(1)   ? Exclusive state standards. This subchapter establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, and notification of a cybersecurity event or unauthorized access to nonpublic information to the state government and consumers.

   (2)   Exceptions to applicability.

      (b)    A licensee affiliated with a depository institution that maintains an information security program in compliance with the interagency guidelines establishing information security standards as set forth pursuant to 15 U.S. Code § 6801 and 6805 shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated depository institution of an information security program that satisfies the interagency guidelines.

      (bm)    A licensee affiliated with a broker, as defined in 15 U.S. Code § 78c (a) (4), or dealer, as defined in 15 U.S. Code § 78c (a) (5), that maintains an information security program in compliance with the requirements of the financial industry regulatory authority that address information security standards shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated broker or dealer of an information security program that satisfies the financial industry regulatory authority’s requirements.

      (c)    A licensee affiliated with a legal entity established pursuant to the federal farm credit act of 1971, 12 U.S. Code § 2001, et seq., that maintains an information security program in compliance with the farm credit administration’s guidance and regulations establishing policies and procedures to address data security and integrity shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated legal entity of an information security program that satisfies the farm credit administration’s guidance and regulations.

      (d)    This subchapter, except for s. 601.954 (1), does not apply to a licensee who is subject to and governed by 45 CFR Parts 160 and 164 and who maintains nonpublic information in the same manner as protected health information under 45 CFR Parts 160 and 164.

      (e)    If a licensee ceases to qualify for an exception under par. (a) to (d), the licensee shall have 180 days to comply with this subchapter.

   (3)   Agreements between parties. Nothing in this subchapter shall prevent or abrogate an agreement between a licensee and another licensee, a 3rd-party service provider, or another party to fulfill any of the requirements under s. 601.953 or 601.954.

   (4)   Private cause of action. This subchapter may not be construed to create or imply a private cause of action for violation of its provisions or to curtail a private cause of action that otherwise exists in the absence of this subchapter.

   (5)   Rules. The commissioner may promulgate rules that are necessary to carry out the provisions of this subchapter.