	788		16
808	789		17
809	790		18
810	791		19
811	792		20
812	793		21
813	794		22
814	795		23
815	796		24
816	797
817		-	provider, the licensee shall complete the steps listed in subsection
818		-	B of this section or confirm and document that the third -party
819		-	service provider has completed those steps.
820		-	D. The licensee shall maintain records concerning all
821		-	cybersecurity events for a period of at least five (5) years from
822		-	the date of the cybersecurity event and shall produce those records
823		-	upon request by the Insurance Commissioner.
824	798		SECTION 6. NEW LAW A new section of law to be codified
825	799		in the Oklahoma Statutes as Section 675 of Title 36, unless there is
826	800		created a duplication in numb ering, reads as follows:
827	801		A. Every licensee shall notify the Insurance Commissioner
828	802		without unreasonable delay, but not later than three busine ss days,
829	803		from a determination that a cybersecurity event involving nonpublic
830	804		information that is in the possession of a licensee has occurred
831	805		when either of the following criteria has been met:
832	806		1. This state is the state of dom icile of the licensee, in the
833	807		case of an insurer, or this state i s the home state of the licensee,
834	808		in the case of a producer, as those terms are defined in the
835	809		Oklahoma Producer Licensing Act, Sections 1435.1 thro ugh 1435.41 of
836	810		Title 36 of the Oklahoma Sta tutes, and the cybersecurity event has a
837	811		reasonable likelihood of materially harming any material part of the
838	812		normal operations of the licensee or any consumer residing in this
839	813		state; or
	814	+	2. The licensee reasonably believes that the nonpublic
	815	+	information involved is of two hundred fi fty (250) or more consumers
	816	+	residing in this state and is either of the following:
	817	+	a. a cybersecurity event impacting the licensee of which
	818	+	notice is required to be provided to any government
	819	+	body, self-regulatory agency, or any other supervisory
	820	+	body pursuant to any state or federal law, or
840	821
841		-	SB543 HFLR Page 17
842		-	BOLD FACE denotes Committee Amendments. 1
	822	+	ENGR. S. B. NO. 543 Page 17 1
843	823		2
844	824		3
845	825		4
846	826		5
847	827		6
848	828		7
849	829		8
850	830		9
851	831		10
852	832		11
853	833		12
854	834		13
855	835		14
856	836		15
857	837		16
858	838		17
859	839		18
860	840		19
861	841		20
862	842		21
863	843		22
864	844		23
865	845		24
866	846
867		-	2. The licensee reasonably bel ieves that the nonpublic
868		-	information involved is of two hundred fi fty (250) or more consumers
869		-	residing in this state and is either of the following:
870		-	a. a cybersecurity event impacting the licensee of which
871		-	notice is required to be provided to any governmen t
872		-	body, self-regulatory agency, or any other supervisory
873		-	body pursuant to any state or federal law, or
874	847		b. a cybersecurity event that has a reasonable likelihood
875	848		of materially harming:
876	849		(1) any consumer residing in this state , or
877	850		(2) any material part of the normal operation or
878	851		operations of the licensee.
879	852		B. The licensee making the notification required in su bsection
880	853		A of this section shall provide as much of the following information
881	854		as possible, electronically in the manner and form prescribed by the
882	855		Commissioner, along with any applicable fee s. The licensee shall
883	856		have a continuing obligation to update and s upplement initial and
884	857		subsequent notifications to the Commissioner regarding material
885	858		changes to previously provided information relating to the
886	859		cybersecurity event. The licensee shall provide:
887	860		1. Date of the cybersecurity event;
888	861		2. Description of how t he information was exposed, lost,
889	862		stolen, or breached including, but not limited to, the specific
890	863		roles and responsibilities of third-party service providers, if any;
	864	+	3. How the cybersecurity event was discovered;
	865	+	4. Whether any lost, stolen, or breached information has been
	866	+	recovered and, if so, how this was done;
	867	+	5. The identity of the source of the cybersecurity event;
	868	+	6. Whether the licensee has filed a police report or has
	869	+	notified any regulatory, government , or law enforcement agencies
	870	+	and, if so, when such notification was provided;
891	871
892		-	SB543 HFLR Page 18
893		-	BOLD FACE denotes Committee Amendments. 1
	872	+	ENGR. S. B. NO. 543 Page 18 1
894	873		2
895	874		3
896	875		4
897	876		5
898	877		6
899	878		7
900	879		8
901	880		9
902	881		10
903	882		11
904	883		12
905	884		13
906	885		14
907	886		15
908	887		16
909	888		17
910	889		18
911	890		19
912	891		20
913	892		21
914	893		22
915	894		23
916	895		24
917	896
918		-	3. How the cybersecurity event was discovered;
919		-	4. Whether any lost, stolen, or breached information has been
920		-	recovered and, if so, how this was done;
921		-	5. The identity of the source of the cybersecurity event;
922		-	6. Whether the licensee has filed a police report or has
923		-	notified any regulatory, government , or law enforcement agencies
924		-	and, if so, when such notification was provided;
925	897		7. Description of the specific ty pes of information acquired
926	898		without authorization. The term “specific types of information”
927	899		means particular data elements including, but not li mited to, types
928	900		of medical information, financial information, or information
929	901		allowing identification of the con sumer;
930	902		8. The period during which the information system was
931	903		compromised by the cybersecurity event;
932	904		9. The number of total consumers in this state affected by the
933	905		cybersecurity event. The licensee shall provide the best estimate
934	906		in the initial report t o the Commissioner and update this estimate
935	907		with each subsequent report to the Commissioner pursuant to this
936	908		section;
937	909		10. The results of any in ternal review identifying a lapse in
938	910		either automated controls or internal procedures, or confirming that
939	911		all automated controls or internal procedures were followed;
940	912		11. Description of efforts being undertaken to remediate the
941	913		situation which permitted t he cybersecurity event to occur;
	914	+	12. A copy of the privacy policy of the licensee and a
	915	+	statement outlining the steps the licensee will take to investigate
	916	+	and notify consumers affected by the cybersecurity event; and
	917	+	13. Name of a contact person who is both familiar with the
	918	+	cybersecurity event and authorized to act for the licensee.
	919	+	C. A licensee shall comply w ith the procedures of the Security
	920	+	Breach Notification Act, Section 161 et seq. of Title 24 of the
942	921
943		-	SB543 HFLR Page 19
944		-	BOLD FACE denotes Committee Amendments. 1
	922	+	ENGR. S. B. NO. 543 Page 19 1
945	923		2
946	924		3
947	925		4
948	926		5
949	927		6
950	928		7
951	929		8
952	930		9
953	931		10
954	932		11
955	933		12
956	934		13
957	935		14
958	936		15
959	937		16
960	938		17
961	939		18
962	940		19
963	941		20
964	942		21
965	943		22
966	944		23
967	945		24
968	946
969		-	12. A copy of the privacy policy of the licensee and a
970		-	statement outlining the steps the licensee will take to investigate
971		-	and notify consumers affected by the cybersecurity event; and
972		-	13. Name of a contact person who is both familiar with the
973		-	cybersecurity event and authorized to act for the licensee.
974		-	C. A licensee shall comply w ith the procedures of the Security
975		-	Breach Notification Act, Section 161 et seq . of Title 24 of the
976	947		Oklahoma Statutes, to notify affected consume rs and provide a copy
977	948		of the notice sent to consumers under that statute to the
978	949		Commissioner, when a licensee is required to notify the Commissioner
979	950		under subsection A of this section.
980	951		D. 1. In the case of a cybersecurity even t in a system
981	952		maintained by a third-party service provider, of which the licensee
982	953		has become aware, the licensee shall treat the event as it would
983	954		under subsection A of this section unless the third -party service
984	955		provider provides the notice required under subsection A of this
985	956		section to the Commissioner and the licensee.
986	957		2. The computation of deadlines of the licensee shall begin on
987	958		the day after the third-party service provider notifies the licensee
988	959		of the cybersecurity event or the licensee otherwise ha s actual
989	960		knowledge of the cybersecurity event, whichever is sooner.
990	961		3. Nothing in this act shall prevent or abrogate an agreement
991	962		between a licensee and another licensee, a third -party service
	963	+	provider, or any other party to fulfill any of the investigation
	964	+	requirements impose or notice requirements imposed under this act.
	965	+	E. 1. In the case of a cybersecurity event involving nonpublic
	966	+	information that is used by the licensee that is acting as an
	967	+	assuming insurer, or in the possession, custody , or control of a
	968	+	licensee, that is acti ng as an assuming insurer and that does not
	969	+	have a direct contractual relationship with the affected consumers,
	970	+	the assuming insurer shall notify its affected ceding insurers and
992	971
993		-	SB543 HFLR Page 20
994		-	BOLD FACE denotes Committee Amendments. 1
	972	+	ENGR. S. B. NO. 543 Page 20 1
995	973		2
996	974		3
997	975		4
998	976		5
999	977		6
1000	978		7
1001	979		8
1002	980		9
1003	981		10
1004	982		11
1005	983		12
1006	984		13
1007	985		14
1008	986		15
1009	987		16
1010	988		17
1011	989		18
1012	990		19
1013	991		20
1014	992		21
1015	993		22
1016	994		23
1017	995		24
1018	996
1019		-	provider, or any other party to fulfill any of t he investigation
1020		-	requirements impose or notice requirements imposed under this act.
1021		-	E. 1. In the case of a cybersecurity event involving nonpublic
1022		-	information that is used by the licensee that is acting as an
1023		-	assuming insurer, or in the possession, custo dy, or control of a
1024		-	licensee, that is acti ng as an assuming insurer and that does not
1025		-	have a direct contractual relationship with the affected consumers,
1026		-	the assuming insurer shall notify its affected ceding insurers and
1027	997		the Commissioner of its state of domicile within three (3) business
1028	998		days of making the determination that a cybersecurity event has
1029	999		occurred. The ceding insurers that have a direct contractual
1030	1000		relationship with affected consumers shall fulfill the consumer
1031	1001		notification requirements imposed under the Sec urity Breach
1032	1002		Notification Act, Section 161 et seq. of Title 24 of the Oklahoma
1033	1003		Statutes, and any other notification requirements relating to a
1034	1004		cybersecurity event imposed under this section.
1035	1005		2. In the case of a cybersecurity event involving nonpublic
1036	1006		information that is in the posse ssion, custody, or control of a
1037	1007		third-party service provider of a licensee that is an assuming
1038	1008		insurer, the assuming i nsurer shall notify its affected ceding
1039	1009		insurers and the Commissioner of its state of domicile within three
1040	1010		(3) business days of receiving notice from its third-party service
1041	1011		provider that a cybersecurity event has occurred. The ceding
1042	1012		insurers that have a direct contractual relationship with affected
	1013	+	consumers shall fulfill the consumer notification requirements
	1014	+	imposed under Security Brea ch Notification Act, Section 161 et seq.
	1015	+	of Title 24 of the Oklahoma Statutes, and any other notification
	1016	+	requirements relating to a cybersecurity event imposed under this
	1017	+	section.
	1018	+	F. In the case of a cybersecurity event involv ing nonpublic
	1019	+	information that is in the possession, custody, or control of a
	1020	+	licensee that is an insurer or its third-party service provider for
1043	1021
1044		-	SB543 HFLR Page 21
1045		-	BOLD FACE denotes Committee Amendments. 1
	1022	+	ENGR. S. B. NO. 543 Page 21 1
1046	1023		2
1047	1024		3
1048	1025		4
1049	1026		5
1050	1027		6
1051	1028		7
1052	1029		8
1053	1030		9
1054	1031		10
1055	1032		11
1056	1033		12
1057	1034		13
1058	1035		14
1059	1036		15
1060	1037		16
1061	1038		17
1062	1039		18
1063	1040		19
1064	1041		20
1065	1042		21
1066	1043		22
1067	1044		23
1068	1045		24
1069	1046
1070		-	consumers shall fulfill the consumer notificatio n requirements
1071		-	imposed under Security Brea ch Notification Act, Section 161 et seq.
1072		-	of Title 24 of the Oklahoma Statutes, and any other notification
1073		-	requirements relating to a cybersecurity event imposed under this
1074		-	section.
1075		-	F. In the case of a cybersecurit y event involving nonpublic
1076		-	information that is in the possession, custody, or control of a
1077		-	licensee that is an insurer or its third-party service provider for
1078	1047		which a consumer accessed the services of the insurer through an
1079	1048		independent insurance producer, and for which consumer notice is
1080	1049		required by this act or the Security Breach Notification Act,
1081	1050		Section 161 et seq. of Title 24 of the Oklahoma Statutes, the
1082	1051		insurer shall notify the producers of record of all affected
1083	1052		consumers of the cybersecurity event no later than the time at which
1084	1053		notice is provided to the affected consumers. The insurer is
1085	1054		excused from this obligation for any producers who are not
1086	1055		authorized by law or contract to sell, solicit , or negotiate on
1087	1056		behalf of the insurer, and in those instances in whic h the insurer
1088	1057		does not have the current producer of record information for an
1089	1058		individual consumer. Any licensee acting as an assuming insurer
1090	1059		shall have no other notice obligations relating to a cybersecurity
1091	1060		event or other data breach under this section or any other law of
1092	1061		this state.
	1062	+	SECTION 7. NEW LAW A new section of law to be codified
	1063	+	in the Oklahoma Statutes as Section 676 of Title 36, unless there is
	1064	+	created a duplication in numb ering, reads as follows:
	1065	+	A. The Insurance Commissioner shall have power to examine and
	1066	+	investigate the affairs of any licensee to determine whether the
	1067	+	licensee has been or is engaged in any conduct in violation of the
	1068	+	provisions of this act or any rules promulgated thereto . This power
	1069	+	is in addition to the powers which the Commissioner has under
	1070	+	applicable provisions of the Insurance Code including, but not
1093	1071
1094		-	SB543 HFLR Page 22
1095		-	BOLD FACE denotes Committee Amendments. 1
	1072	+	ENGR. S. B. NO. 543 Page 22 1
1096	1073		2
1097	1074		3
1098	1075		4
1099	1076		5
1100	1077		6
1101	1078		7
1102	1079		8
1103	1080		9
1104	1081		10
1105	1082		11
1106	1083		12
1107	1084		13
1108	1085		14
1109	1086		15
1110	1087		16
1111	1088		17
1112	1089		18
1113	1090		19
1114	1091		20
1115	1092		21
1116	1093		22
1117	1094		23
1118	1095		24
1119	1096
1120		-	SECTION 7. NEW LAW A new section of law to be codified
1121		-	in the Oklahoma Statutes as Section 676 of Title 36, unless there is
1122		-	created a duplication in numb ering, reads as follows:
1123		-	A. The Insurance Commissioner shall have power to examine and
1124		-	investigate the affairs of any licensee to determine whether the
1125		-	licensee has been or is engaged in any conduct in violation of the
1126		-	provisions of this act or any rules promulgat ed thereto. This power
1127		-	is in addition to the powers which the Commissioner has under
1128		-	applicable provisions of the Insurance Code including, but not
1129	1097		limited to, Sections 309.1 through 309.6, 332, and 1250.4 of Title
1130	1098		36 of the Oklahoma Statutes .
1131	1099		B. Whenever the Commissioner has reason to belie ve that a
1132	1100		licensee has been or is engaged in conduct in this state that
1133	1101		violates any provision of this act, the Commissioner may take action
1134	1102		that is necessary or appropriate to enforce the provisi ons.
1135	1103		SECTION 8. NEW LAW A new sectio n of law to be codifi ed
1136	1104		in the Oklahoma Statutes as Section 677 of Title 36, unless there is
1137	1105		created a duplication in numbering, reads as follows:
1138	1106		A. Any documents, materials , or other information in the
1139	1107		control or possession of the Insurance Department that are furnished
1140	1108		by a licensee or an employee or agent thereof acting on behalf of a
1141	1109		licensee pursuant to the provisions of Section 4 and Section 6 of
1142	1110		this act or that are obtained by the Insuran ce Commissioner in an
1143	1111		investigation or examinati on pursuant to Section 7 of this act shall
	1112	+	be confidential by law and privileged, shall not be subject to the
	1113	+	Oklahoma Open Records Act, shall not be subject to subpoena, and
	1114	+	shall not be subject to discover y or admissible in evidence in any
	1115	+	private civil action. However, the Commissioner is au thorized to
	1116	+	use the documents, materials, or other information in the
	1117	+	furtherance of any regulatory or legal action brought as a part of
	1118	+	the Commissioner’s duties. The Commissioner shall no t otherwise
	1119	+	make the documents, materials, or other information pu blic without
	1120	+	the prior written consent of the licensee.
1144	1121
1145		-	SB543 HFLR Page 23
1146		-	BOLD FACE denotes Committee Amendments. 1
	1122	+	ENGR. S. B. NO. 543 Page 23 1
1147	1123		2
1148	1124		3
1149	1125		4
1150	1126		5
1151	1127		6
1152	1128		7
1153	1129		8
1154	1130		9
1155	1131		10
1156	1132		11
1157	1133		12
1158	1134		13
1159	1135		14
1160	1136		15
1161	1137		16
1162	1138		17
1163	1139		18
1164	1140		19
1165	1141		20
1166	1142		21
1167	1143		22
1168	1144		23
1169	1145		24
1170	1146
1171		-	be confidential by law and privileged, shall not be subject to the
1172		-	Oklahoma Open Records Act, shall not be subject to subpoena, and
1173		-	shall not be subject to discover y or admissible in evid ence in any
1174		-	private civil action. However, the Commissioner is au thorized to
1175		-	use the documents, materials, or other information in the
1176		-	furtherance of any regulatory or legal action brought as a part of
1177		-	the Commissioner’s duties. The Commissioner shall no t otherwise
1178		-	make the documents, materials, or other information pu blic without
1179		-	the prior written consent of the licensee.
1180	1147		B. Neither the Commissioner nor any person who received
1181	1148		documents, materials , or other information while acting under the
1182	1149		authority of the Commissioner shall b e permitted or required to
1183	1150		testify in any private civil action concerning any confidential
1184	1151		documents, materials, or information subject to subsection A of this
1185	1152		section.
1186	1153		C. In order to assist in the perf ormance of the duties of the
1187	1154		Commissioner under this act, the Commissioner:
1188	1155		1. May share documents, materials, or other information
1189	1156		including the confidential and privileged documents, materials, or
1190	1157		information subject to subsection A of this section, with other
1191	1158		state, federal, and international regulatory age ncies, with the
1192	1159		National Association of Insurance Commissioners and its affiliates
1193	1160		or subsidiaries and with state, federal, and international law
1194	1161		enforcement authorities; provided, that the recipient agrees in
	1162	+	writing to maintain the confidentiality and pri vileged status of the
	1163	+	document, material, or other information;
	1164	+	2. May receive documents, materials, or information including
	1165	+	otherwise confidential and privileged documents, materials , or
	1166	+	information, from the National Association of Insurance
	1167	+	Commissioners, its affiliates or subsidiaries , and from regulatory
	1168	+	and law enforcement officials of other foreign or domestic
	1169	+	jurisdictions, and shall maintain as confidential or privileged any
	1170	+	document, material, or information received with notice or the
1195	1171
1196		-	SB543 HFLR Page 24
1197		-	BOLD FACE denotes Committee Amendments. 1
	1172	+	ENGR. S. B. NO. 543 Page 24 1
1198	1173		2
1199	1174		3
1200	1175		4
1201	1176		5
1202	1177		6
1203	1178		7
1204	1179		8
1205	1180		9
1206	1181		10
1207	1182		11
1208	1183		12
1209	1184		13
1210	1185		14
1211	1186		15
1212	1187		16
1213	1188		17
1214	1189		18
1215	1190		19
1216	1191		20
1217	1192		21
1218	1193		22
1219	1194		23
1220	1195		24
1221	1196
1222		-	writing to maintain the confidentiality a nd privileged status of the
1223		-	document, material, or other information;
1224		-	2. May receive documents, materials, or information including
1225		-	otherwise confidential and privileged documents, materials , or
1226		-	information, from the National Association of Insurance
1227		-	Commissioners, its affiliates or subsidiaries , and from regulatory
1228		-	and law enforcement officials of other foreign or domestic
1229		-	jurisdictions, and shall maintain as confidential or privileged any
1230		-	document, material, or information received with notice or the
1231	1197		understanding that it is confidential or priv ileged under the laws
1232	1198		of the jurisdiction that is the source of the document, material, or
1233	1199		information;
1234	1200		3. May share documents, materials, or other information subject
1235	1201		to subsection A of this section, with a third-party consultant or
1236	1202		vendor; provided, the consultant agrees in writing to maintain the
1237	1203		confidentiality and privileged status of the document, material, or
1238	1204		other information; and
1239	1205		4. May enter into agreements governing sharing and use of
1240	1206		information consistent with this subsection.
1241	1207		D. No waiver of any applicable privilege or claim of
1242	1208		confidentiality in the documents, materials, or information shall
1243	1209		occur as a result of disclosure to the Insurance Commissioner under
1244	1210		this section or as a result of sharing as authorized in subsection C
1245	1211		of this section.
	1212	+	E. Nothing in this act shall prohibit the Commissioner from
	1213	+	releasing final, adjudicated actions that are open to public
	1214	+	inspection pursuant to the Oklahoma Open Records Act, to a database
	1215	+	or other clearinghouse service maintained by the National
	1216	+	Association of Insurance Commissioners, its affiliates, or
	1217	+	subsidiaries.
	1218	+	F. Documents, materials, or other information in the possession
	1219	+	or control of the National Association of Insur ance Commissioners or
	1220	+	a third-party consultant or vendor pursuant to this ac t shall not be
1246	1221
1247		-	SB543 HFLR Page 25
1248		-	BOLD FACE denotes Committee Amendments. 1
	1222	+	ENGR. S. B. NO. 543 Page 25 1
1249	1223		2
1250	1224		3
1251	1225		4
1252	1226		5
1253	1227		6
1254	1228		7
1255	1229		8
1256	1230		9
1257	1231		10
1258	1232		11
1259	1233		12
1260	1234		13
1261	1235		14
1262	1236		15
1263	1237		16
1264	1238		17
1265	1239		18
1266	1240		19
1267	1241		20
1268	1242		21
1269	1243		22
1270	1244		23
1271	1245		24
1272	1246
1273		-	E. Nothing in this act shall prohibit the Commissioner from
1274		-	releasing final, adjudicated actions that are open to public
1275		-	inspection pursuant to the Oklahoma Open Records Act, to a database
1276		-	or other clearinghouse service maintained by the National
1277		-	Association of Insurance Commissioners, its affiliates, or
1278		-	subsidiaries.
1279		-	F. Documents, materials, or other information in the possession
1280		-	or control of the National Association of Insur ance Commissioners or
1281		-	a third-party consultant or vendor pursuant to this ac t shall not be
1282	1247		construed to be public information, shall not be subject to the
1283	1248		Oklahoma Open Records Act, shall not be subject to subpoena, and
1284	1249		shall not be subject to discovery or adm issible as evidence in any
1285	1250		private civil action.
1286	1251		SECTION 9. NEW LAW A new section of law to be codified
1287	1252		in the Oklahoma Statutes as Section 678 of Title 36, unless there is
1288	1253		created a duplication in numbering, reads as follows:
1289	1254		A. The Insurance Commissioner may promulgate any rules
1290	1255		necessary to carry ou t the provisions of this section.
1291	1256		B. 1. The following exceptions shall apply to this act:
1292	1257		a. a licensee with less than Five Million Dollars
1293	1258		($5,000,000.00) in gross annual revenue, is exempt
1294	1259		from this act,
1295	1260		b. a licensee subject to the Health Insurance Po rtability
1296	1261		and Accountability Act, Pub . L. 104–191, 110 Stat.
	1262	+	1936, as amended, that has established and maintains
	1263	+	an information security program pursuant to such
	1264	+	statutes, rules, regulations, procedures , or
	1265	+	guidelines established thereunder, will be considered
	1266	+	to meet the requirements of Section 4 of this act,
	1267	+	provided that the licensee is compliant with and
	1268	+	submits a written statement to the Commission er
	1269	+	certifying its compliance with the same, and
1297	1270
1298		-	SB543 HFLR Page 26
1299		-	BOLD FACE denotes Committee Amendments. 1
	1271	+	ENGR. S. B. NO. 543 Page 26 1
1300	1272		2
1301	1273		3
1302	1274		4
1303	1275		5
1304	1276		6
1305	1277		7
1306	1278		8
1307	1279		9
1308	1280		10
1309	1281		11
1310	1282		12
1311	1283		13
1312	1284		14
1313	1285		15
1314	1286		16
1315	1287		17
1316	1288		18
1317	1289		19
1318	1290		20
1319	1291		21
1320	1292		22
1321	1293		23
1322	1294		24
1323	1295
1324		-	1936, as amended, that has established and maintains
1325		-	an information security program pursuant to such
1326		-	statutes, rules, regulation s, procedures, or
1327		-	guidelines established thereunder, will be considered
1328		-	to meet the requirements of Section 4 of this act,
1329		-	provided that the licensee is compliant with and
1330		-	submits a written statement to the Commission er
1331		-	certifying its compliance with the same, and
1332	1296		c. an employee, agent, repre sentative, or designee of a
1333	1297		licensee, who is also a licensee, is exempt from this
1334	1298		act and shall not be required to develop their own
1335	1299		information security program to the extent that the
1336	1300		employee, agent, representative , or designee is
1337	1301		covered by the information security program of the
1338	1302		licensee.
1339	1303		2. If a licensee ceases to qualify for an exception, the
1340	1304		licensee shall have one hundred eighty (180) days to comply with the
1341	1305		provisions of this act.
1342	1306		C. In the case of a violation of this act, a licensee may be
1343	1307		penalized in accordance with any a pplicable sections of the
1344	1308		Insurance Code, including, but not limited to, Section 908 of Title
1345	1309		36 of the Oklahoma Statutes, or any other provisi on providing for
1346	1310		penalties that the licensee is subject to under the license or
1347	1311		permit of the licensee. Nothing in this act shall be construed to
	1312	+	impose any civil liability for any violation of this act or omission
	1313	+	to act by the licensee or employees of the license e.
	1314	+	D. The provisions of this act shall take precedence over any
	1315	+	other state laws applicable to license es for data security and the
	1316	+	investigation of a cybersecurity event.
	1317	+	SECTION 10. NEW LAW A new section of law to be codified
	1318	+	in the Oklahoma Statutes as Section 679 of Title 36, unless there is
	1319	+	created a duplication in numbering, reads as follows:
1348	1320
1349		-	SB543 HFLR Page 27
1350		-	BOLD FACE denotes Committee Amendments. 1
	1321	+	ENGR. S. B. NO. 543 Page 27 1
1351	1322		2
1352	1323		3
1353	1324		4
1354	1325		5
1355	1326		6
1356	1327		7
1357	1328		8
1358	1329		9
1359	1330		10
1360	1331		11
1361	1332		12
1362	1333		13
1363	1334		14
1364	1335		15
1365	1336		16
1366	1337		17
1367	1338		18
1368	1339		19
1369	1340		20
1370	1341		21
1371	1342		22
1372	1343		23
1373	1344		24
1374	1345
1375		-	impose any civil liability for any violation of this act or omission
1376		-	to act by the licensee or employees of the license e.
1377		-	D. The provisions of this act sha ll take precedence over any
1378		-	other state laws applicable to license es for data security and the
1379		-	investigation of a cybersecurity event.
1380		-	SECTION 10. NEW LAW A new section of law to be codified
1381		-	in the Oklahoma Statutes as Section 679 of Title 36, unless there is
1382		-	created a duplication in numbering, reads as follows:
1383	1346		Licensees shall have one (1) year from the effective date of
1384	1347		this act to implement Section 4 of this act and two (2) years from
1385	1348		the effective date of this act to implement subsection F of Section
1386	1349		4 of this act.
1387		-	SECTION 11. This act shall become effective November 1, 20 23.
	1350	+	SECTION 11. AMENDATORY 51 O.S. 2021, Section 24A.3, as
	1351	+	last amended by Section 1, Chapter 402, O.S.L. 2022 (51 O.S. Supp.
	1352	+	2022, Section 24A.3), is amended to read as follows:
	1353	+	Section 24A.3. As used in the Oklahoma Open Records Act:
	1354	+	1. “Record” means all documents including, but not limited to,
	1355	+	any book, paper, photograph, microfilm, data files created by or
	1356	+	used with computer software, computer tape, disk, record, sound
	1357	+	recording, film recording, video record or other material regardless
	1358	+	of physical form or characteristic, created by, received by, under
	1359	+	the authority of, or coming into the custody, control or possession
	1360	+	of public officials, public bodies or their representatives in
	1361	+	connection with the transaction of public bus iness, the expenditure
	1362	+	of public funds or the administering of public property. “Record”
	1363	+	Record does not mean:
	1364	+	a. computer software,
	1365	+	b. nongovernment personal effects,
	1366	+	c. unless public disclosure is required by other laws or
	1367	+	regulations, vehicle movement records of the Oklahoma
	1368	+	Transportation Authority obtained in connection with
	1369	+	the Authority’s electronic toll collection system,
1388	1370
1389		-	COMMITTEE REPORT BY: COMMITTEE ON INSURANCE, dated 04/05/2023 - DO
1390		-	PASS, As Amended.
	1371	+	ENGR. S. B. NO. 543 Page 28 1
	1372	+	2
	1373	+	3
	1374	+	4
	1375	+	5
	1376	+	6
	1377	+	7
	1378	+	8
	1379	+	9
	1380	+	10
	1381	+	11
	1382	+	12
	1383	+	13
	1384	+	14
	1385	+	15
	1386	+	16
	1387	+	17
	1388	+	18
	1389	+	19
	1390	+	20
	1391	+	21
	1392	+	22
	1393	+	23
	1394	+	24
	1395	+
	1396	+	d. personal financial information, credit reports or
	1397	+	other financial data obtained by or submitted to a
	1398	+	public body for the purpose of evaluating credit
	1399	+	worthiness, obtaining a license, permit or for the
	1400	+	purpose of becoming qualified to contract with a
	1401	+	public body,
	1402	+	e. any digital audio/video recordings of the toll
	1403	+	collection and safeguarding activities of the Oklahoma
	1404	+	Transportation Authority,
	1405	+	f. any personal information provided by a guest at any
	1406	+	facility owned or operated by the Oklahoma Tourism and
	1407	+	Recreation Department to obtain any service at t he
	1408	+	facility or by a purchaser of a product sold by or
	1409	+	through the Oklahoma Tourism and Recre ation
	1410	+	Department,
	1411	+	g. a Department of Defense Form 214 (DD Form 214) filed
	1412	+	with a county clerk including any DD Form 214 filed
	1413	+	before July 1, 2002,
	1414	+	h. except as provided for in Section 2 -110 of Title 47 of
	1415	+	the Oklahoma Statutes,:
	1416	+	(1) any record in connectio n with a Motor Vehicle
	1417	+	Report issued by the Department of Public Safety,
	1418	+	as prescribed in Section 6-117 of Title 47 of the
	1419	+	Oklahoma Statutes, or
	1420	+
	1421	+	ENGR. S. B. NO. 543 Page 29 1
	1422	+	2
	1423	+	3
	1424	+	4
	1425	+	5
	1426	+	6
	1427	+	7
	1428	+	8
	1429	+	9
	1430	+	10
	1431	+	11
	1432	+	12
	1433	+	13
	1434	+	14
	1435	+	15
	1436	+	16
	1437	+	17
	1438	+	18
	1439	+	19
	1440	+	20
	1441	+	21
	1442	+	22
	1443	+	23
	1444	+	24
	1445	+
	1446	+	(2) personal information within driver records, as
	1447	+	defined by the Driver ’s Privacy Protection Act,
	1448	+	18 United States Code, Sections 2721 thr ough
	1449	+	2725, which are stored and maintained by the
	1450	+	Department of Public Safety, or
	1451	+	i. any portion of any document or information provided to
	1452	+	an agency or entity of the state or a political
	1453	+	subdivision to obtain licensure under th e laws of this
	1454	+	state or a political subdivision that contains an
	1455	+	applicant’s personal address, personal phone number,
	1456	+	personal electronic mail address or other contact
	1457	+	information. Provided, how ever, lists of persons
	1458	+	licensed, the existence of a license o f a person, or a
	1459	+	business or commercial address, or other business or
	1460	+	commercial information disclosable under state law
	1461	+	submitted with an application for licensure shall be
	1462	+	public record, or
	1463	+	j. information relating to a cybersecurity event reported
	1464	+	to the Insurance Commissioner purs uant to the
	1465	+	Insurance Data Security Act;
	1466	+	2. “Public body” shall include, but not be limited to, any
	1467	+	office, department, board, bureau, commission, agency, trusteesh ip,
	1468	+	authority, council, committee, trust or any entity cr eated by a
	1469	+	trust, county, city, village, town, township, district, school
	1470	+
	1471	+	ENGR. S. B. NO. 543 Page 30 1
	1472	+	2
	1473	+	3
	1474	+	4
	1475	+	5
	1476	+	6
	1477	+	7
	1478	+	8
	1479	+	9
	1480	+	10
	1481	+	11
	1482	+	12
	1483	+	13
	1484	+	14
	1485	+	15
	1486	+	16
	1487	+	17
	1488	+	18
	1489	+	19
	1490	+	20
	1491	+	21
	1492	+	22
	1493	+	23
	1494	+	24
	1495	+
	1496	+	district, fair board, court, executive office, advisory group, task
	1497	+	force, study group or any subdivision thereof, supported in whole or
	1498	+	in part by public funds or entrusted with th e expenditure of public
	1499	+	funds or administering or operating public property, and all
	1500	+	committees, or subcommittees thereof. Except for the records
	1501	+	required by Section 24A.4 of this title, “public body” public body
	1502	+	does not mean judges, justices, the Council on Ju dicial Complaints,
	1503	+	the Legislature or legislators. “Public body” Public body shall not
	1504	+	include an organization that is exempt from federal income tax under
	1505	+	Section 501(c)(3) of the Internal Revenue Code of 1986, as amended,
	1506	+	and whose sole beneficiary is a college or university, or an
	1507	+	affiliated entity of the college or university, that is a member of
	1508	+	The Oklahoma State System of Higher Education. Such organization
	1509	+	shall not receive direct appropria tions from the Oklahoma
	1510	+	Legislature. The following persons shall not be eligible to serve
	1511	+	as a voting member of the governing bo ard of the organization:
	1512	+	a. a member, officer, or employee of the Oklahoma State
	1513	+	Regents for Higher Education,
	1514	+	b. a member of the board of regents or other governing
	1515	+	board of the college or university that is the sole
	1516	+	beneficiary of the organization, or
	1517	+	c. an officer or employee of the college or university
	1518	+	that is the sole beneficiary of the organization;
	1519	+
	1520	+	ENGR. S. B. NO. 543 Page 31 1
	1521	+	2
	1522	+	3
	1523	+	4
	1524	+	5
	1525	+	6
	1526	+	7
	1527	+	8
	1528	+	9
	1529	+	10
	1530	+	11
	1531	+	12
	1532	+	13
	1533	+	14
	1534	+	15
	1535	+	16
	1536	+	17
	1537	+	18
	1538	+	19
	1539	+	20
	1540	+	21
	1541	+	22
	1542	+	23
	1543	+	24
	1544	+
	1545	+	3. “Public office” means the physical lo cation where public
	1546	+	bodies conduct busine ss or keep records;
	1547	+	4. “Public official” means any official or employee of any
	1548	+	public body as defined herein; and
	1549	+	5. “Law enforcement agency” means any public body charged with
	1550	+	enforcing state or local criminal laws and initiating criminal
	1551	+	prosecutions including, but not limited to, police departments,
	1552	+	county sheriffs, the Departm ent of Public Safety, the Oklahoma State
	1553	+	Bureau of Narcotics and Dangerous Drugs Control, the Alcoholic
	1554	+	Beverage Laws Enforcement Commi ssion, and the Oklahoma State Bureau
	1555	+	of Investigation.
	1556	+	SECTION 12. This act shall become effective November 1, 20 23.
	1557	+	Passed the Senate the 20th day of March, 2023.
	1558	+
	1559	+
	1560	+
	1561	+	Presiding Officer of the Senate
	1562	+
	1563	+
	1564	+	Passed the House of Representatives the ____ day of __________,
	1565	+	2023.
	1566	+
	1567	+
	1568	+
	1569	+	Presiding Officer of the House
	1570	+	of Representatives
	1571	+