Illinois House Bill 5397 (Prior Session Legislation)

---

Spectrum: Partisan Bill (Republican 3-0)
Status: Introduced on February 14 2020 - 25% progression, died in committee
Action: 2020-02-18 - Referred to Rules Committee
Pending: House Rules Committee
Text: Latest bill text (Introduced) [HTML]

Creates the Insurance Data Security Act. Requires any person licensed, authorized to operate, or registered as an insurer in accordance with the insurance laws of this State to conduct a risk assessment of cybersecurity threats, implement appropriate security measures, and no less than annually assess the effectiveness of the safeguards' key controls, systems, and procedures. Requires a licensee to develop, implement, and maintain a written information security program based on the licensee's risk assessment. Requires each licensee to establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, the licensee's information systems, or the continuing functionality of any aspect of the licensee's business or operations. Requires licensees domiciled in this State to annually submit a written certification of compliance to the Director of Insurance. Provides that a licensee shall notify the Director as promptly as possible, but not later than 72 hours from a determination that a cybersecurity event has occurred in specified circumstances. Provides standards and procedures for risk management, data security, and notification and investigation of cybersecurity events resulting in unauthorized access to, disruption of, or misuse of nonpublic data. Provides that the Director has the power to examine and investigate to determine whether a licensee has been or is engaged in any conduct in violation of the Act. Grants the Department of Insurance rulemaking authority to implement the Act. Provides that any documents, materials, or other information obtained pursuant to the Act is confidential by law and privileged, is not subject to the Freedom of Information Act, is not subject to subpoena, and is not subject to discovery or admissible in evidence in any private civil action. Makes a conforming change in the Freedom of Information Act. Defines terms. Effective January 1, 2021.

INSURANCE DATA SECURITY ACT

Rep. Keith Wheeler [R]

Rep. Grant Wehrli [R]

Rep. Amy Grant [R]

Date	Chamber	Action
2020-02-18	House	Referred to Rules Committee
2020-02-18	House	First Reading
2020-02-14	House	Chief Co-Sponsor Rep. Amy Grant
2020-02-14	House	Chief Co-Sponsor Rep. Grant Wehrli
2020-02-14	House	Filed with the Clerk by Rep. Keith R. Wheeler

Chapter	Article	Section	Citation Type	Statute Text
5	140	7.5	Amended Code	Citation Text

Type	Source
Summary	https://www.ilga.gov/legislation/BillStatus.asp?DocNum=5397&GAID=15&DocTypeID=HB&SessionID=108&GA=101
Text	https://www.ilga.gov/legislation/101/HB/10100HB5397.htm