(A) The following licensees are exempt from the provisions of Section 38-99-20:

(1) a licensee with fewer than ten employees, including any independent contractors;

(2) an employee, agent, representative, or designee of a licensee, who is also a licensee, is exempt from the provisions of Section 38-99-20 and need not develop its own information security program to the extent that the employee, agent, representative, or designee is covered by the information security program of the other licensee; and

(3) a licensee subject to the Health Insurance Portability and Accountability Act, Pub.L. 104-191, 110 Stat. 1936, that has established and maintains an information security program pursuant to such statutes, rules, regulations, procedures, or guidelines established thereunder, will be considered to meet the requirements of Section 38-99-20, provided that the licensee is compliant with, and submits a written statement certifying its compliance with, the provisions of Section 38-99-20.

(B) In the event that a licensee ceases to qualify for an exception, such licensee shall have one hundred and eighty days to comply with this chapter.

HISTORY: 2018 Act No. 171 (H.4655), Section 3, eff January 1, 2019; 2019 Act No. 6 (S.360), Section 11, eff July 1, 2019.

Editor's Note

2018 Act No. 171, Sections 1 and 2, provide as follows:

"SECTION 1. The purpose and intent of this act is to establish standards for data security and standards for the investigation of and notification to the director of a cybersecurity event applicable to licensees. This act may not be construed to create or imply a private cause of action for a violation of its provisions nor may it be construed to curtail a private cause of action which would otherwise exist in the absence of this act.

"SECTION 2. This act is known and may be cited as the 'South Carolina Insurance Data Security Act'."

Effect of Amendment

2019 Act No. 6, Section 11, in (A), substituted "Section 38-99-20" for "this chapter", in (2), substituted "Section 38-99-20" for "this chapter", in (3), substituted "Section 38-99-20" for "this chapter" in two places, and made nonsubstantive changes.