DLA Piper and Aon have released a guide “The price of data security,” ahead of the General Data Protection Regulation (“GDPR”), effective May 25, 2018.

The guide reviews the insurability of GDPR fines across Europe, which can reach up to €20 million or, if higher, up to four percent of a group's annual global turnover. It also looks at insurability of costs associated with GDPR non-compliance (e.g. litigation, investigation, and compensation), as well as the insurability of non-GDPR regulatory fines.

The guide highlights that there are currently only a few jurisdictions in Europe where civil fines can be covered by insurance and, even then, there must be no deliberate wrongdoing or gross negligence on the part of the insured. Criminal penalties are almost never insurable. GDPR administrative fines are civil in nature, but the GDPR also allows European Member States to impose their own penalties for personal data violations.

Key findings of the report include:

- GDPR fines were found to be insurable in only two of the countries reviewed – Finland and Norway;

- In 20 out of 30 reviewed jurisdictions. GDPR fines would generally not be regarded as insurable, including the United Kingdom, France, Italy, and Spain; and

- In eight of the jurisdictions it is unclear whether GDPR fines would be insurable. In these jurisdictions specific details around individual cases, for example the conduct of the insured and whether the fine is classed as criminal, would need to be considered.

Although, according to the report, the insurability of GDPR fines may be limited, insurance forms a key component of an organization's risk management strategy to manage costs associated with GDPR non-compliance and resulting business disruption losses. Such costs could include legal fees and litigation, regulatory investigation, remediation, and other costs associated with compensation and notification to impacted data subjects.

Vanessa Leemans, chief commercial officer of Aon Cyber Solutions for EMEA, commented, “GDPR will expose organizations to significantly higher risks related to how they manage and store personal data. Data breaches, and other cyber events, could see businesses face both major fines and extensive costs. It is therefore essential that organizations fully understand where their exposures lie. They should work closely with their insurance partners to ensure they have an appropriate risk transfer solution and incident response plan in place.”

Organizations also may face damage to both their reputation and market position if impacted by a high-profile data breach.

Prakash (PK) Paran, partner and co-chair of the global insurance practice at DLA Piper added, “While there are only a few jurisdictions where GDPR fines are insurable, insurance against legal costs and liabilities following a data breach is widely available across Europe and may provide valuable cover to organizations. However, corporate groups still need to consider reputational damage and impact on existing customers, the wider market, and their relationships with regulators, all of which may go beyond quantifiable financial losses. Prevention is better than the cure.”