{"data":{"id":"us-ok/okla.-stat.-tit.-36-36-672","jurisdiction":"us-ok","citation":"Okla. Stat. tit. 36, § 36-672","heading":"Definitions","body":"As used in this act:\n\n1. “Authorized individual” means an individual known to and\n\nscreened by the licensee and determined to be necessary and\n\nappropriate to have access to the nonpublic information held by the\n\nlicensee and its information systems;\n\n2. “Commissioner” means the Insurance Commissioner;\n\n3. “Consumer” means an individual, including but not limited to\n\napplicants, policyholders, insureds, beneficiaries, claimants, and\n\ncertificate holders, who is a resident of this state and whose\n\nnonpublic information is in the possession, custody, or control of a\n\nlicensee;\n\n4. “Cybersecurity event” means an event resulting in\n\nunauthorized access to or disruption or misuse of an information\n\nsystem or nonpublic information stored on the information system.\n\nThe term cybersecurity event shall not include the unauthorized\n\nacquisition of encrypted nonpublic information if the encryption,\n\nprocess, or key is not also acquired, released, or used without\n\nauthorization. Cybersecurity event shall not include an event in\n\nwhich the licensee has determined that the nonpublic information\n\naccessed by an unauthorized person has not been used or released and\n\nhas been returned or destroyed;\n\n5. “Department” means the Insurance Department;\n\n6. “Encrypted” means the transformation of data into a form\n\nwhich results in a low probability of assigning meaning without the\n\nuse of a protective process or key;\n\n7. “Information security program” means the administrative,\n\ntechnical, and physical safeguards that a licensee uses to access,\n\ncollect, distribute, process, protect, store, use, transmit, dispose\n\nof, or otherwise handle nonpublic information;\n\n8. “Information system” means a discrete set of electronic\n\ninformation resources organized for the collection, processing,\n\nmaintenance, use, sharing, dissemination or disposition of nonpublic\n\ninformation, as well as any specialized system such as industrial or\n\nprocess controls systems, telephone switching and private branch\n\nexchange systems, and environmental control systems;\n\n9. “Licensee” means any person licensed, authorized to operate,\n\nor registered, or required to be licensed, authorized to operate, or\n\nregistered, pursuant to Title 36 of the Oklahoma Statutes; provided,\n\nhowever, that it shall not include a purchasing group or a risk\n\nretention group chartered and licensed in a state other than this\n\nstate or a person that is acting as an assuming insurer that is\n\ndomiciled in another state or jurisdiction;\n\n10. “Multi-factor authentication” means authentication through\n\nverification of at least two (2) of the following types of\n\nauthentication factors:\n\na. knowledge factors, such as a password,\n\nb. possession factors, such as a token or text message on\n\na mobile phone, or\n\nc. inherence factors, such as a biometric characteristic;\n\n11. “Nonpublic information” means electronic information that\n\nis not publicly available and is:\n\na. business related information of a licensee, of which\n\nthe tampering with or unauthorized disclosure, access,\n\nor use of would cause a material adverse impact to the\n\nbusiness, operations, or security of the licensee,\n\nb. any information concerning a consumer that, because of\n\nname, number, personal mark, or other identifier, can\n\nbe used to identify him or her, in combination with\n\nany one or more of the following data elements:\n\n(1) social security number,\n\n(2) driver license number or nondriver identification\n\ncard number,\n\n(3) financial account number, credit card number, or\n\ndebit card number,\n\n(4) any security code, access code, or password that\n\nwould permit access to a consumer’s financial\n\naccount, or\n\n(5) biometric records, or\n\nc. any information or data, except age or gender, in any\n\nform or medium created by or derived from a health\n\ncare provider or a consumer that can be used to\n\nidentify a particular consumer and that relates to:\nber, credit card number, or\n\ndebit card number,\n\n(4) any security code, access code, or password that\n\nwould permit access to a consumer’s financial\n\naccount, or\n\n(5) biometric records, or\n\nc. any information or data, except age or gender, in any\n\nform or medium created by or derived from a health\n\ncare provider or a consumer that can be used to\n\nidentify a particular consumer and that relates to:\n\n(1) the past, present, or future physical, mental, or\n\nbehavioral health or condition of any consumer or\n\na member of the family of the consumer,\n\n(2) the provision of health care to any consumer, or\n\n(3) payment for the provision of health care to any\n\nconsumer;\n\n12. “Person” means any individual or any nongovernmental entity\n\nincluding, but not limited to, any nongovernmental partnership,\n\ncorporation, branch, agency, or association;\n\n13. “Publicly available information” means any information that\n\na licensee has reasonable basis to believe is lawfully made\n\navailable to the general public from federal, state, or local\n\ngovernment records, widely distributed media, or disclosures to the\n\ngeneral public that are required to be made by federal, state, or\n\nlocal law. For the purposes of this definition, a licensee has a\n\nreasonable basis to believe that information is lawfully made\n\navailable to the general public if the licensee has taken steps to\n\ndetermine:\n\na. that the information is of the type that is available\n\nto the general public, and\n\nb. whether a consumer can direct that the information not\n\nbe made available to the general public and, if so,\n\nthat such consumer has not done so; and\n\n14. “Third-party service provider” means a person, not\n\notherwise defined as a licensee, that contracts with a licensee to\n\nmaintain, process, store, or otherwise is permitted access to\n\nnonpublic information through its provision of services to the\n\nlicensee.","path":["OK Code","Title 36"],"source_url":"https://www.oklegislature.gov/OK_Statutes/CompleteTitles/os36.pdf","current_through":"2026-08-14","vintage":"open-us-law v2026.08, retrieved 2026-09-14","retrieved_at":"2026-09-14T18:32:36Z","sha256":"5ca287cf3672bace2992da5e51ffa6eb0dfcfcbb98e089542fb91ce59cf6bf50","source_id":"us-ok","stale":false,"prev":"us-ok/okla.-stat.-tit.-36-36-6719","next":"us-ok/okla.-stat.-tit.-36-36-673"},"notice":"GroundRules: Original legal text. Not legal advice."}