PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE ATTORNEY WORK PRODUCT
MEMORANDUM
TO: Carolyn Whitford, General Counsel & Executive Vice President, Quorum Insurance Holdings Corp. Gregory Stahl, Vice President, Legal Affairs, Quorum Insurance Holdings Corp.
FROM: David Cartwright, Partner, Data Privacy & Cybersecurity, Calderwood & Harkness LLP Lisa Johannsen, Associate, Data Privacy & Cybersecurity, Calderwood & Harkness LLP
DATE: February 22, 2023
RE: Incident Response and Breach Notification Obligations Applicable to the Proposed Quorum–Meridian Data-Licensing Arrangement
MATTER NO.: C&H Matter No. 1025-00008
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to analyze the incident response and data-breach notification obligations that will govern the proposed enterprise data-licensing arrangement between Quorum Insurance Holdings Corp. ("Quorum") and Meridian Credit intelligence, Inc. ("Meridian"), and to recommend specific contractual provisions for inclusion in the Data Security Addendum ("DSA") to the Master Data License Agreement ("MDLA"). This memorandum is prepared at the request of Quorum's General Counsel to inform both the internal compliance assessment and the ongoing negotiation of the DSA with Meridian's outside counsel, Kessler Pruitt & Ashe LLP.
Under the proposed MDLA, Quorum will receive and process substantial volumes of consumer and commercial credit data from Meridian across three distinct data products. Specifically, Quorum will receive daily and weekly feeds of consumer credit-file data encompassing approximately 310 million consumer records (delivered via the MCI Consumer Credit File™ product), commercial credit data covering approximately 42 million business records (delivered via the MCI CommercialView™ product), and alternative consumer data covering approximately 85 million consumer alt-data records (delivered via the MCI AltSignal™ product). In aggregate, this arrangement will involve the transfer and processing of approximately 437 million records per month, delivered through a combination of SFTP batch transfers and a real-time REST API. This volume represents approximately 87.4% of the 500 million records-per-month base tier contemplated in the MDLA pricing schedule.
The nature and volume of data involved in this arrangement — encompassing consumer financial information, tradeline and payment-history data, Social Security numbers, dates of birth, addresses, account numbers, credit inquiries, employer identification numbers, personal guarantor information, and commercial credit information — triggers a complex and overlapping web of federal and state breach-notification and incident-response obligations. The data at issue includes some of the most sensitive categories of consumer information recognized under U.S. law, and any unauthorized access to or acquisition of this data would carry significant legal, regulatory, financial, and reputational consequences for both parties.
The parties have agreed in principle to a 48-hour breach notification timeline, measured from "Discovery" of a qualifying incident. While this timeline is commercially reasonable and, as we will demonstrate, appropriately aggressive to accommodate the most stringent regulatory deadlines applicable to Quorum, the DSA must be carefully drafted to accomplish several critical objectives. The DSA must precisely define the term "Discovery" using an objective standard that prevents any party from delaying the commencement of the notification clock. It must allocate incident-response and breach-notification obligations between Quorum and Meridian in a manner that reflects the parties' respective roles as data licensor and data recipient. It must clearly delineate responsibilities for regulatory reporting to federal and state authorities, including insurance-specific regulators. And it must account for the full multi-jurisdictional scope of applicable federal and state laws, given Quorum's operations in all 50 states and the District of Columbia.
This memorandum undertakes the following analyses: (a) a survey of the federal statutory framework, with particular attention to the Fair Credit Reporting Act ("FCRA") and the Gramm-Leach-Bliley Act ("GLBA"), as those statutes impose distinct but related obligations on the parties; (b) a detailed, state-by-state analysis of the breach notification laws applicable to Quorum's multi-state insurance operations, with in-depth treatment of the jurisdictions posing the greatest compliance challenges; (c) an analysis of the California Consumer Privacy Act/California Privacy Rights Act ("CCPA/CPRA") obligations, including the private right of action and statutory damages provisions; (d) a thorough examination of the New York Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500), which imposes some of the most aggressive breach-reporting requirements in the country; (e) a discussion of state insurance data-security regulations, including those enacted in Connecticut (Quorum's home state) and other jurisdictions that have adopted the NAIC Insurance Data Security Model Law; and (f) a set of specific, actionable recommendations for contractual provisions to be incorporated into the DSA, accompanied by proposed draft language set forth in Appendix B.
We conclude that the 48-hour contractual notification obligation agreed upon in principle by the parties is appropriate and should be maintained, but that substantial additional drafting work is required to ensure that the DSA adequately protects Quorum's interests across the full spectrum of applicable legal requirements.
II. Nature of Data at Issue and Risk Profile
A. Data Products and Categories
A thorough analysis of breach-notification obligations requires a clear understanding of the specific data products involved in the proposed arrangement and the categories of information they contain. Each of the three Meridian data products implicates distinct categories of personally identifiable information ("PII") and commercially sensitive data, and the breach-notification analysis differs in important respects depending on which data product is involved.
MCI Consumer Credit File™. This product constitutes the core of the proposed data-licensing arrangement. The MCI Consumer Credit File provides full-file consumer tradeline data covering approximately 310 million individual consumer records. Each record includes, at minimum, the following categories of personally identifiable information: the consumer's full legal name (including any known aliases or former names); Social Security number; date of birth; current and historical residential addresses (typically going back seven to ten years); telephone numbers; employer information; account numbers for credit accounts maintained by the consumer; detailed payment histories across all reported tradelines; current account balances; credit limits; dates of account opening and closure; account status designations (current, delinquent, charge-off, etc.); records of credit inquiries made by third parties; and public record information, including bankruptcies, tax liens, and civil judgments, to the extent reported. The data is delivered via daily SFTP batch transfers and is also available through a real-time REST API for on-demand inquiries in connection with individual underwriting decisions.
MCI CommercialView™. This product provides commercial credit data on approximately 42 million business entities. Each business record includes the business legal name, trade names (d/b/a designations), business address, Employer Identification Number ("EIN"), NAICS/SIC codes, business financial information (including estimated revenue and employee counts), trade payment data reflecting the business's payment history with its commercial creditors, and business credit scores and ratings. Critically for purposes of this memorandum, many MCI CommercialView records also include personal guarantor information — that is, personally identifiable information about individual persons who have provided personal guarantees for business credit obligations. Such personal guarantor information may include the guarantor's name, Social Security number, date of birth, and residential address, which constitutes consumer PII and may qualify as consumer report information under the FCRA. The data is delivered via weekly SFTP batch transfers.
MCI AltSignal™. This product provides alternative consumer data encompassing utility payment data, telecommunications payment data, and residential rental payment data on approximately 85 million consumer records. Each record includes the consumer's name, address, Social Security number (where available), account identifiers for utility, telecom, and rental accounts, and detailed payment histories for such accounts. This data constitutes both consumer financial information and PII, and a growing body of regulatory guidance (including CFPB guidance on alternative data in credit decisioning) treats this category of data as subject to FCRA obligations when used in connection with credit or insurance underwriting decisions. The data is delivered via daily SFTP batch transfers.
Aggregate Volume. Across all three data products, the total estimated monthly volume of records processed under the proposed arrangement is approximately 437 million records per month. This volume represents approximately 87.4% of the 500 million records-per-month base tier established in the MDLA pricing schedule, with additional per-record charges applicable to volumes exceeding the base tier. The sheer scale of data transfer and processing — spanning hundreds of millions of consumer records containing Social Security numbers and detailed financial information — magnifies both the probability and the potential severity of any data-security incident.
B. Risk Profile Assessment
The risk profile associated with this data-licensing arrangement is, by any reasonable measure, exceptionally high. Several factors contribute to this assessment.
First, the massive volume of consumer PII involved creates significant breach exposure. A single incident affecting even a fraction of the data at issue could result in the compromise of tens of millions of consumer records, each containing Social Security numbers and detailed financial information. The scale of potential exposure is comparable to the most significant consumer data breaches in recent history, and regulators, plaintiffs' attorneys, and the media would treat any breach involving data of this magnitude with commensurately heightened attention.
Second, credit bureau data is among the most sensitive categories of consumer information recognized under U.S. law. Federal and state regulators have consistently taken the position that consumer credit file data — particularly when it includes Social Security numbers, account numbers, and detailed payment histories — warrants the highest level of protection. This position is well supported by recent enforcement history. The Federal Trade Commission's 2019 settlement with Pinnacle Partners LLC resulting from that company's 2017 data breach, which resulted in a $575 million settlement (subsequently increased to $700 million), demonstrated the extraordinary regulatory and financial exposure associated with credit bureau data breaches. State attorneys general have likewise pursued aggressive enforcement actions against both credit bureaus and their licensees who fail to maintain adequate security over consumer report information. A breach involving Meridian-sourced credit data licensed to Quorum would attract similar scrutiny from the FTC, the Consumer Financial Protection Bureau ("CFPB"), state attorneys general, and state insurance regulators.
Third, Quorum's status as a multi-line insurance carrier operating in all 50 states plus the District of Columbia means that the company is subject to the broadest possible scope of state breach-notification laws. Unlike a company with a more limited geographic footprint, Quorum cannot rely on compliance with the notification requirements of a single jurisdiction or a handful of key states. Any breach involving the Meridian data would, given the nationwide scope of the consumer records at issue, almost certainly trigger notification obligations in every U.S. jurisdiction simultaneously. This creates a formidable compliance challenge, as the notification deadlines, content requirements, and regulatory reporting obligations vary materially across jurisdictions.
Fourth, Quorum's status as a regulated insurance company triggers additional, insurance-specific data-security requirements that go beyond the general-purpose breach notification laws applicable to all businesses. These include the New York Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500), the Connecticut Insurance Department data-security requirements enacted pursuant to the NAIC Insurance Data Security Model Law, and analogous requirements in other states that have adopted the NAIC model. These insurance-specific regimes typically impose shorter notification deadlines, more detailed reporting requirements, and more prescriptive security standards than the general-purpose state breach-notification laws.
Taken together, these factors establish that the proposed data-licensing arrangement carries an exceptionally high risk profile from a data-security and breach-notification perspective, and that the contractual provisions governing incident response and breach notification must be drafted with corresponding rigor.
III. Federal Statutory Framework
A. Fair Credit Reporting Act (FCRA)
The Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., is the principal federal statute governing the collection, dissemination, and use of consumer credit information. Because Quorum's intended use of Meridian data for insurance underwriting purposes constitutes a "consumer report" use within the meaning of 15 U.S.C. § 1681a(d), the FCRA imposes a range of obligations on both Meridian (as the consumer reporting agency furnishing the data) and Quorum (as the user of consumer report information). Several FCRA provisions are directly relevant to the breach-notification and incident-response analysis.
FCRA § 615(e) (15 U.S.C. § 1681m(e)): Red Flags and Unauthorized Access. Section 615(e) of the FCRA, as implemented by the FTC's Red Flags Rule, requires users of consumer reports to develop and implement reasonable policies and procedures to detect, prevent, and mitigate identity theft. While this provision does not impose a specific breach-notification timeline, it imposes an affirmative obligation on Quorum, as a user of consumer report information, to notify Meridian (as the consumer reporting agency) if Quorum experiences unauthorized access to consumer report information. This notification enables Meridian to take steps to protect other consumers and other licensees whose data may be affected. The DSA should include reciprocal obligations that align with this statutory requirement, ensuring that both parties promptly notify the other in the event of unauthorized access.
FCRA § 623 (15 U.S.C. § 1681s-2): Furnisher Obligations. Although Quorum is primarily a user rather than a furnisher of consumer report information in the context of this arrangement, furnisher obligations may be implicated if Quorum uses Meridian data to generate information — such as insurance scores, risk models, or derived analytics — that is subsequently furnished back to any consumer reporting agency. If any component of Quorum's intended use of the data involves furnishing information to consumer reporting agencies, FCRA § 623 would impose additional obligations regarding the accuracy and integrity of furnished information, including obligations to investigate and correct inaccuracies. Any breach that results in the corruption or unauthorized alteration of data that Quorum subsequently furnishes could give rise to FCRA liability. We recommend that Quorum clarify with its underwriting and analytics teams whether any Meridian-derived data will be furnished to consumer reporting agencies, so that the DSA can be drafted accordingly.
FCRA Safeguarding Requirements. Although the FCRA does not contain a specific breach-notification provision with a defined timeline, it does impose general duties on both consumer reporting agencies and users of consumer reports to safeguard consumer report information. Section 628 of the FCRA (15 U.S.C. § 1681w) directs the FTC and other federal agencies to promulgate regulations requiring the proper disposal of consumer report information. The FTC's Disposal Rule, codified at 16 C.F.R. Part 682, requires any person who maintains or possesses consumer report information for a business purpose to properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. This requirement is directly relevant to the post-termination data return/destruction obligation in the MDLA, which contemplates a 90-day period for Quorum to return or destroy all raw Meridian data following termination or expiration of the agreement.
We note that the treatment of "Derived Data" following termination remains a disputed term in the MDLA negotiation. Quorum's position, as we understand it, is that Derived Data (defined in Article VII of the MDLA as data products, models, scores, and analytics created by Quorum using Meridian-sourced data as an input) should be owned by Quorum and retained indefinitely post-termination. Meridian has taken the position that Derived Data that incorporates or could be reverse-engineered to reveal Meridian's proprietary data constitutes a derivative work and remains subject to Meridian's intellectual property rights. This memorandum addresses breach-notification obligations during the active term of the MDLA and does not attempt to resolve the Derived Data post-termination dispute. However, as discussed in Section IX below, we recommend that the breach-notification tail provisions be drafted to cover Derived Data regardless of the ultimate resolution of the IP ownership question.
B. Gramm-Leach-Bliley Act (GLBA)
The Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq., and its implementing regulations impose information-security and privacy obligations on "financial institutions," a term that encompasses insurance companies. Quorum, as a multi-line insurance carrier, is a financial institution within the meaning of the GLBA, and the data received from Meridian constitutes "customer information" and "nonpublic personal information" subject to GLBA requirements. Several GLBA provisions are directly relevant to the DSA.
GLBA Safeguards Rule (16 C.F.R. Part 314, as amended). The Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive information-security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the institution, the nature and scope of its activities, and the sensitivity of the customer information at issue. The FTC significantly strengthened the Safeguards Rule through amendments that are scheduled to take effect on June 9, 2023 — approximately four months from the date of this memorandum. The amended Safeguards Rule introduces several new requirements that are directly relevant to the proposed data-licensing arrangement:
• Incident Response Plans: The amended rule requires financial institutions to establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information. The incident response plan must address the goals of the plan, the internal processes for responding to a security event, the definition of clear roles, responsibilities, and levels of decision-making authority, processes for external and internal communications and information sharing, requirements for remediation, documentation and reporting regarding security events and related incident response activities, and evaluation and revision of the incident response plan following a security event.
• FTC Notification Requirement: The amended Safeguards Rule introduces, for the first time, a requirement that financial institutions notify the FTC of certain security events. Specifically, a financial institution must notify the FTC as soon as practicable, and in no event later than 60 days after discovery, of a security event involving the unauthorized acquisition of unencrypted customer information of 500 or more consumers, unless law enforcement requests a delay. This notification requirement will become effective alongside the other amended Safeguards Rule provisions on June 9, 2023.
• Service Provider Oversight: Consistent with existing requirements under GLBA § 501(b), the amended Safeguards Rule reinforces the obligation of financial institutions to oversee service providers and business partners that have access to customer information. Quorum must ensure that the DSA obligates Meridian to maintain security standards consistent with GLBA requirements, as Meridian functions as a data source and, in certain respects, as a service provider to Quorum in its capacity as a financial institution. The DSA should include specific representations and covenants from Meridian regarding the adequacy of its information-security program and its commitment to maintaining compliance with security standards at least as protective as those required of Quorum under the GLBA.
GLBA Privacy Rule (Regulation P, 12 C.F.R. Part 1016). The Privacy Rule governs the collection, use, and sharing of nonpublic personal information by financial institutions. Quorum's use of Meridian data, and any downstream sharing of such data with affiliates, service providers, or other third parties, must comply with the Privacy Rule's notice, opt-out, and data-sharing restrictions. While the Privacy Rule does not directly impose breach-notification requirements, a data breach that results in unauthorized disclosure of customer information to third parties could constitute a violation of the Privacy Rule's restrictions on sharing nonpublic personal information, giving rise to additional regulatory exposure. The DSA should include provisions addressing the permissible uses and downstream sharing of Meridian data to ensure compliance with Regulation P.
C. Interplay Between FCRA and GLBA
The proposed data-licensing arrangement implicates both the FCRA and the GLBA simultaneously, as the Meridian data constitutes both "consumer report information" under the FCRA and "customer information" or "nonpublic personal information" under the GLBA. This creates a dual-compliance requirement: the DSA must be drafted to satisfy the obligations imposed by both statutory regimes, and where the two regimes impose differing requirements with respect to any particular obligation, the DSA should adopt the more stringent standard.
We note that the Interagency Guidelines Establishing Information Security Standards, originally promulgated pursuant to GLBA § 501(b) and applicable to banking entities supervised by the federal banking agencies, have been adopted by reference or analogy by a number of state insurance regulators. While these Guidelines do not apply directly to Quorum as an insurance company (as opposed to a bank), they represent a widely recognized benchmark for information-security standards in the financial services industry, and we recommend that the DSA incorporate security standards at least as protective as those set forth in the Interagency Guidelines. This approach will both strengthen Quorum's compliance posture and provide a defensible basis for arguing that Quorum maintained "reasonable security" — the standard applied by state attorneys general and the FTC in data-breach enforcement actions.
IV. State Breach Notification Laws — Multi-State Analysis
A. Overview of the State Landscape
All 50 states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted data-breach notification laws imposing obligations on entities that experience unauthorized access to or acquisition of personal information. Because Quorum is licensed as an insurer in all 50 states and the District of Columbia, and because the Meridian data encompasses consumer records for individuals residing throughout the United States, a data breach involving Meridian-sourced data could trigger notification obligations in every U.S. jurisdiction simultaneously.
The state breach-notification landscape is complex and non-uniform. While all jurisdictions share the common requirement that entities notify affected individuals of data breaches, the specific parameters of these obligations vary materially across states. The key variables that differ from jurisdiction to jurisdiction include:
(i) Definition of "Personal Information" Triggering Notification. Most states define personal information as a combination of a consumer's name plus one or more specified data elements (Social Security number, driver's license number, financial account number, etc.), but the specific data elements included in the definition vary. Some states (e.g., California, Illinois) have expanded their definitions to include medical information, biometric data, email addresses with passwords, and other categories. Given that the Meridian data includes Social Security numbers, dates of birth, account numbers, and financial information, it will satisfy the personal information definition in every jurisdiction.
(ii) Definition of "Breach" or "Unauthorized Access." Some states require actual "acquisition" of data (not merely unauthorized access), while others are triggered by unauthorized access alone. Some states distinguish between encrypted and unencrypted data, providing safe harbors for breaches involving properly encrypted data. The DSA should be drafted with reference to the broadest applicable definitions.
(iii) Notification Timing. Notification deadlines range from "the most expedient time possible and without unreasonable delay" (the standard used by a plurality of states, including New York, California, and Illinois) to specific day-count deadlines. The most aggressive specific deadlines include Colorado (30 days), Florida (30 days), and Washington (30 business days). Several states impose deadlines of 45 days (e.g., Ohio), 60 days (e.g., Connecticut, Texas, Virginia), or 90 days (e.g., Maryland prior to 2023 amendments).
(iv) Notification Recipients. Most states require notification to affected individuals. Many states also require notification to the state attorney general (typically when the number of affected residents exceeds a threshold, often 250, 500, or 1,000 individuals). Some states require notification to consumer reporting agencies when large numbers of residents are affected. States with insurance-specific data-security laws may also require notification to the state insurance commissioner or superintendent.
(v) Content Requirements. States impose varying requirements regarding the content of breach notifications, including descriptions of the incident, categories of information affected, contact information for the notifying entity, and information about identity-theft prevention services.
(vi) Safe Harbors. Many states provide a safe harbor from notification if the breached data was encrypted and the encryption key was not compromised, or if a good-faith risk-of-harm analysis determines that there is no reasonable likelihood of harm to affected individuals. The availability and scope of these safe harbors vary by jurisdiction.
(vii) Penalties. Penalties for non-compliance range from no specified penalty (some jurisdictions rely on general consumer-protection enforcement authority) to per-violation civil penalties (e.g., California authorizes penalties of up to $7,500 per violation in enforcement actions brought by the AG), to private rights of action (California's CCPA provides for statutory damages in breach cases).
B. Key Jurisdictions — Detailed Analysis
1. New York
New York is a critical jurisdiction for this analysis for two independent reasons: Quorum is a licensed insurer in New York, and New York's regulatory framework for data security in the financial services sector is among the most rigorous in the nation.
NY General Business Law § 899-aa. New York's general breach-notification law requires any person or business that conducts business in the state and maintains computerized data that includes private information of New York residents to notify affected individuals "in the most expedient time possible and without unreasonable delay." The statute does not impose a specific day-count deadline for notifications to individuals, but the "most expedient time possible" standard has been interpreted by the New York Attorney General's office to require notification promptly upon completion of a reasonable investigation, and delays of more than a few weeks absent extraordinary circumstances have been questioned in enforcement proceedings. Notification to the New York Attorney General, the Division of State Police, and the Department of State is required when a breach affects New York residents.
NY DFS Cybersecurity Regulation (23 NYCRR Part 500). The New York Department of Financial Services Cybersecurity Regulation, which took effect on March 1, 2017, and has been subject to significant amendment since its initial adoption, imposes comprehensive cybersecurity requirements on "covered entities," a term that includes all entities operating under or required to operate under a license, registration, charter, certificate, permit, accreditation, or similar authorization under the Banking Law, Insurance Law, or Financial Services Law of the State of New York. Quorum, as a licensed insurer in New York, is a covered entity subject to 23 NYCRR Part 500.
Section 500.17 of the regulation establishes breach-notification requirements that are among the most aggressive in the country. A covered entity is required to notify the Superintendent of Financial Services within 72 hours of determining that a "Cybersecurity Event" has occurred if the event satisfies either of two criteria: (a) the event has a reasonable likelihood of materially harming any material part of the normal operations of the covered entity, or (b) the event results in the covered entity providing notification to any government body, self-regulatory agency, or other supervisory body regarding an unauthorized access to or disclosure of nonpublic information. The 72-hour clock is critical because it is among the shortest regulatory notification deadlines applicable to Quorum, and it is measured from "determination" that a qualifying event has occurred — a standard that must be carefully aligned with the "Discovery" definition in the DSA.
Section 500.11 addresses third-party service provider security policy requirements. Covered entities are required to implement written policies and procedures designed to ensure the security of information systems and nonpublic information that is accessible to, or held by, third-party service providers. While Meridian is technically a data licensor rather than a traditional "service provider," the scope of § 500.11 is broad enough to encompass any third party that has access to or holds nonpublic information that the covered entity receives or processes. The DSA should be drafted to ensure that the contractual requirements imposed on Meridian satisfy Quorum's obligations under § 500.11, including requirements for risk assessments of third-party service providers, minimum cybersecurity practices, and due-diligence processes.
Recent amendments to 23 NYCRR Part 500, adopted by the DFS in November 2023, further enhance the regulatory requirements applicable to covered entities. These amendments expand the definition of "Cybersecurity Event" to include certain unauthorized access scenarios, impose enhanced requirements for incident response planning and CISO reporting to the board of directors, introduce new requirements for governance of cybersecurity risk, and strengthen the penalties framework for non-compliance. While the November 2023 amendments postdate the proposed execution timeline for the MDLA, we recommend that the DSA be drafted to anticipate compliance with the enhanced requirements, as Quorum will need to comply with them during the term of the agreement.
Recommended DSA Provisions for New York Compliance. We recommend that the DSA require Meridian to notify Quorum of any Security Incident or Data Breach within 48 hours of discovery. This timeline is 24 hours more aggressive than the DFS's 72-hour reporting window, ensuring that Quorum has a minimum of 24 hours to assess the incident, determine whether it constitutes a "Cybersecurity Event" requiring DFS notification, prepare its DFS filing, and submit notification before the 72-hour regulatory deadline expires. The DSA should further require Meridian's full cooperation in Quorum's preparation and submission of DFS notifications, including providing all factual information, technical details, and supporting documentation necessary for Quorum to complete the DFS notification form and respond to any follow-up inquiries from the Superintendent.
2. Connecticut. Connecticut is of particular importance to this analysis because Quorum is headquartered in Stamford, Connecticut, making Connecticut Quorum's domiciliary state for insurance regulatory purposes.
Connecticut General Statutes § 36a-701b. Connecticut's general breach-notification law, as amended, requires persons conducting business in the state who own, license, or maintain computerized data that includes personal information to notify affected residents of any breach of security. Following recent amendments, the notification deadline is 60 days from the date of discovery of the breach. Notification to the Connecticut Attorney General is required when the breach affects Connecticut residents. The 60-day deadline, while not the shortest in the country, provides less margin than some other jurisdictions and requires prompt investigation and assessment following discovery.
CT Insurance Department Data-Security Requirements. Connecticut has adopted legislation aligning with the NAIC Insurance Data Security Model Law. Public Act 23-53, enacted in the 2023 legislative session, imposes comprehensive cybersecurity requirements on licensed insurers domiciled in Connecticut, including requirements to maintain a written information-security program, conduct risk assessments, implement access controls and monitoring, and maintain an incident response plan. Critically for this memorandum, the Connecticut Insurance Commissioner notification requirement mirrors the NAIC model: licensed insurers must notify the Connecticut Insurance Commissioner within 72 hours of determining that a cybersecurity event has occurred that meets specified criteria (including events involving the unauthorized access to nonpublic information and events requiring notification to other governmental authorities).
Because Quorum is domiciled in Connecticut, the Connecticut Insurance Commissioner is Quorum's primary insurance regulator for data-security purposes. The 72-hour notification requirement to the Connecticut Insurance Commissioner operates in parallel with, and on the same timeline as, the 72-hour notification requirement under 23 NYCRR Part 500 in New York. This convergence reinforces the appropriateness of the 48-hour contractual notification from Meridian to Quorum: a 48-hour notification from Meridian provides Quorum with a 24-hour buffer to assess the incident, prepare its regulatory filings, and submit notifications to both the Connecticut Insurance Commissioner and the New York DFS Superintendent before the respective 72-hour deadlines expire.
3. California (CCPA/CPRA)
California presents a uniquely complex compliance challenge because, in addition to its general breach-notification law, it has enacted the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), which together create a private right of action for data breaches and expose Quorum to potentially massive statutory damages.
California Civil Code § 1798.82 — General Breach Notification. California's general breach-notification law requires any person or business that conducts business in the state, or any person or business that owns or licenses computerized data that includes personal information, to disclose any breach of the security of the system to California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notification must be made "in the most expedient time possible and without unreasonable delay," consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach, identify affected individuals, and restore the reasonable integrity of the data system. If the breach affects more than 500 California residents, notification to the California Attorney General is required. Given that the Meridian data encompasses approximately 310 million consumer records drawn from a nationwide population, any breach of meaningful scope would almost certainly involve more than 500 California residents, triggering the AG notification requirement.
CCPA/CPRA Private Right of Action (Cal. Civ. Code § 1798.150). The CCPA creates a private right of action for California consumers whose "personal information" (as defined in Cal. Civ. Code § 1798.81.5(d)) is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's failure to implement and maintain reasonable security procedures and practices appropriate to the nature of the information. The CPRA, which took effect on January 1, 2023, amended and expanded the CCPA's provisions but preserved the private right of action for data breaches.
Under the CCPA/CPRA, consumers may recover statutory damages of not less than $100 and not greater than $750 per consumer per incident, or actual damages, whichever is greater. In addition, the California Attorney General may seek civil penalties of up to $2,500 per violation or $7,500 per intentional violation. The potential exposure is staggering when considered in light of the volume of consumer records at issue. Even assuming that only a fraction of the 310 million consumer credit file records belong to California residents — and California's share of the national population suggests that approximately 38 to 40 million records may belong to California residents — the theoretical statutory damages exposure under the CCPA private right of action ranges from approximately $3.8 billion (at the $100 per consumer minimum) to approximately $30 billion (at the $750 per consumer maximum). While courts have not yet addressed whether such massive aggregate damages awards are constitutionally permissible under the Due Process Clause, and it is likely that any such award would be subject to constitutional challenge, the theoretical exposure underscores the critical importance of maintaining robust contractual protections and ensuring that both Quorum and Meridian implement and maintain security measures that satisfy the "reasonable security" standard.
The DSA should include provisions that specifically address CCPA/CPRA compliance, including representations from both parties regarding the implementation and maintenance of reasonable security procedures and practices, obligations to cooperate in responding to consumer requests exercised under the CCPA/CPRA (including requests to know and requests to delete, to the extent applicable to the licensed data), and indemnification provisions addressing CCPA/CPRA statutory damages exposure.
4. Georgia. Georgia is relevant to this analysis primarily because Meridian is headquartered in Atlanta, Georgia. Georgia's breach-notification law, codified at O.C.G.A. § 10-1-912, requires any information broker or data collector that maintains computerized data that includes personal information of Georgia residents to give notice of a breach of the security of the system to affected residents "in the most expedient time possible and without unreasonable delay." The statute does not impose a specific day-count deadline, but the "most expedient time possible" standard requires prompt action and does not excuse delay. Georgia also requires notification to the Georgia Bureau of Investigation and the Georgia Attorney General if the breach affects Georgia residents.
Because Meridian is domiciled in Georgia, a breach originating in Meridian's systems would be subject to Georgia law in the first instance, and the Georgia Attorney General would likely assert jurisdiction over any enforcement action arising from such a breach. The DSA should ensure that Meridian's obligations with respect to its own regulatory notifications in Georgia are clearly articulated and that Quorum is provided advance notice of any such notifications to enable coordinated response.
5. Massachusetts. Massachusetts warrants specific attention for two reasons: Quorum operates as a licensed insurer in Massachusetts, and Massachusetts has adopted data-security regulations that are among the most prescriptive in the country.
201 C.M.R. 17.00 — Standards for the Protection of Personal Information. Massachusetts regulations require every person that owns or licenses personal information of Massachusetts residents to develop, implement, and maintain a comprehensive, written information-security program ("WISP") that contains specific administrative, technical, and physical safeguards. The regulations prescribe minimum security requirements, including encryption of personal information transmitted over wireless networks and on portable devices, maintenance of firewalls and malware protection, and implementation of access-control protocols. These requirements go beyond the general standards imposed by many other states and establish a prescriptive baseline that Quorum must meet with respect to the Meridian data.
Mass. Gen. Laws ch. 93H, § 3 — Breach Notification. Massachusetts law requires notification to the Massachusetts Attorney General and the Director of Consumer Affairs and Business Regulation "as soon as practicable and without unreasonable delay" when a person who owns or licenses data that includes personal information of Massachusetts residents knows or has reason to know of a breach of security. Notification to affected individuals is also required.
We note that Quorum's primary lender, Standish National Bank, N.A., is headquartered in Boston, Massachusetts. To the extent that Standish requires representations regarding data-security protections as a condition of its consent or waiver with respect to the Meridian transaction, the Standish consent/waiver may incorporate references to Massachusetts data-security standards. This is discussed further in Section XI below.
6. Other Notable Jurisdictions
In addition to the jurisdictions analyzed in detail above, several other states impose notification deadlines or requirements that are particularly noteworthy:
Florida (Fla. Stat. § 501.171). Florida imposes a 30-day notification deadline for notifications to affected individuals, measured from the date of determination that a breach has occurred or the date on which the entity has reason to believe a breach has occurred. Florida also requires notification to the Florida Department of Legal Affairs (Attorney General) within 30 days if the breach affects 500 or more individuals. Florida's 30-day deadline is among the shortest specific day-count deadlines in the country and will be one of the "driving clocks" for Quorum's notification timeline.
Texas (Tex. Bus. & Com. Code § 521.053). Texas requires notification to affected individuals "as quickly as possible" without unreasonable delay, subject to a 60-day cap. Texas also requires notification to the Texas Attorney General if the breach affects 250 or more Texas residents.
Illinois (815 ILCS 530/10). Illinois requires notification to affected residents "in the most expedient time possible and without unreasonable delay." Illinois also requires notification to the Illinois Attorney General if the breach affects more than 500 Illinois residents.
Colorado (C.R.S. § 6-1-716). Colorado imposes a 30-day notification deadline for notifications to affected residents, measured from the date of determination that a security breach occurred. Colorado also requires notification to the Colorado Attorney General if the breach affects 500 or more Colorado residents. Like Florida, Colorado's 30-day deadline is among the most aggressive in the country.
Virginia (Va. Code § 18.2-186.6). Virginia requires notification "without unreasonable delay" following discovery or notification of a breach, subject to a 60-day cap. Notification to the Virginia Attorney General and the Virginia State Police is required.
Washington (RCW 19.255.010). Washington imposes a 30-business-day notification deadline for notifications to affected residents, measured from discovery. Washington also requires notification to the Washington Attorney General if the breach affects more than 500 Washington residents.
C. Summary Table of Notification Deadlines
The following table summarizes the key notification deadlines and requirements across the most significant jurisdictions for Quorum's purposes. A comprehensive state-by-state table covering all 50 states and the District of Columbia is provided in Appendix A.
Conclusion Regarding Notification Timeline. As the foregoing analysis demonstrates, the most aggressive regulatory deadlines applicable to Quorum are the 72-hour notification requirements under 23 NYCRR Part 500 (New York DFS) and the Connecticut Insurance Commissioner notification requirement (also 72 hours). These 72-hour clocks are the "driving clocks" that set the pace for the contractual notification timeline. The parties' agreed-upon 48-hour contractual notification from Meridian to Quorum is appropriately set to provide Quorum with a 24-hour buffer before the most aggressive regulatory deadlines expire. This 24-hour buffer, while tight, should provide sufficient time for Quorum to assess the incoming notification from Meridian, determine whether the incident constitutes a reportable "Cybersecurity Event" under the applicable regulatory frameworks, prepare its DFS and Connecticut Insurance Commissioner notifications, and submit those filings within the 72-hour window.
We emphasize, however, that the 24-hour buffer leaves very little margin for delay or miscommunication. It is essential that the DSA include clear procedures for notification — including designated contacts, multiple communication channels (email, telephone, and courier), and escalation protocols — to ensure that no time is lost in the handoff between Meridian's notification and Quorum's assessment and response.
D. Safe Harbors and Risk-of-Harm Analysis
Many state breach-notification laws provide a safe harbor from the notification obligation if specified conditions are met. The two most common safe-harbor mechanisms are: (i) an encryption safe harbor, which exempts from notification any breach involving data that was encrypted and for which the encryption key was not compromised; and (ii) a risk-of-harm safe harbor, which exempts from notification any breach for which a good-faith risk-of-harm analysis determines that there is no reasonable likelihood of harm to affected individuals.
With respect to the encryption safe harbor, the DSA should require that all Meridian data be encrypted both at rest and in transit, using encryption standards consistent with the requirements of ISO 27001, SOC 2 Type II, and the NIST Cybersecurity Framework. This is consistent with the security requirements already contemplated in the parties' negotiation of the DSA. If Meridian data is properly encrypted at all times, and the encryption keys are maintained separately and not compromised in a breach, Quorum may be able to avail itself of the encryption safe harbor in many (though not all) jurisdictions, potentially avoiding the obligation to notify millions of affected consumers.
With respect to the risk-of-harm safe harbor, the DSA should establish a process for conducting a risk-of-harm analysis in the event of a Security Incident, with cooperation between both Quorum's and Meridian's security and legal teams. Not all states provide a risk-of-harm safe harbor, and in those states that do, the standards vary. The DSA should provide that the parties will cooperate in conducting a risk-of-harm analysis that satisfies the requirements of the most stringent applicable jurisdiction, and that the decision whether to proceed with notification will be made by the party bearing primary notification responsibility (typically Quorum, as the entity with the direct regulatory obligations), in consultation with the other party and with outside counsel.
V. NAIC Insurance Data Security Model Law Considerations
The NAIC Insurance Data Security Model Law, adopted by the National Association of Insurance Commissioners in 2017, establishes a comprehensive framework for data-security requirements applicable to licensed insurers. The Model Law is designed to serve as a template for adoption by state legislatures, and as of the date of this memorandum, it has been enacted in some form by a growing number of states, including Connecticut, New York (through the DFS Cybersecurity Regulation, which predates the NAIC model but is substantially similar in scope), South Carolina, Ohio, Michigan, Alabama, Delaware, Indiana, Iowa, Louisiana, Maine, Minnesota, Mississippi, Montana, New Hampshire, North Dakota, Tennessee, Virginia, Vermont, and Wisconsin, among others. Additional states are expected to adopt the model in the coming legislative sessions.
The NAIC Insurance Data Security Model Law imposes several requirements that are directly relevant to the proposed data-licensing arrangement and the DSA:
(a) Written Incident Response Plan. Licensed insurers subject to the Model Law must maintain a written incident response plan that addresses the insurer's capacity to investigate, contain, and respond to cybersecurity events; the assignment of roles and responsibilities to specific individuals within the organization; processes for notifying the insurance commissioner, affected consumers, and other required parties; and procedures for coordinating with law enforcement.
(b) Investigation Timeline. The Model Law requires insurers to investigate promptly upon learning that a cybersecurity event has occurred or may have occurred, and to determine as soon as practicable whether a cybersecurity event has in fact occurred, the nature and scope of the event, and whether any nonpublic information has been involved.
(c) Commissioner Notification. Insurers must notify the commissioner of their domiciliary state within 72 hours of determining that a cybersecurity event has occurred that either involves nonpublic information and requires notification to a government body, self-regulatory agency, or other supervisory body, or has a reasonable likelihood of materially harming a consumer or any material part of the normal operations of the insurer. Notification to the domiciliary commissioner satisfies the notification obligation; the domiciliary commissioner is then responsible for coordinating with other states' commissioners through the NAIC's secure communication channels.
(d) Coordination with Law Enforcement. The Model Law permits insurers to delay notification if a law enforcement agency determines that notification would impede a criminal investigation or jeopardize national security.
(e) Record Retention. Insurers must maintain records of all cybersecurity events for a period of at least five years from the date of the event, including records of the investigation, response, and remediation activities.
(f) Third-Party Service Provider Oversight. The Model Law requires insurers to exercise due diligence in selecting third-party service providers and to require service providers to implement appropriate security measures. This requirement applies to the Quorum–Meridian relationship and reinforces the need for robust security provisions in the DSA.
Because Quorum is licensed in multiple states that have adopted the NAIC Insurance Data Security Model Law, Quorum must comply with each state's specific implementation. While the core requirements are substantially similar across adopting states, minor variations exist, and Quorum's compliance program must account for these differences.
Recommended DSA Provision. We recommend that the DSA include a provision requiring Meridian to provide all information, documentation, and cooperation reasonably necessary for Quorum to comply with its obligations under the NAIC Insurance Data Security Model Law and any state implementation thereof. This includes, at minimum, prompt notification of cybersecurity events, access to forensic investigation reports and findings, cooperation in the preparation and submission of regulatory notifications, and preservation of records for the required retention periods.
VI. The 48-Hour Contractual Notification Requirement
A. Definition of "Discovery"
The parties have agreed in principle that the DSA will require each party to provide the other with notification of a data breach or security incident within 48 hours. However, the utility and enforceability of a 48-hour notification obligation depends critically on the precision with which the DSA defines the term "Discovery," as this is the event that triggers the commencement of the 48-hour clock.
We recommend that the DSA adopt the following definition of "Discovery":
"Discovery" means the date on which the notifying party first knows, or reasonably should have known through the exercise of reasonable diligence consistent with its written incident response plan, that a Security Incident has occurred, regardless of whether the notifying party has completed its investigation of the incident, determined the full scope of the incident, or identified all affected individuals or data elements. For purposes of this definition, a party shall be deemed to have knowledge of a Security Incident when any employee, officer, contractor, or agent of the party who is responsible for information security, data protection, privacy, legal, or compliance functions becomes aware of facts or circumstances that would cause a reasonable person in such position to conclude that a Security Incident has occurred or is reasonably likely to have occurred.
This definition employs an objective standard — what the party "knew or reasonably should have known" — rather than a subjective standard tied to the party's actual, confirmed knowledge. This is a deliberate drafting choice designed to prevent either party from delaying the start of the notification clock by failing to investigate anomalies, deferring incident classification decisions, or requiring full confirmation of a breach before commencing the notification process.
We anticipate that Meridian's outside counsel (Kessler Pruitt & Ashe LLP) may push back on this definition and seek to substitute a standard that ties "Discovery" to the date on which the party "confirms" or "conclusively determines" that a breach has occurred, rather than the date of initial detection or suspicion. We recommend strongly against accepting such a standard. A "confirmation"-based trigger would allow the disclosing party to delay notification by extending its internal investigation — potentially for weeks — before concluding that a breach has been "confirmed." This approach is inconsistent with the purpose of the 48-hour notification obligation and would undermine Quorum's ability to comply with the 72-hour regulatory deadlines under 23 NYCRR Part 500 and the Connecticut Insurance Commissioner notification requirement.
We further recommend that the DSA include affirmative language providing that the obligation to investigate and the obligation to notify run in parallel, and that the pendency of an investigation does not defer or toll the 48-hour notification clock. The initial notification (discussed in Section VI.C below) should convey the best information available at the time, with supplemental notifications to follow as the investigation progresses.
B. Scope of "Security Incident" vs. "Data Breach"
The DSA should establish a two-tier classification system for data-security events, with distinct definitions and response obligations for each tier:
Security Incident (Tier 1): Any unauthorized access to, or unauthorized acquisition, use, disclosure, modification, or destruction of, Licensed Meridian Data, or any event that compromises or reasonably threatens to compromise the confidentiality, integrity, or availability of systems containing Licensed Meridian Data, including suspected incidents, near-misses, and anomalous activity that may indicate an attempted or successful intrusion. This definition is intentionally broad and is designed to ensure that the 48-hour notification obligation is triggered at the earliest possible stage, including for incidents that have not yet been confirmed as actual breaches.
Data Breach (Tier 2): A Security Incident that results in the unauthorized acquisition of unencrypted Personal Information (or encrypted Personal Information where the encryption key is also compromised) that constitutes a "breach of the security of the system" or "breach of security" under one or more applicable state or federal breach-notification statutes, such that notification to affected individuals, state attorneys general, insurance commissioners, or other regulatory authorities is required under applicable law.
The 48-hour notification obligation should apply to both tiers. However, the follow-up obligations should differ:
• For Security Incidents that do not rise to the level of a Data Breach: notification within 48 hours; investigation and root-cause analysis within 30 days; remediation as warranted; no obligation to notify individuals or regulators unless the incident is subsequently reclassified as a Data Breach.
• For Data Breaches: notification within 48 hours; investigation, forensics, and root-cause analysis on an accelerated timeline; consumer notification and credit monitoring as required by applicable law; regulatory notifications within applicable deadlines; full cooperation in response and remediation.
This two-tier structure provides transparency and early warning for all security events while appropriately calibrating the response obligations to the severity and regulatory significance of the event.
C. Content of Notification
The DSA should specify the required content for both initial and supplemental notifications.
Initial Notification (within 48 hours of discovery): The initial notification must include, at minimum:
(i) the identity of the notifying party and the designated point of contact for communications regarding the incident;
(ii) the date and time at which the incident was discovered, including the identity and role of the individual(s) who first detected the incident;
(iii) a description of the nature of the incident, including the type of event (e.g., unauthorized access, ransomware, phishing, insider threat, system misconfiguration, unauthorized disclosure) and the systems and data repositories affected;
(iv) the categories of data reasonably believed to be affected (e.g., Social Security numbers, account numbers, credit tradeline data, addresses, dates of birth);
(v) the approxima