A BILL TO BE ENTITLED
AN ACT to protect PARTICIPANTS and beneficiaries of the charlotte firefighters' retirement system from harm related to breaches of data.
The General Assembly of North Carolina enacts:
SECTION 1.(a)  Section 36 of Title VI of Chapter 506 of the 1987 Session Laws, as amended by Chapter 830 of the 1991 Session Laws, S.L. 1990‑100, and S.L. 2001‑22, reads as rewritten:
"Sec. 36. Employment of Professional Services.
(a)	The Board of Trustees shall have the authority to employ and/or utilize professional and secretarial services and to purchase and maintain such property, equipment and supplies as are deemed necessary for the proper operation of the System. All expenses, fees and/or retainers for the employment of services shall be borne by the System with the singular exception of the employment of the Actuary. All fees and expenses in connection with the employment of a qualified actuary to perform the annual evaluation of the Retirement System's financial condition shall be paid by the City of Charlotte.
(a1)	Actuary. The Board of Trustees shall annually request the City to employ a qualified Actuary to perform such studies and evaluations of the Charlotte Firefighters' Retirement System as may be necessary and/or desirable by the Board or City in connection with the administration of the System. Within the meaning of this subsection, a qualified Actuary shall be an associate or fellow of the Society of Actuaries and either a member of the Conference of Consulting Actuaries or a member of the American Academy of Actuaries.
(b)	Medical Board. The Board of Trustees shall appoint a Medical Board to be composed of one or more physicians to serve at the pleasure of the Board. The Medical Board shall arrange for and evaluate all medical examinations required under provisions of this act. The Medical Board shall also investigate and evaluate all medical evidence, statements, and certificates submitted by and on behalf of a Member in connection with an application for disability retirement. The Medical Board shall render its conclusions and recommendations in 2017 Act‑ approved by NC Legislature Page 20 writing to the Board of Trustees in accordance with the provisions of this act.
(c)	Legal Counsel. The City attorney and staff shall be the legal advisor to the Board of Trustees. The Board may employ separate legal counsel as it deems necessary and beneficial for the operation of the System.
(d)	Auditor. The Board of Trustees shall appoint an Auditor who shall be a certified public accountant.
(e)	Administrator. The Board of Trustees shall have the authority to appoint an Administrator who shall be responsible for the administration and coordination of all System operations and activities that are not otherwise specified in this act. Such administration shall be in accordance with rules and regulations of this act and the policy and direction of the Board. In the absence of an Administrator, the Secretary of the Board as specified in Section 34(b)(2) shall be responsible for the coordination of Board meetings and providing proper notice of such meetings. The Administrator shall be domiciled in this State or otherwise subject to the relevant banking and insurance laws of this State.
(f)	Insurance. The Board of Trustees shall purchase and maintain insurance coverage that is necessary for the proper operation of the System, including worker's compensation, fidelity insurance, and officers' and employees' liability coverage, and data breach and cyber liability insurance that is for the benefit of the System and Participants and Participants' Beneficiaries. All expenses incurred in purchasing or maintaining this coverage, including fees, and retainers, shall be borne by the System."
SECTION 1.(b)  Section 45 of Title VII of Chapter 506 of the 1987 Session Laws, as amended by Chapter 830 of the 1991 Session Laws, S.L. 1990‑100, and S.L. 2001‑22, reads as rewritten:
"Sec. 45. Annual Report to City Council. An annual report of the financial and actuarial condition of the System, as of the preceding June 30, shall be prepared and forwarded to the City Council in the quarter after receipt of the System's audit report from the Auditor. Such report shall contain but shall not be limited to the Auditor's opinion, such statements contained in the Auditor's report, a summary of the annual actuarial valuation and the actuary's valuation certification. The annual report shall also include any instances of a data breach or other cybersecurity incident impacting Participants and Participants' Beneficiaries, the cost of the incident, and the steps taken in response to the incident."
SECTION 1.(c)  Section 49 of Title VIII of Chapter 506 of the 1987 Session Laws, as amended by Chapter 830 of the 1991 Session Laws, S.L. 1990‑100, and S.L. 2001‑22, reads as rewritten:
"Sec. 49. Custody of System Assets. The Treasurer of the Retirement System shall be the custodian and responsible for the safekeeping of all funds paid into the Charlotte Firefighters' Retirement System. The Treasurer shall deposit said funds in a bank or banks otherwise subject to the relevant banking and insurance laws of this State, as designated by the Board of Trustees. The Treasurer may, with Board concurrence, use one or more nominees to facilitate transfer of the System's securities and may hold the securities in safekeeping with the Federal Reserve System, a clearing corporation, or a custodian bank which is a member of the Federal Reserve System. All payments from said funds shall be authorized by the Treasurer only upon the signed, written request of the Administrator, or the Secretary of the Board in the absence of an administrator. The Treasurer shall furnish such bond as shall be required by the Board of Trustees and premium for said bond shall be paid out of the funds of the System."
SECTION 1.(d)  Section 50 of Title VIII of Chapter 506 of the 1987 Session Laws, as amended by Chapter 830 of the 1991 Session Laws, S.L. 1990‑100, and S.L. 2001‑22, reads as rewritten:
"Sec. 50. Investment/Reinvestment of Funds and Assets. The Board of Trustees shall be vested with the authority and responsibility and shall have full power to hold, purchase, sell, assign, transfer, lend and dispose of any of the securities and investments in which the System shall have been invested, as well as the proceeds of said investments and any monies belonging to the System. The Board of Trustees as fiduciaries shall:
(1)	Discharge its duties solely in the interest of the Participants and the Beneficiaries;
(2)	Act with the same care, skill, prudence and diligence under the circumstances then prevailing, that a prudent person acting in a similar capacity and familiar with those matters would use in the conduct of a similar enterprise with similar aims;
(3)	Act with due regard for the management, reputation and stability of the issuer and the character of the particular investments being considered;
(4)	Make investments for the exclusive purpose of providing benefits to Participants and Participants' Beneficiaries;
(5)	Give appropriate consideration to those facts and circumstances the Board of Trustees knows or should know are relevant to the particular investment or investment course of action involved, including the role the investment or investment course of action plays in that portion of the System's investments for which the Board of Trustees has responsibility, and shall act accordingly. Appropriate consideration shall include, but is not limited to, a determination by the Board of Trustees that a particular investment or investment course of action is reasonably designed as part of the investments of the System to further the purposes of the System taking into consideration the risk of loss and the opportunity for gain or other return associated with the investment or investment course of action; and consideration of the following factors as they relate to the investment or the investment course of action: a. The diversification of the investments of the System; b. The liquidity and current return of the investments of the System relative to the anticipated cash flow requirements of the System; and c. The projected return of the investments of the System relative to the funding 2017 Act‑ approved by NC Legislature Page 23 objectives of the System;
(6)	Give appropriate consideration to investments which would enhance the general welfare of the City and its citizens if those investments offer the safety and rate of return comparable to other investments held by the System and available to the Board of Trustees at the time the investment decision is made;
(7)	May use a portion of income of the System to defray the cost of investing, managing and protecting the assets of the System, including data breach and cyber liability insurance, and making whole a Participant or Participant's Beneficiary who was a victim of a System data breach or other cybersecurity incident.
(8)	May utilize the services of Investment Fiduciaries to manage the assets of the System. These Investment Fiduciaries shall be subject to the terms, conditions, and limitations provided in this section and any limitations as set forth by the Board of Trustees."
SECTION 1.(e)  Title VIII of Chapter 506 of the 1987 Session Laws, as amended by Chapter 1033 of the 1987 Session Laws, Chapter 248 of the 1989 Session Laws, Chapter 830 of the 1991 Session Laws, S.L. 1990‑100, and S.L. 2001‑22, is amended by adding a new section to read:
"Sec. 55.1. Participants and Beneficiary Protection Against Cybersecurity Incidents. In addition to maintaining data breach and cyber liability insurance, the Board of Trustees shall have the duty to do all of the following to protect Participants and Beneficiaries of the System, which may be delegated to the Administrator or other contracted entity:
(1)	Set up a reporting mechanism and grievance procedure for Participants and Beneficiaries who may be victims of a System data breach or other cybersecurity incident.
(2)	Investigate all reported System data breaches or other cybersecurity incidents, regardless of the source of the report.
(3)	Provide resources for Participants and Beneficiaries who may be victims of a System data breach or other cybersecurity incident that include actionable steps that Participants and Beneficiaries may take to protect their funds and assets from any threats related to the System data breach or other cybersecurity incident that has occurred or that may occur.
(4)	If a System data breach or other cybersecurity incident is found to have occurred, make whole the Participants or Beneficiaries who were victims of that System data breach or other cybersecurity incident."
SECTION 2.(a)  As soon as practicable, including after assessing whether the current administrator has failed to meet its obligations under the existing contract, the Board of Trustees of the Charlotte Firefighters' Retirement System (Board of Trustees) shall contract with an administrator for the Charlotte Firefighters' Retirement System (System) that meets all of the requirements under this act.
SECTION 2.(b)  Within 60 days of this act becoming effective, the Board of Trustees shall enter into a contract for data breach and cyber liability insurance in accordance with this act.
SECTION 2.(c)  Within 60 days of this act becoming effective, the Board of Trustees shall set up the reporting mechanism and grievance procedure for Participants and Beneficiaries who may have been victims of a System data breach or other cybersecurity incident required under this act.
SECTION 2.(d)  The Board of Trustees shall investigate any System data breaches or other cybersecurity incidents that have been reported within a year prior to the effective date of this act or after and provide the resources required under this act to Participants and Beneficiaries if any are found to have occurred on or after that date.
SECTION 2.(e)  The requirement under this act to make whole a Participant or Beneficiary who is a victim of a System data breach or other cybersecurity incident shall apply to incidents occurring on or after the effective date of this act.
SECTION 3.  This act applies only to the City of Charlotte.
SECTION 4.  This act is effective when it becomes law.