Cybersecurity Continues as a Top Priority
Cybersecurity continues to be a top priority of the Department of Financial Services (“DFS”). New York was the first state to codify cybersecurity best practices and guidance into regulatory requirements for covered entities. DFS made several public remarks over the last year as to the changing landscape related to cybersecurity, and not surprisingly, in July, DFS released “pre-proposed” amendments to Part 500, the cybersecurity regulation. “Pre-proposal” means that the proposed revisions have not yet been formally submitted and there will be an additional 60-day period for comments when that occurs. The pre-proposed draft amendments sought to increase involvement of a regulated entity’s senior management; increase technology requirements; expand what is covered under the 72-hour notification requirements; add a new 24-hour reporting requirement for ransom payments; and heighten annual certification and assessment requirements.
We will continue to monitor and provide comments to the proposed regulation is necessary. Should you have any questions on the current regulation, DFS’s Cybersecurity Portal is a valuable resource and Cybersecurity FAQs for Producers can be found here.
Litigation of Regulation 187 Continues
In 2018, DFS amended Insurance Regulation No. 187 to establish a uniform standard of care requiring insurance companies, as well insurance agents and brokers, to consider “the best interest of the consumer” in recommending life insurance and annuity policies. The amendment, titled “Suitability and Best Interests in Life Insurance and Annuity Transactions,” was meant to address concerns about the complexity of insurance and annuity products and the growing need of consumers to rely on professional advice to understand such products. Not long after this amendment, a lawsuit was brought to strike down the regulation on multiple grounds, including that it was unconstitutionally vague. The New York Supreme Court dismissed the suit, saying, “[t]he Amendment is not ambiguous; in fact, it is clear and quite self-explanatory.”
Nevertheless, on appeal, the Appellate Division, Third Department, reversed. The court found Regulation 187 to be unconstitutionally vague, finding that “while the consumer protection goals underlying promulgation of the amendment are laudable, as written, the amendment fails to provide sufficient concrete, practical guidance for producers to know whether their conduct, on a day-to-day basis, comports with the amendment’s corresponding requirements for making recommendations and compiling and evaluating the relevant suitability information of the consumer.”
The State appealed that decision to the New York State Court of Appeals, the state’s highest court. Oral argument was just recently heard on September 8, 2022. We will report on the decision as soon as it is issued. We believe it is likely that if the Court of Appeals does not uphold Regulation 187 as drafted that DFS will promulgate a more prescriptive regulation.
