Worldwide: Issues To Consider When Evaluating Cyber Coverage In Light Of The CCPA And Other State Privacy Laws

With the expansion of privacy legislation—from the General Data Protection Regulation (GDPR) in Europe to the coming California Consumer Privacy Act (CCPA) in the United States—cyber liability insurance is taking on increased importance. This post discusses key issues companies should consider as they review their cyber coverage in light of changing legislation and increased litigation risks. Companies should act now to ensure they have sufficient cyber coverage in place before the CCPA goes into effect on January 1, 2020.

Covering costs related to data breach response and recovery and data breach- and privacy-related enforcement actions and litigation presents challenges. Worldwide, as of April 2019, the average total cost of a data breach was $3.92 million.1 The average total cost of a data breach in the United States was $8.19 million.2 The costs of enforcement actions can be similarly significant in terms of monetary penalties and secondary costs. Without adequate coverage, these costs can have long-term effects on a business.

Cyber policies are now a common part of most companies' insurance portfolios. The policies generally cover five principal areas: (1) costs to manage and respond to a cyber-incident, (2) costs stemming from network interruption, (3) costs for security and privacy liability, (4) costs relating to extortion and (5) costs for media liability or reputational harm. Whether insurers cover all of these areas or all costs within different areas varies from policy to policy. Most policies offer first-party and third-party coverage. First-party coverage applies to losses that are directly sustained by the insured party, such as damage to a company's own electronic data files. Third-party coverage applies to claims by others against the insured company, such as claims by people who were injured by the insured company's actions (or inactions).

With the increase in state privacy legislation, particularly the CCPA, many insurance companies are working with clients to also cover certain "compliance" costs arising out of a violation of a privacy-related legal obligation where no underlying cyber incident has occurred. Insurers and insureds alike are also working to understand how the CCPA's private right of action fits within existing third-party liability coverage and whether and how they may need to expand such coverage. We provide below a few points of guidance for companies to consider as they engage in similar discussions with their brokers and insurers.

Potential Gaps in Cyber Coverage

Companies should consider the following potential gaps, among others, in cyber coverage as they evaluate their policies in the lead-up to the CCPA and in light of other state privacy laws.

  1. "Compliance" Coverage: Not all policies clearly cover regulatory fines that federal or state regulators may impose for a company's violation of a privacy statute where no underlying cyber incident occurred. Instead, some policies link reimbursement to the existence of a breach and its documentation. With the adoption of laws like the GDPR and the CCPA, some insurance companies are also offering cyber coverage that includes a "compliance" element.

This is important because regulatory fines present significant potential costs. Under the CCPA, state regulatory fines range between $2,500 and $7,500 (intentional) per violation. A breach exposing 10,000 records could, if each record is considered a separate violation, lead to fines of tens of millions of dollars.

Compliance coverage provides protection for regulatory fines where there is no underlying cyber incident. Some insurance companies also offer services to help incentivize compliance, like regulatory readiness assessments.3 Compliance coverage may apply, for example, where a regulator fines a company for failing to timely or properly respond to a consumer (or data subject) request for information. Many companies with a European presence sought similar coverage before the GDPR took effect in May 2018. Companies required to comply with the CCPA should consider doing the same.

  1. Coverage for Litigation Costs: Not all policies cover data breach- and privacy-related litigation costs, and others limit the type of litigation costs covered. The CCPA includes a private right of action that many believe will spawn a new wave of privacy class actions. The CCPA provides consumers a private right of action in the event their personal information is affected by a data breach and certain other conditions are met. Consumers may seek the greater of either actual damages or statutory damages ranging from $100 to $750 per consumer per incident. Defense costs could similarly increase as companies defend against shareholder lawsuits and other related litigation. A cyber policy that covers litigation defense helps a company prepare for and mitigate these costs. Companies should consider policies that include robust third-party liability coverage. They should also write into their policies their outside counsel of choice to ensure there is no dispute down the line as to their ability to hire trusted counsel.
  2. Coverage for Intentional Acts of Employees: Some cyber policies exclude coverage for intentional acts by the insured's employees. It is important to understand how this limitation may affect coverage for costs related to the access and disclosure of information by an employee not authorized to access such information. Some new state laws expand the definition of a breach to include "access," not just acquisition, in certain circumstances. For example, the CCPA may be interpreted as expanding the definition of "breach" to include unauthorized access and disclosure. The New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act similarly expands the definition of "breach of the security of the system" to include unauthorized access.
  3. Coverage for Cyber Fraud: Keep in mind that fraud, even if cyber-related, may fall under a separate crime policy. Companies should think through how their cyber and crime policies may interact with regard to recovery of costs related to, for example, fraudulent consumer information requests. Recent reports suggest that companies subject to the GDPR have faced an onslaught of fraudulent data subject requests, which are akin to consumer information requests under the CCPA.4 Companies may want to prepare for a similar situation when the CCPA goes into effect.

Follow Policy Requirements to Ensure Coverage

Beyond potential gaps in coverage, companies should also carefully note additional obligations that they may need to comply with to ensure coverage. Companies should work these obligations into their incident response plans, including by assigning responsibility for the tasks to specific members of their incident response teams. These obligations may include notification obligations or use of insurer-mandated service providers (e.g., a particular cybersecurity forensic firm). Companies should write into their policies their outside counsel of choice to ensure high-quality representation by firms that are familiar with and trusted by their company.

Risk of Insurance Denial of Coverage for Certain Types of Incidents

In the midst of these changes, a few pending cases could lead to troublesome precedent in terms of easing insurance companies' ability to avoid payment of certain cyber-related claims. The most significant of these cases involves a claim Mondelez (a multi-national company with brands such as Oreo and Ritz Crackers) filed under its property policy related to costs incurred as a result of the NotPetya ransomware attack in 2017. After U.S. government authorities attributed the NotPetya attack to a foreign state actor, Mondelez's insurer used that attribution to assert that Mondelez's claim was barred under a war exclusion clause. The parties are now locked in litigation regarding the applicability of the exclusion.

Other potential cybersecurity insurance risk areas include (1) lack of coverage for accidental errors and omissions (as opposed to attacks and unauthorized activity); (2) in cases where there was significant business interruption, some insurers are limiting claims to losses incurred during actual network interruption, not the entire period of business interruption; (3) where the data breach occurs with a third-party contractor or outsourced service provider, some insurance policies do not cover such breaches; and (4) unclear allocation between cybersecurity policy and crime/fraud policy in the case of fraudulent wire transfers originating from business email compromise.

Companies should monitor this and other cyber insurance disputes to ensure they update their policies as necessary.

Conclusion

With the CCPA going into effect in just a few months, companies should reach out to their outside counsel and brokers now to understand what coverage they have, what coverage they think they need and the cost/benefit to buying additional cyber coverage. The following are points companies should consider as they reevaluate their cyber insurance coverage in light of the CCPA and other state privacy laws:

  • Prepare, or ask your broker to prepare, an overview of your current cyber coverage, including whether it includes "compliance" coverage, permits recovery of costs related to an investigation where no underlying cyber incident is discovered (even if no official action is taken by a regulator), covers unauthorized access by employees, includes litigation costs and similar key issues.
  • Ensure you obtain expanded litigation coverage, if you intend to, by January 1, 2020. The CCPA's private right of action is apparently effective as of that date, although public enforcement of the CCPA will not begin until the earlier of six months after the California Attorney General issues its CCPA regulations or July 1, 2020.
  • Write your outside counsel of choice into your cyber policy. Many insurance companies still provide companies the option of doing so and it can facilitate cost recovery to ensure this is done before an event occurs.
  • Update your incident response plans to incorporate key obligations in your cyber policy to ensure you meet all prerequisites for recovery. Incorporate any mandated service providers into your incident response team, as appropriate. Review the California Attorney General Office's regulations once released to see if they suggest you may need additional coverage.
  • Monitor developments related to the CCPA, particularly the private right of action, and reevaluate your insurance coverage at the end of 2020 to determine if you should adjust your coverage.
  • Assign someone on your team, or request outside counsel, to monitor federal and state privacy and cybersecurity developments and schedule regular (perhaps quarterly) updates to ensure your team understands any developing requirements.

Footnotes

1 IBM Security, Cost of a Data Breach Report (April 2019), p. 3, available at: https://www.ibm.com/security/data-breach.

2 Id.

3 See, e.g., Insurance Journal, AXA XL Adds Cybersecurity Services to Cyber Insurance Program (Nov. 30, 2018), available at: https://www.insurancejournal.com/news/national/2018/11/30/510695.htm.

4 See The Register, Talk about unintended consequences: GDPR is an identity thief's dream ticket to Europeans' data (Aug. 9, 2019), available at: https://www.theregister.co.uk/2019/08/09/gdpr_identity_thief/.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
Similar Articles
Relevancy Powered by MondaqAI
Smith Gambrell & Russell LLP
 
In association with
Related Topics
 
Similar Articles
Relevancy Powered by MondaqAI
Smith Gambrell & Russell LLP
Related Articles
 
Related Video
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions