Sec. 23. (a) In the case of a cybersecurity event:

(1) that involves nonpublic information:

Terms Used In Indiana Code 27-2-27-23

  • consumer: means a resident of Indiana whose nonpublic information is in a licensee's possession, custody, or control. See Indiana Code 27-2-27-4
  • Contract: A legal written agreement that becomes binding when signed.
  • cybersecurity event: means an event resulting in unauthorized access to or a disruption or misuse of an information system or nonpublic information stored on the information system that has a reasonable likelihood of materially harming a consumer or any material part of the normal operations of the licensee. See Indiana Code 27-2-27-5
  • licensee: means a person that is:

    Indiana Code 27-2-27-10

  • nonpublic information: means electronic information that is not publicly available information and is described in either of the following subdivisions:

    Indiana Code 27-2-27-12

  • Obligation: An order placed, contract awarded, service received, or similar transaction during a given period that will require payments during the same or a future period.
  • third party service provider: means a person that contracts with a licensee to maintain, process, store, or otherwise is permitted access to nonpublic information through its provision of services to the licensee. See Indiana Code 27-2-27-15
(A) that is in the possession, custody, or control of a licensee that is an insurer or its third party service provider; and

(B) for which a consumer accessed the insurer’s services through an independent insurance producer; and

(2) for which consumer notice is required by IC 24-4.9;

the insurer shall notify the producers of record of all affected consumers of the cybersecurity event not later than the time at which notice is provided to the affected consumers.

     (b) The insurer is excused from the obligation set forth in subsection (a):

(1) for any producers who are not authorized by law or contract to sell, solicit, or negotiate on behalf of the insurer; and

(2) in those instances in which the insurer does not have the current producer of record information for an individual consumer.

As added by P.L.130-2020, SEC.10.

  Previous section
Next section  
 Chapter 27 Contents