Company: AHL
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001267395-25-000019
Chunk: 140

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-19
Form: 20-F
Item: Item 4
Chunk 140
---
 to examine the cybersecurity programs of financial institutions in the future and such examinations may result in additional expenditure of resources and regulatory scrutiny.

In 2017, the NAIC also adopted the Insurance Data Security Model Law (the “ Cybersecurity Model Law”). The Cybersecurity Model Law requires insurers, insurance producers and other entities required to be licensed under state insurance laws to comply with certain requirements under state insurance laws, such as developing and maintaining a written information security program, overseeing the data security practices of third-party vendors, and providing notice of certain data breaches. As with all NAIC model laws, this Insurance Data Security Model Law must be adopted by a state before becoming law in such state. The Cybersecurity Model Law closely resembles the NYDFS Cybersecurity Regulation and, as of February 1, 2025, a version of the Cybersecurity Model Law has been adopted by more than 25 U. S. states.

Table of Contents

Several states have enacted broad comprehensive data privacy laws that require businesses in scope to disclose information about their privacy practices and give state residents rights to access, delete, and correct their personal information and to opt out of the use of their information for targeted advertising, profiling that results in the provision or denial of decisions including insurance services, and from having their personal information sold to third parties. Most of these laws broadly exempt entities covered by the GLBA or insurers more generally. However, in 2018 California enacted the California Consumer Privacy Act (“ CCPA”), which came into effect on January 1, 2020, and broadly regulates the collection, processing and disclosure of the personal information of California residents, imposes limits on the “sale” of personal information and grants California residents certain rights to, among other things, access and delete data about them in certain circumstances. CCPA also established a private right of action, with potentially significant statutory damages, whereby businesses that fail to implement reasonable security measures to protect against breaches of personal information could be liable to affected consumers. The CCPA was expanded substantially on January 1, 2023, when the California Privacy Rights Act of 2020 (“ CPRA”) amendments to the CCPA became fully operative. The amended CCPA, among other things, gives California residents the ability to limit use of certain sensitive personal information, further restricts the use of cross-contextual advertising, establishes restrictions on the retention of personal information, expands the types of data breaches subject to the CCPA’s private right of action, provides for increased penalties for CCPA violations concerning California residents under the age of 16