California Insurance Commission Requires Breach Notification

In May, the California Insurance Commissioner notified insurance companies of a new obligation for any entities doing business in that state. The additional requirement applies to such insurers in the event of a data breach involving more than 500 California residents. Companies are now required to alert the Insurance Commissioner’s office of any data breach notifications sent to the Attorney General’s office as covered under California’s data breach notification law. The law states that companies doing business in California and own or license any computerized data, and suffer any data breach of unencrypted personally identifiable information(PII) involving more than 500 people, notify the persons affected, and disclose the security breach to the Attorney General by sending a sample copy of that notification (without the PII) to the AG’s office.