European homebuyers who insure their properties through U.S. companies could require those businesses to upgrade their data protection efforts beginning in May of this year.
The number of foreign nationals purchasing property in the United State surged in the 12 months between March 2016 and March 2017, according to the National Association of Realtors. The Association said foreigners bought 284,455 properties, about a third more than a year earlier. And, similar to previous years, a larger percentage of buyers, especially in states like Florida and Arizona, were European citizens.
European homebuyers who insure their properties through U.S. companies could require those businesses to upgrade their data protection efforts beginning in May of this year.
Related: 5 things to know about the NAIC's new cybersecurity model law
|Looming EU compliance deadline
As of May 25, 2018, U.S.-based businesses that have operations in the European Union (EU) or that have customers who are citizens of EU nations will have new requirements to meet regarding data protection. This is when the new General Data Protection Regulation (GDPR) takes effect. Any companies not prepared to meet the new regulations that experience a data breach could face massive fines.
GDPR was designed to better protect EU citizen data and ensure companies storing that data should possess it. Standards vary based on where the data originates from, but generally any information like name, address, credit card number, etc. is covered. In the domestic U.S., protected data is defined as Personally Identifying Information (PII). And, as defined by GDPR, for an EU citizen it is known as Personal Data. Failure to protect the PII or Personal Data to the right standard could bring a hefty bill, or upon consistent failure, even an order to cease business in EU countries.
Related: Is cyber insurance prepared for GDPR?
|What this means for U.S. insurers
Current U.S. based data privacy regulations require companies to notify customers if a data breach occurs. But in the U.S., there can be a significant time delay between the breach and the notification letter, not so with GDPR. GDPR requires the Supervisory Authorities be notified within 72 hours, even while a breach is still being investigated. Failure to report within 72 hours could lead to significant fines. Maximum fines could be up to $26MM or 4% of global gross revenue, whichever is greater.
Insurance companies selling plans to EU citizens purchasing homes, rental properties or commercial properties in the U.S. could be affected by GDPR because they gather Personal Data on applications and store data on customers. If a hacker is able to breach the insurance company's systems and gain access to EU citizen data, the company would be required to notify GDPR Supervisory Authorities and prove that it met all GDPR requirements. Failure to cooperate with an investigation or to meet GDPR requirements could lead to fines or worse.
Related: Cyber risk management a top priority as companies prepare for GDPR
|Where to begin
The first step toward compliance for any company is determining the need for and if necessary, assigning a Data Protection Officer (DPO). A company will be required to have a DPO if it possesses large amounts of data covered by GDPR. The DPO must be available and involved in any events where there is a possibility of a loss of GDPR covered data. The DPO will be the point person for any GDPR issue with the affected persons and the Supervisory Authority. Obviously, because the DPO will be instrumental in proving a company's compliance with GDPR this individual needs to know the regulations and the company's security protocols inside and out, backward and forward. If a company is not required to have a DPO, it should still have a plan in place for who it will call if the Supervisory Authority opens an investigation.
Additionally, any Personal Data that is lawfully received, stored or processed by a company needs to be encrypted. This means completely encrypted at rest and in transit, complete end to end encryption. GDPR does not allow for lenience regarding outdated software or new implementations that are being investigated for deployment.
Companies will also now be required to complete Data Protection Assessments and Privacy Impact Assessments. They will be expected to increase visibility into what level of impact a breach might have for customers and the company, if one occurs. And, all efforts made to comply with GDPR need to be documented so they can be given to a Supervisory Authority upon request. The best source of information on the regulation requirements is gdpr-info.eu.
|The road ahead
Once GDPR takes effect, if a company experiences a breach or is contacted by a GDPR Supervisory Authority the best course of action is to show an attitude of compliance by offering complete support for the investigation. Then, contact the legal team. It is important to remember that complying with GDPR can be complex. It takes some time to update systems and processes to the level of security required by the new regulations. It can also be costly, and disruptive, but the protection of data is becoming paramount in the new business paradigm. For GDPR the cost of compliance is geared to be less than the cost of sanctions.
John Barchie is a senior fellow at Arrakis Consulting, a full-service security service provider, develops and executes security solutions for clients ranging from startups to Fortune 10 corporations.
See also:
Want to continue reading?
Become a Free PropertyCasualty360 Digital Reader
Your access to unlimited PropertyCasualty360 content isn’t changing.
Once you are an ALM digital member, you’ll receive:
- Breaking insurance news and analysis, on-site and via our newsletters and custom alerts
- Weekly Insurance Speak podcast featuring exclusive interviews with industry leaders
- Educational webcasts, white papers, and ebooks from industry thought leaders
- Critical converage of the employee benefits and financial advisory markets on our other ALM sites, BenefitsPRO and ThinkAdvisor
Already have an account? Sign In Now
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
