Sec. 23. (a) In the case of a cybersecurity event:
(1) that involves nonpublic information:
(A) that is in the possession, custody, or control of a licensee that is an insurer or its third party service provider; and
(B) for which a consumer accessed the insurer's services through an independent insurance producer; and
(2) for which consumer notice is required by IC 24-4.9;
the insurer shall notify the producers of record of all affected consumers of the cybersecurity event not later than the time at which notice is provided to the affected consumers.
(b) The insurer is excused from the obligation set forth in subsection (a):
(1) for any producers who are not authorized by law or contract to sell, solicit, or negotiate on behalf of the insurer; and
(2) in those instances in which the insurer does not have the current producer of record information for an individual consumer.
As added by P.L.130-2020, SEC.10.