Preamble
The National Conference of Insurance Guaranty Funds (NCIGF) has entered into agreements with member state insurance guaranty associations and insurance receivers to assist in the transfer and distribution of UDS data between receivers and the guaranty associations by offering the Secure UDS Process (SUDS). SUDS permits the parties to transfer UDS data through a secure server thereby giving greater protection to sensitive non-public personal information
Purpose
The purpose of this policy is to further minimize the potential exposure of personal data to the risk of accidental loss, interception, or disclosure to unauthorized persons by establishing the maximum period of time the records may remain posted on the SUDS system before they are deleted.
Data is covered by this policy
This policy applies to all UDS records that are transferred utilizing SUDS, and any miscellaneous records that may have posted or transmitted utilizing SUDS.
Retention Period
All records or files posted on SUDS will be deleted after 30 days from the date of posting.
Backup process for SUDS data
All records or files that are posted on SUDS will be backed up as a normal business process. All SUDS back up records will be deleted in accordance with the standard SUDS retention period.
Automated process
SUDS will automatically delete any records or files that are still posted on the system after 30 days from the date of posting. NCIGF will be unable to recreate or resend any files after the records are deleted from the system.
Notification
SUDS users are expected to promptly retrieve their data from SUDS after it is posted. If files remain on SUDS after 10 days, SUDS will generate an email to the recipient (and sender?) reminding the recipient that the records are ready to be retrieved. A second and final email reminder will be generated after 20 days.
Responsibility for implementation of retention policy
NCIGF’s chief IT Officer shall be responsible for implementation and maintenance of this policy.
Discovery request for SUDS data
In the event NCIGF becomes aware of any third party requests to disclose SUDS data, NCIGF will immediately notify the receiver whose data was requested, and provide copies of such request and accompanying documents so that the receiver may seek a protective order or other appropriate remedy, or authorize the release of the data. Upon receipt of such request, NCIGF will suspend the SUDS destruction schedule for the affected receiver until such time as the matter is resolved.