The GDPR cyber insurance checklist: Are you covered?

At long last, the GDPR effective date is just around the corner. As companies continue to work towards compliance, many are realizing that despite their best efforts, the odds of achieving and perpetually remaining in 100% compliance are slim to none.

As with any massive compliance undertaking, mistakes and missteps related to GDPR requirements are inevitable, especially in a world where data volumes, connectivity, mobility, and risks continue to increase. Given this reality, companies should consider transfer of GDPR-associated risks through insurance.

It’s critical to note that finding the most comprehensive coverage for GDPR exposures requires careful analysis of available insurance policy options. That analysis should include a thorough review of the various mandates contained in the GDPR, as well as the company’s practices around protected data, its current insurance policy(ies), and the law governing interpretation of those policies. Importantly, even companies that currently have cyber insurance in place may not have optimal coverage for the wide variety of exposures under the GDPR.

GDPR insurance coverage checklist

An analysis of insurance coverage for a company’s GDPR risks should be comprehensive and include the following issues:

Personal data breach liability: The GDPR defines a personal breach as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.” Thus, under the GDPR, there are three different types of personal data breaches: a confidentiality breach, which involves disclosure of personal data; an availability breach, where personal data cannot be accessed or is destroyed; and an integrity breach, where personal data is altered.

Most cyber insurance policies provide excellent coverage for a confidentiality data breach. Many insurers have a pre-vetted team of breach response professionals at the ready to assist an insured in the event of an incident.

Coverage for associated regulatory actions, industry fines, reputational harm, and business interruption may also be provided. In light of the GDPR, however, care should be taken to ensure that the policy will respond to actions initiated by ex-U.S. regulators under ex-U.S. regulations.

Companies also will need to review any existing cyber policies carefully to determine if coverage is limited to confidentiality breach situations. Although coverage for availability and integrity breaches may be more difficult to find in today’s current cyber insurance market place, insureds should seek out forms with broader coverage options.

Data practices liability: Although a lot of attention is placed on the data breach requirements in the GDPR, GDPR liability also can arise from the company’s practices around its collection, storage, and use of protected information, as well as the adequacy of its policies, notices, and consents.

Companies should not assume that their cyber policies will automatically respond to these exposures; regulatory coverage in many cyber forms is triggered only in connection with a confidentiality data breach. Analysis of coverage for these additional GDPR exposures should include a very careful review of the insurance policy’s insuring agreements in conjunction with its definitions and exclusions.

GDPR fines and penalties: Virtually every discussion about the GDPR emphasizes the massive fines that may be imposed pursuant to Article 83. Depending on the violation at issue, the GDPR provides for fines up to 20,000,000 EUR or 4% of the total worldwide annual turnover of the preceding financial year.

Insurance coverage for GDPR fines and penalties requires a comprehensive and thoughtful analysis. The answer to the coverage question will turn on a number of issues, including the following:

• What does the policy say about coverage for regulatory fines and penalties related to a breach, a disclosure, and data-use practices in the absence of a breach or disclosure?
• If there is an intentional violation of the GDPR, will the bad actor’s intent be imputed to the company and potentially trigger an exclusion?
• Will a GDPR fine be considered punitive or compensatory? For insurance coverage purposes, it may be relevant that Article 83 notes that any fine should be “effective, proportionate and dissuasive.”
• Does the policy specify a choice of law with regard to interpretation of the policy and/or coverage for fines and penalties?
• Does the law applicable to interpretation of the insurance policy at issue permit coverage for punitive damages?
• Does it matter if the insured is directly or vicariously liable for the incident?
• Are there work-arounds available to the company if punitive damages coverage is not available in the US?

D&O exposure: It is widely anticipated that the plaintiffs bar will seek to hold corporate leadership accountable for damages resulting from any alleged failure to provide adequate oversight in connection with GDPR compliance.

Companies should remember to evaluate coverage and liability limits under their management liability or directors and officers insurance policies in connection with this new exposure.

Words of hope

As companies come to grips with the GDPR, we can expect to see insurance policies evolve to provide insureds with more transparent and complete risk transfer solutions. In the meantime, companies should be aware that insurers are often open to negotiating coverage terms to better suit the needs of individual insureds.

Insureds should carefully evaluate their potential exposures under the GDPR and take the time to negotiate with insurers to find the coverage that best addresses their needs.

Judy Selby, JD, is a Principal of Judy Selby Consulting LLC and a senior advisor at Hanover Stone Partners LLC. She can be reached at judyselbyconsulting@gmail.com.