Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the incident response and data-breach notification obligations that will govern the proposed enterprise data-licensing arrangement between Quorum Insurance Holdings Corp. ("Quorum") and Meridian Credit intelligence, Inc. ("Meridian"), and to recommend specific contractual provisions for inclusion in the Data Security Addendum ("DSA") to the Master Data

II. Nature of Data at Issue and Risk Profile A. Data Products and Categories A thorough analysis of breach-notification obligations requires a clear understanding of the specific data products involved in the proposed arrangement and the categories of information they contain. Each of the three Meridian data products implicates distinct categories of personally identifiable information ("PII") and commercially sensit

III. Federal Statutory Framework A. Fair Credit Reporting Act (FCRA) The Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., is the principal federal statute governing the collection, dissemination, and use of consumer credit information. Because Quorum's intended use of Meridian data for insurance underwriting purposes constitutes a "consumer report" use within the meaning of 15 U.S.C. § 1681a(d), the FCRA imposes

IV. State Breach Notification Laws — Multi-State Analysis A. Overview of the State Landscape All 50 states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted data-breach notification laws imposing obligations on entities that experience unauthorized access to or acquisition of personal information. Because Quorum is licensed as an insurer in all 50 states and the District of Columb

1. New York New York is a critical jurisdiction for this analysis for two independent reasons: Quorum is a licensed insurer in New York, and New York's regulatory framework for data security in the financial services sector is among the most rigorous in the nation. NY General Business Law § 899-aa. New York's general breach-notification law requires any person or business that conducts business in the state and maint

Section 500.17 of the regulation establishes breach-notification requirements that are among the most aggressive in the country. A covered entity is required to notify the Superintendent of Financial Services within 72 hours of determining that a "Cybersecurity Event" has occurred if the event satisfies either of two criteria: (a) the event has a reasonable likelihood of materially harming any material part of the no

Section 500.11 addresses third-party service provider security policy requirements. Covered entities are required to implement written policies and procedures designed to ensure the security of information systems and nonpublic information that is accessible to, or held by, third-party service providers. While Meridian is technically a data licensor rather than a traditional "service provider," the scope of § 500.11

2. Connecticut. Connecticut is of particular importance to this analysis because Quorum is headquartered in Stamford, Connecticut, making Connecticut Quorum's domiciliary state for insurance regulatory purposes. Connecticut General Statutes § 36a-701b. Connecticut's general breach-notification law, as amended, requires persons conducting business in the state who own, license, or maintain computerized data that inclu

3. California (CCPA/CPRA) California presents a uniquely complex compliance challenge because, in addition to its general breach-notification law, it has enacted the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), which together create a private right of action for data breaches and expose Quorum to potentially massive statutory damages. California Civil Code § 1798.82 — Gener

4. Georgia. Georgia is relevant to this analysis primarily because Meridian is headquartered in Atlanta, Georgia. Georgia's breach-notification law, codified at O.C.G.A. § 10-1-912, requires any information broker or data collector that maintains computerized data that includes personal information of Georgia residents to give notice of a breach of the security of the system to affected residents "in the most expedie

5. Massachusetts. Massachusetts warrants specific attention for two reasons: Quorum operates as a licensed insurer in Massachusetts, and Massachusetts has adopted data-security regulations that are among the most prescriptive in the country. 201 C.M.R. 17.00 — Standards for the Protection of Personal Information. Massachusetts regulations require every person that owns or licenses personal information of Massachusett

6. Other Notable Jurisdictions In addition to the jurisdictions analyzed in detail above, several other states impose notification deadlines or requirements that are particularly noteworthy: Florida (Fla. Stat. § 501.171). Florida imposes a 30-day notification deadline for notifications to affected individuals, measured from the date of determination that a breach has occurred or the date on which the entity has reas

V. NAIC Insurance Data Security Model Law Considerations The NAIC Insurance Data Security Model Law, adopted by the National Association of Insurance Commissioners in 2017, establishes a comprehensive framework for data-security requirements applicable to licensed insurers. The Model Law is designed to serve as a template for adoption by state legislatures, and as of the date of this memorandum, it has been enacted i

VI. The 48-Hour Contractual Notification Requirement A. Definition of "Discovery" The parties have agreed in principle that the DSA will require each party to provide the other with notification of a data breach or security incident within 48 hours. However, the utility and enforceability of a 48-hour notification obligation depends critically on the precision with which the DSA defines the term "Discovery," as this