New Jersey property-casualty insurance firms and other industries are objecting to a proposed regulation that would require the installation of what they term expensive and uniform information security systems.

The Division of Consumer Affairs recently closed the comment period on the new rule it has put forward to implement the Identity Theft Prevention Act of 2005.

Richard Stokes, regional manager for the Property Casualty Insurers Association of America (PCI), said his group and other industry trade groups have expressed concern about the security systems, based on federal standards, that must be emplaced by all businesses regardless of size.

"Implementing the proposed regulation exceeds the requirements set out in the legislation," Mr. Stokes said. "This regulation does nothing to clarify how businesses are required to comply and adversely impacts their ability to serve customers."

Mr. Stokes said the imposition of one security system could make it easier for hackers to break since they would just have to concentrate on learning one system.

"And what is this going to do to the state's system, which is about 30 years old?" he asked.

Jack Lynn, president of the Professional Insurance Agents of N.J., said that enforcing the kind of security systems that include encryption technology on small insurance agencies is not reasonable and would "impose an undue hardship on them."

Mr. Stokes said he has been given private assurances from the Division of Consumer Affairs that it would withdraw the controversial security breach measure.

"But what if they don't?" he asked.

A Division of Consumer Affairs spokesman did not return a call for comment.

In addition to the security system, Mr. Stokes said the rigorous notification of consumers could pose problems since it must be done within 24 hours, and sometimes the extent of the problem cannot be known in such a short time frame.

Special Reports /

N.J. ID Theft Bill Stirs Insurers' Ire

Related Stories

Recommended For You