Everybody knew it was coming. But many companies are still scrambling to figure out how the EU's General Data Protection Regulation ("GDPR") – which went into effect on May 25, 2018 –will affect how they do business. But while publications are awash with advice regarding compliance, few tackle the question of whether your business is protected against loss in the event of a data breach or other unintentional failure to comply. It is strongly recommended that your due diligence include a review of your insurance coverage for GDPR non-compliance, especially for fines, penalties and lawsuits (individual or class action).
Coverage for Costs of Compliance
Many costs that companies will incur to comply with GDPR simply will not be covered by any insurance. Insurance is designed to respond to fortuitous loss or liability, not ordinary costs of doing business. Thus, for example, coverage likely is unavailable for expenses to implement data security measures, maintain required records or hire a data protection officer.
On the other hand, the cost of notification in the event of a data breach is a standard feature of specialized "cyber" insurance policies. The GDPR requires a "controller" of personal data to notify the relevant supervisory authority "without undue delay" and, where feasible, within 72 hours of discovering a breach, unless the breach is unlikely to involve a "risk to the rights and freedoms of natural persons."
Further, where the breach is likely to result in a high risk to such rights and freedoms, the controller also must notify the affected data subjects without undue delay, subject to certain exceptions. Cyber policies generally do cover the cost of notification to individuals. You should examine your policy to make sure that coverage applies in the event of a suspected breach as well as in the case of known unauthorized disclosure. On the other hand, not all cyber policies currently cover the cost of notifying privacy regulators – an important coverage addition to explore with your insurer at renewal time.
In addition, cyber policies typically cover fees for legal advice on compliance with breach notification laws. A best practice would be to expressly include GDPR among the "Privacy Laws" enumerated in your cyber policy.
Coverage for Fines and Penalties
Commentators have expressed doubt whether coverage will be available for GDPR fines, in part because of their sheer magnitude. The GDPR provides for two tiers of administrative fines – the higher topping out at the greater of a whopping €20 million or four percent of global annual turnover for the preceding financial year. The higher tier applies to a wide range of violations, including:
• processing personal data without either the subject's express consent or one of several prescribed alternative justifications;
• failure to provide data subjects with transparent information regarding their rights under the GDPR;
• failure to give the data subject required access to his or her data or to rectify inaccurate data; and
• failure to comply with the rules governing the transfer of personal data outside the EU.
Lower-tier fines – up to the greater of €10 million or two percent of global annual turnover for the preceding year – apply to violations such as failure to timely notify the supervisory authority of a breach, to cooperate with the data protection supervisory authority, or to appoint a data protection officer.
Cyber policies generally do provide coverage for civil fines and penalties imposed by governmental authorities for breach of privacy laws, but there are three key caveats in relation to GDPR. First, many cyber policies today limit coverage for regulatory fines and penalties to those imposed as the result of a data breach. Fines imposed for violations of nonbreach-related GDPR provisions may not be covered under such policies. A second real concern is whether it will even be possible to obtain full protection. Analysts have noted that, based on its revenues, a typical FTSE 100 company could face up to £5 billion for GDPR violations. Very large companies may be able to purchase over $100 million in cyber coverage, but probably nowhere near the theoretical maximum of a GDPR fine. Finally, cyber policies commonly contain language barring coverage for fines and penalties unless they are "insurable by law." The better policies also provide that the insurability of fines or penalties shall be determined by the "laws of any applicable jurisdiction that most favors coverage for such monetary fines or penalties." Uncertainty nevertheless arises because the insurability of fines such as those imposed by the GDPR largely has not been tested in EU courts (or U.S. courts, for that matter), while several European jurisdictions appear expressly to prohibit insurance for such penalties. For these reasons, policyholders and insurers alike should consider enhancement of current policy wordings and limits in light of GDPR.
Also importantly, only civil fines are covered by insurance – criminal penalties almost never are. GDPR administrative fines are civil in nature. But the GDPR permits EU Member States to impose their own penalties for violations outside of administrative fines. These penalties may be criminal in nature and most likely would not be covered.
Coverage for Third-Party Liability
The GDPR also confers a private right of action on data subjects for violations of the regulation. Individuals may seek monetary damages in the EU Member State in which they reside, or in which the defendant data controller or processer has an establishment. Although cyber policies provide coverage for damages and defense costs arising out of third-party claims due to privacy breaches, not all claims for violations of GDPR would be covered under many current wordings. Some policies cover liability arising out of the unauthorized access to or disclosure of personally identifiable information, but do not address the wrongful collection or processing of information in the absence of disclosure, the failure to provide individuals access to their own information or to correct or delete data when requested, or the failure to make required disclosures when obtaining data subjects' consent.
Just the Beginning
Many see the GDPR as only the first of such laws to be passed. The California Consumer Privacy Act of 2018 ("CCPA") was passed in record time and signed into law June 28, 2018, to go into effect January 1, 2020. The CCPA has many features that are similar to the GDPR, including a focus on consumers' rights to obtain information about how their information is being collected and for what purpose, to request deletion of their information, and to opt out of the sale of their information. Other states are expected to follow suit. Cyber policies remain a vital source of protection for businesses soon to be subject to the GDPR and U.S. state laws. But policyholders need to re-evaluate their programs, and insurers need to continue to modify policies to maintain competitive value. Ready or not, the GDPR and its progeny are here to stay.