South Carolina's Insurance Data Security Act: Chapter 38-99 Read Against the NAIC Model

How the Chapter Came to Be

The legislature's record for H. 4655 shows the bill passing the House 105 to 2 and the Senate 38 to 0, ratification as R. 184 on May 1, 2018, the Governor's signature on May 3, and assignment as Act No. 171. Section 6 sets January 1, 2019 as the effective date. Section 3 is what added Chapter 99 of Title 38; every section in it carries that history note.

On the claim often repeated about this statute, the Department of Insurance is the source. Its cybersecurity page states: "South Carolina was the first state in the nation to pass this important and timely legislation which was modeled after the NAIC Insurance Data Security Model Law." The characterization is the agency's own. The post on Model #668 walks through the template itself; what follows is limited to what South Carolina changed.

One feature of the enacting act does not appear in the Code at all. The model's statement that the law creates no private cause of action is in Section 2B of the model, and South Carolina placed it in Section 1 of the act rather than in Chapter 99: "This act may not be construed to create or imply a private cause of action for a violation of its provisions nor may it be construed to curtail a private cause of action which would otherwise exist in the absence of this act." A reader of the codified chapter alone would not see it.

Who SC Code Chapter 38-99 Reaches

"Licensee" in section 38-99-10(9) follows the model, covering a person licensed, authorized to operate or registered, or required to be, under South Carolina's insurance laws, and leaving out out-of-state purchasing and risk retention groups and assuming insurers domiciled elsewhere. Consumers are South Carolina residents whose nonpublic information a licensee holds.

The reach grew after enactment. Captive insurers sit under a provision stating that no other part of Title 38 applies to them unless Chapter 90 says so, and Section 10 of 2019 Act No. 6 (S. 360) amended that provision. section 38-90-160(A) reads in part:

The South Carolina Insurance Data Security Act set forth in Chapter 99, Title 38 applies to captive insurance companies unless the captive insurer qualifies for an exemption set forth in that chapter.

S.C. Code section 38-90-160(A)

Subsection (C), rewritten by the same section of Act 6, lists Chapter 99 among the chapters that "apply in full to a risk retention group." Neither the model nor its drafting notes speak to captives.

The Information Security Program: Small Changes in Wording and a Shorter Runway

Section 38-99-20 reproduces the model's Section 4 almost clause for clause, including the February fifteenth certification by domestic insurers in subsection (I). Three differences stand out on a side-by-side reading.

• Timing. Model Section 13 gives licensees one year from the effective date for the program and two for vendor oversight. Section 4 of Act 171 uses fixed dates instead, July 1, 2019 and July 1, 2020, which is six and eighteen months after January 1, 2019.
• Testing of outside software. The model speaks of procedures for "evaluating, assessing or testing" externally developed applications; section 38-99-20(D)(2)(e) reads "evaluating, assessing, and testing."
• Delegation. Where the model's subsection E(3) ties delegation to "Section 4 of this Act," section 38-99-20(E)(2) speaks of delegating "any of its responsibilities under this chapter," which is not limited to the program section.

The Department's Bulletin 2020-04, issued April 17, 2020 ahead of the vendor deadline, adds a fact from the agency's own files about why subsection (F) matters: "Third-party service providers have been responsible for most of the cyber event notifications the South Carolina Department of Insurance (Department) has received to date." The same bulletin says a licensee's failure to run an effective third-party risk process "may constitute an unsound or hazardous condition."

Notice to the Director

Section 38-99-40(A) is where the text most visibly departs from Model Section 6A. The model calls for notice "as promptly as possible but in no event later than 72 hours from a determination." South Carolina's version opens differently: a licensee "shall notify the director no later than seventy-two hours after determining that a cybersecurity event has occurred." The instruction to act as promptly as possible does not appear in the South Carolina text.

The investigation section moves in the opposite direction. Model Section 5B requires a licensee to determine "as much of the following information as possible"; section 38-99-30(B) drops the qualifier and says the licensee "shall, at a minimum" determine whether an event occurred, assess its nature and scope, identify the information involved, and perform or oversee restoration of security.

The two triggers follow the model. Notice is due where South Carolina is an insurer's domicile or a producer's home state, or where the licensee reasonably believes the information of "no less than two hundred and fifty consumers residing in this State" is involved and either a government notice duty applies or material harm is reasonably likely.

Agency guidance fills in practical edges the statute leaves open. Bulletin 2018-09 states that "[l]oss of information only in paper format does not constitute a Cybersecurity event," that notice is not expected for temporary service disruptions from power outages or other benign causes unless they result in unauthorized access or misuse, and that the Department recognizes detailed information may not be available within 72 hours. It describes a "Report a Cybersecurity Event" form under which a licensee receives an event number and returns to update the filing. The same bulletin quotes the definition of a cybersecurity event in the model's wording, and the codified definition in section 38-99-10(3) differs slightly from that quotation.

Notice to Consumers

Chapter 99 contains no consumer notice clock of its own. Section 38-99-40(C) directs a licensee to comply with section 39-1-90 "and other applicable law," and to give the director a copy of the notice sent to consumers "when a licensee is required to notify the director." The model has the same structure, with a bracket for the state's breach statute.

The two regimes run on different triggers. Section 39-1-90 is built around personal identifying information and is keyed to circumstances where illegal use "has occurred or is reasonably likely to occur" or use of the information "creates a material risk of harm to the resident," with disclosure "in the most expedient time possible and without unreasonable delay." Chapter 99's director notice is keyed to a determination that a cybersecurity event occurred, which reaches a licensee's business information and health data. An event can therefore involve notice to the director under one statute without consumer notice under the other.

Exemptions After the 2019 Amendment

As enacted in 2018, section 38-99-70(A) exempted qualifying licensees "from the provisions of this chapter," a broader sweep than the model, which confines its exceptions to Section 4. Section 11 of 2019 Act No. 6 rewrote the subsection so that each exemption reaches only section 38-99-20, and the history note gives that change an effective date of July 1, 2019. The Department had already taken that position: Bulletin 2018-12, dated November 2, 2018, told licensees that exempt licensees "must still comply with other provisions of the Act, such as the prompt investigation and reporting of cybersecurity events to the Director."

The current subsection covers a licensee with fewer than ten employees, including independent contractors; an employee, agent, representative or designee who is itself a licensee, to the extent covered by another licensee's program; and a HIPAA-regulated licensee that maintains a program under those rules. On the third, the wording differs from the model in a way that changes what is certified. The model's condition is compliance with, and certification of compliance with, "the same," meaning the HIPAA requirements. South Carolina's condition is that the licensee "is compliant with, and submits a written statement certifying its compliance with, the provisions of Section 38-99-20." Section 38-99-70(B) keeps the model's 180-day transition for a licensee that stops qualifying.

Bulletin 2018-12 goes beyond the statute in one respect. It lists a fourth exempt category: "A licensee who is subject to the New York cybersecurity regulation, provided that the licensee is compliant with and submits a written statement certifying its compliance with the provisions of Section 38-99-20." Section 38-99-70 has no such item; the model mentions Part 500 only in a drafting note. The bulletin also states that licensees "do not need to proactively communicate their exemption status to the Department" but must be able to document it on request.

Confidentiality and Provisions the Model Lacks

Model Section 8A confidentiality covers documents furnished under listed provisions: the annual certification and specified items of the notice. Section 38-99-60(A) drops that list and protects documents "furnished by a licensee or an employee or agent acting on behalf of a licensee," along with those obtained in an examination, without tying the protection to particular provisions. Subsection (C)(3) also allows sharing with "a third-party consultant or vendor" where the model says service provider or vendor. The reporting form attached to Bulletin 2018-09 has the filer acknowledge that the Department may be required to release statistical or aggregate information and may also make consumer notices and summary information about events requiring public notification available on its website.

Section 38-99-100 has no model counterpart. It provides that nothing in the chapter "creates any duty or liability for a provider of communication services for the transmission of voice, data, or other information over its network."

Penalties and the Enforcement Record

Section 38-99-80 routes violations to section 38-2-10, the general insurance penalty section, which applies to "each violation." An insurer, pharmacy benefits manager or health maintenance organization faces a fine of up to $15,000, or up to $30,000 if the violation is wilful, and suspension or revocation of its authority. Other licensed persons face up to $2,500, or up to $5,000 if wilful, and suspension or revocation of the license. Section 38-99-50 gives the director examination and enforcement authority, and section 38-99-90 authorizes regulations.

No enforcement action under Chapter 99 was located for this article. The Department publishes enforcement orders by year on its Bulletins and Orders page, but the yearly folders returned only an empty shell without their document listings when requested, and a domain-restricted search surfaced consent orders on unrelated conduct and none citing section 38-99. The record here is therefore zero located, not a finding that no such order exists.

Frequently Asked Questions