{"data":{"id":"us-ok/okla.-stat.-tit.-36-36-678","jurisdiction":"us-ok","citation":"Okla. Stat. tit. 36, § 36-678","heading":"Promulgation of rules — Violations","body":"A. The Insurance Commissioner may promulgate any rules\n\nnecessary to carry out the provisions of this section.\n\nB. 1. The following exceptions shall apply to this act:\n\na. a licensee with less than Five Million Dollars\n\n($5,000,000.00) in gross annual revenue, is exempt\n\nfrom this act,\n\nb. a licensee subject to the Health Insurance Portability\n\nand Accountability Act, Pub. L. 104–191, 110 Stat.\n\n1936, as amended, that has established and maintains\n\nan information security program pursuant to such\n\nstatutes, rules, regulations, procedures, or\n\nguidelines established thereunder, will be considered\n\nto meet the requirements of Section 4 of this act,\n\nprovided that the licensee is compliant with and\n\nsubmits a written statement to the Commissioner\n\ncertifying its compliance with the same,\n\nc. a licensee subject to Title V of the federal Gramm-\n\nLeach-Bliley Act of 1999 (15 U.S.C. Sections 6801-6809\n\nand 6821-6827) that has established and maintains an\n\ninformation security program pursuant to such,\n\nstatutes, rules, regulations, procedures, or\n\nguidelines established thereunder, will be considered\n\nto meet the requirements of Section 4 of this act,\n\nprovided that the licensee is compliant with and\n\nsubmits a written statement to the Commissioner\n\ncertifying its compliance with the same, and\n\nd. an employee, agent, representative, or designee of a\n\nlicensee, who is also a licensee, is exempt from this\n\nact and shall not be required to develop their own\n\ninformation security program to the extent that the\n\nemployee, agent, representative, or designee is\n\ncovered by the information security program of the\n\nlicensee.\n\n2. If a licensee ceases to qualify for an exception, the\n\nlicensee shall have one hundred eighty (180) days to comply with the\n\nprovisions of this act.\n\nC. In the case of a violation of this act, a licensee may be\n\npenalized in accordance with any applicable sections of the\n\nInsurance Code, including, but not limited to, Section 908 of Title\n\n36 of the Oklahoma Statutes, or any other provision providing for\n\npenalties that the licensee is subject to under the license or\n\npermit of the licensee. Nothing in this act shall be construed to\n\nimpose any civil liability for any violation of this act or omission\n\nto act by the licensee or employees of the licensee.\n\nD. The provisions of this act shall take precedence over any\n\nother state laws applicable to licensees for data security and the\n\ninvestigation of a cybersecurity event.","path":["OK Code","Title 36"],"source_url":"https://www.oklegislature.gov/OK_Statutes/CompleteTitles/os36.pdf","current_through":"2026-08-14","vintage":"open-us-law v2026.08, retrieved 2026-09-14","retrieved_at":"2026-09-14T18:32:36Z","sha256":"a8763b8dd8b79a95efd1c623910b105a7cf2d11265779147b4265724b500a66e","source_id":"us-ok","stale":false,"prev":"us-ok/okla.-stat.-tit.-36-36-677","next":"us-ok/okla.-stat.-tit.-36-36-679"},"notice":"GroundRules: Original legal text. Not legal advice."}