House Bill 215 is a local act that updates the governing law for the Charlotte Firefighters’ Retirement System to add cybersecurity protections and related administrative duties. The bill requires the system to maintain data breach and cyber liability insurance, creates a new duty for the Board of Trustees to establish a reporting and grievance process for participants and beneficiaries, and directs the board to investigate reported cybersecurity incidents and provide resources to affected individuals. If a qualifying data breach or cybersecurity incident is found, the bill requires the system to make affected participants or beneficiaries whole for incidents occurring on or after the effective date.
The bill also revises several existing provisions governing the retirement system’s operations, including the use of professional services, annual reporting, custody of assets, and investment authority. It expands the annual report to the Charlotte City Council to include any data breach or cybersecurity incident, the cost of the incident, and the response taken. It further clarifies fiduciary duties and allows system funds to be used for cyber insurance and for compensating victims of system-related cyber incidents. The act applies only to the City of Charlotte and takes effect when it becomes law.
Impact
The bill amends the local charter provisions governing the Charlotte Firefighters’ Retirement System, specifically sections of Chapter 506 of the 1987 Session Laws as later amended. It adds new statutory duties for the Board of Trustees regarding cyber insurance, incident response, reporting, and remediation, and it modifies existing language on insurance, annual reporting, and investment authority to incorporate cybersecurity-related costs and responsibilities. The practical effect is to impose new operational and financial obligations on the retirement system and its trustees, while creating potential compensation rights for participants and beneficiaries harmed by a system data breach or cybersecurity incident.
Sentiment
The available record shows no committee transcript and no recorded votes, so there is no documented floor or committee debate to gauge formal sentiment. Based on the bill text, the measure appears protective and remedial in nature, aimed at strengthening safeguards for retirement system members after a data security incident. The overall framing suggests support for participant protection, fiduciary accountability, and improved transparency rather than controversy over policy direction.
Contention
The main policy tension in the bill is likely the cost and scope of the new obligations it places on the Charlotte Firefighters’ Retirement System and the City of Charlotte, including mandatory cyber insurance, incident investigations, reporting infrastructure, and the duty to make victims whole. Another possible point of contention is the retroactive reach of the investigation requirement for incidents reported within a year before the effective date, although the compensation mandate itself applies only to incidents on or after the effective date. The bill also shifts responsibility toward the board and system administrators, which could raise questions about implementation, contract oversight, and who bears financial liability for cyber-related losses.