On October 14, 2015, the National Association of Insurance
Commissioners' (NAIC) Cybersecurity Task Force adopted the Cybersecurity Bill of
Rights, a document meant to inform consumers of the services
they can expect from insurance entities that possess their personal
information. The Bill of Rights is part of an ongoing effort by the
Task Force to improve response measures among insurance entities,
update NAIC model laws on cybersecurity, and educate consumers on
how best to protect their information when a data breach
occurs.
The document notes, "This Cybersecurity Bill of Rights
describes what you can expect from insurance companies," but
"Your specific rights may vary based on state and federal
law." This clause, added in response to legitimate concerns
that the rights declared could conflict with existing state and
federal provisions, makes the Bill of Rights more an aspirational
and informational document than a legal one. In addition, adoption
by the NAIC
