Emerging Legal Trends inCyber InsuranceOctober 2011René SiemensJohn NicholsonPillsbury Winthrop Shaw Pittman LLP
Are You at Risk for a Data Breach or OtherCyber-Related Losses?     Does your product have an intensely loyal consumer fan...
The Current Legal Landscape     Privacy / Data Security Compliance Obligations (for now)            US Federal            ...
The Evolving Legal Landscape     US            Personal Data Privacy and Security Act of 2011 (S.1151) (Sen. Leahy)       ...
What Does Cyber-Liability Insurance Cover?     Third-Party:            Data security breaches            Privacy breaches ...
Third-Party Cyber Coverage: What’s Included?     Crisis Management Expenses            Notification costs            Credi...
First-Party Cyber Coverage: What’s Included?     Costs of restoring, recreating or re-collecting:            Lost data    ...
Cyber Insurance Market Trends            800            600            400                                                ...
Who Is Buying Cyber Insurance?     Source: Marsh Insights: Benchmarking Trends July 20119 | Trends in Cyberinsurance
Who Is Issuing It?10 | Trends in Cyberinsurance
Are Issuers Paying Claims?     Yes, but statistical information is hard to come by     Areas of potential friction:       ...
Ten Tips For Buying Cyber Insurance#1 – Make sure your limits and sub-limits are adequate   • Average remediation cost is ...
Ten Tips For Buying Cyber Insurance#2 – Watch out for “panel” and “consent” provisions   • Policies often provide that you...
Ten Tips For Buying Cyber Insurance#3 – Make sure you are covered for your vendors’ errors  and omissions     Example:    ...
Ten Tips For Buying Cyber Insurance#4 – Make sure you are covered for loss of data, not just  theft or unauthorized access...
Ten Tips For Buying Cyber Insurance#5 – If you handle data for others, make sure your liability to them is covered   Examp...
Ten Tips For Buying Cyber Insurance#6 – Avoid “one size fits all” coverage     Example:       ●    Bank suffers loss of th...
Ten Tips For Buying Cyber Insurance#7 – Beware of hidden traps     Example:      ● Bad                  “The Insurer shall...
Ten Tips For Buying Cyber Insurance#8 – Harmonize cyber insurance with your indemnity  agreements     ● Bad               ...
Ten Tips For Buying Cyber Insurance#9 – Harmonize cyber insurance with your other insurance• Review your agreements with v...
Ten Tips For Buying Cyber Insurance#10 – Negotiate favorable defense provisions   • “Pay defense costs on behalf of” vs. “...
Preparing for/Responding to an Incident1. Know what information you collect. Conduct an audit to identify what   you have ...
What If You Don’t Have Cyber Insurance?    Insurance industry and brokers assert that there is no    coverage under conven...
General                 Errors &                                Liability   Property   Omissions    Crime      Cyber Data ...
Case Study – Sony PSN Attack     Sony PS3 user posts code to “jailbreak” Sony PSN consoles and Sony sues     user in US fe...
Case Study – Sony PSN Attack (cont)     May 14 – Sony brings PSN/Qriocity back online; Offline for a total of 24 days     ...
Questions & Answers                            René Siemens                            Partner                            ...
Upcoming SlideShare
Loading in...5
×

Cyberinsurance 111006

289

Published on

PWSP October 2011 presentation on data breaches and cyberinsurance.

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
289
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
13
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Transcript of "Cyberinsurance 111006"

  1. 1. Emerging Legal Trends inCyber InsuranceOctober 2011René SiemensJohn NicholsonPillsbury Winthrop Shaw Pittman LLP
  2. 2. Are You at Risk for a Data Breach or OtherCyber-Related Losses? Does your product have an intensely loyal consumer fan base? (Sony) Is your organization (or any senior executive) visibly politically active on any controversial issue? (Koch Industries attacked in response to Wisc. protests) Does your organization outsource the processing/collection/storage of personal information to a third party? Does your organization outsource any IT functions with access to personal information? Does your organization ship backup tapes/drives from operational facilities to a backup/storage provider? (SAIC/Tricare) Does your organization process/collect/store personal information about your customers? (SSN, credit card, address, financial information, medical information …) (Betfair) Does your organization process/collect/store personal information about your employees? (SSN, drivers license #, address, insurance information, bank account information, credit card …)2 | Trends in Cyberinsurance
  3. 3. The Current Legal Landscape Privacy / Data Security Compliance Obligations (for now) US Federal GLBA HIPAA / HITECH Red Flags Rules FTC US State privacy/consumer protection laws (e.g., Massachusetts) Canada, EU and many other countries Other - PCI DSS US Data Breach Notification Laws (for now) 46 states + DC, Puerto Rico and others Current trend is addition of medical information HIPAA / HITECH Act Other regulations3 | Trends in Cyberinsurance
  4. 4. The Evolving Legal Landscape US Personal Data Privacy and Security Act of 2011 (S.1151) (Sen. Leahy) Personal Data Protection and Breach Accountability Act of 2011 (S. 1535) (Sen. Blumenthal) Data Breach Notification Act (S. 1408) (Sen. Feinstein) Among others Canada - Sept. 29, update to PIPEDA proposed in Bill C-12 to expand existing privacy law to include data breach notification requirements "It seems to me that its time to begin imposing fines--significant, attention-getting fines--on companies when poor privacy and security practices lead to breaches," - Jennifer Stoddart, Canadian Privacy Commissioner (May 2011) EU - mid-November, EC to publish revised Data Protection Directive which will include: Mandatory data breach disclosure law covering public and private sectors Binding Safe Processor Rules (BSPR) requiring cloud service providers (CSPs) in the EU to be certified by the EU and making them legally liable for data breaches occurring at CSP data centers4 | Trends in Cyberinsurance
  5. 5. What Does Cyber-Liability Insurance Cover? Third-Party: Data security breaches Privacy breaches Content liability (libel, infringement, etc.) First-Party: Loss of data Revenue loss due to interruption of data systems “E-vandalism,” “e-extortion”5 | Trends in Cyberinsurance
  6. 6. Third-Party Cyber Coverage: What’s Included? Crisis Management Expenses Notification costs Credit monitoring services Public relations consultants Forensic investigation Pursuit of indemnity rights Regulatory compliance costs Claim Expenses Costs of defending against lawsuits Judgments and settlements Regulatory Response Costs Costs of responding to regulatory investigations Settlement costs6 | Trends in Cyberinsurance
  7. 7. First-Party Cyber Coverage: What’s Included? Costs of restoring, recreating or re-collecting: Lost data Stolen data Damaged data Revenue lost due to interruption of your operations due to, e.g., Hacking Virus transmission Other security failures7 | Trends in Cyberinsurance
  8. 8. Cyber Insurance Market Trends 800 600 400 Total Premiums Underwritten 200 Source: The Betterly Report 0 2005 2008 2009 2010 Premiums ≈ $15,000 to $35,000 per $1,000,000 of limits, depending on retention and level of covers Source: Aon: Cyber Insurance Options Oct. 3, 2011 Soft market: Premiums declined an average of 8.5% during the first half of 2011 Source: Marsh Insights: Benchmarking Trends July 2011 Large corporations were early adopters Most growth is among middle market companies8 | Trends in Cyberinsurance
  9. 9. Who Is Buying Cyber Insurance? Source: Marsh Insights: Benchmarking Trends July 20119 | Trends in Cyberinsurance
  10. 10. Who Is Issuing It?10 | Trends in Cyberinsurance
  11. 11. Are Issuers Paying Claims? Yes, but statistical information is hard to come by Areas of potential friction: Adequacy of limits, size of retentions Consent and panel provisions Coverage of vendors’ errors and omissions Loss vs. theft of data “One size fits all” crisis management expense coverage Hidden traps Interplay with vendor indemnity agreements “Other insurance” provisions Inadequacy of defense coverage Cyber policies are highly manuscripted: prevent disputes by negotiating clear policy language!11 | Trends in Cyberinsurance
  12. 12. Ten Tips For Buying Cyber Insurance#1 – Make sure your limits and sub-limits are adequate • Average remediation cost is $7.2 million per data breach event • Average remediation cost is $214 per record Source: Symantec Corp. and Ponemon Institute: Global Cost of a Data Breach (2010) • Warning! Many policies impose inadequate limits on “crisis management expenses” and “regulatory action” expenses12 | Trends in Cyberinsurance
  13. 13. Ten Tips For Buying Cyber Insurance#2 – Watch out for “panel” and “consent” provisions • Policies often provide that you must use the insurance company’s pre- approved forensic consultants, defense counsel, etc. • Make sure that yours are pre-approved! • Forensic, notification and defense costs are often covered only if you obtain the insurer’s “prior consent” • Make sure you get it – and obtain policy language confirming that post- tender costs will be covered or at least that the insurer’s consent “shall not be unreasonably withheld”13 | Trends in Cyberinsurance
  14. 14. Ten Tips For Buying Cyber Insurance#3 – Make sure you are covered for your vendors’ errors and omissions Example: ● Bad “The Insurer shall pay all Loss that an Insured incurs as a result of your actual or alleged breach of duty to maintain security of confidentiality Confidential Information” ● Good “The Insurer shall pay all Loss that an Insured incurs as a result of any alleged failure to protect Confidential Information in the care, custody and control of the Insured or a third party to which an Insured has provided Confidential Information”14 | Trends in Cyberinsurance
  15. 15. Ten Tips For Buying Cyber Insurance#4 – Make sure you are covered for loss of data, not just theft or unauthorized access Example: ● Bad “A covered breach shall include the unauthorized acquisition, access, use, or disclosure of confidential information” ● Good “A covered breach shall include the unauthorized acquisition, access, use, disclosure or loss of confidential information”15 | Trends in Cyberinsurance
  16. 16. Ten Tips For Buying Cyber Insurance#5 – If you handle data for others, make sure your liability to them is covered Example: ● Bad “The Insurer will not make any payment for any claim alleging or arising from … your performance of services under a contract with your client” ● Better “The Insurer will not pay for Claims arising out of breach of contract; provided, however, that this exclusion shall not apply to liabilities that the Insured would have in the absence of contract, or arising out of breach of a confidentiality agreement or a professional services agreement for the handling of confidential information” ● Best “The Insurer will pay on behalf of the Insured all Damages and Claim Expense which the Insured becomes legally obligated to pay because of liability imposed by law or Assumed Under Contract”16 | Trends in Cyberinsurance
  17. 17. Ten Tips For Buying Cyber Insurance#6 – Avoid “one size fits all” coverage Example: ● Bank suffers loss of thousands of customer credit card numbers ● Insurance policy covers cost of providing notice and credit monitoring ● Bank would rather just cancel and re-issue the cards Lesson: When procuring insurance, negotiate for the coverage you will need17 | Trends in Cyberinsurance
  18. 18. Ten Tips For Buying Cyber Insurance#7 – Beware of hidden traps Example: ● Bad “The Insurer shall pay Crisis Management Expenses incurred by an Insured arising out of a Claim” ● Good “The Insurer shall pay Crisis Management Expenses incurred by an Insured in response to an actual or alleged security breach”18 | Trends in Cyberinsurance
  19. 19. Ten Tips For Buying Cyber Insurance#8 – Harmonize cyber insurance with your indemnity agreements ● Bad “The Insurer’s liability applies only to amounts in excess of the policy’s Self-Insured Retention. Such Retention Amount shall be borne by the Insured’s uninsured and at their own risk” ● Good “The Insurer’s liability applies only to amounts in excess of the policy’s Self-Insured Retention. Such Retention Amount may be paid either by the Insured, or by the Insured’s other insurance or indemnified by third parties”19 | Trends in Cyberinsurance
  20. 20. Ten Tips For Buying Cyber Insurance#9 – Harmonize cyber insurance with your other insurance• Review your agreements with vendors Make sure your vendors are required to have adequate insurance Ask to be added as an additional insured on their policies Make sure your policy’s “other insurance” clause specifies that their policy will apply first• Example: “This Policy shall be primary, unless the Insured is also covered for the loss under the insurance of a third party, in which case this insurance shall apply excess of amounts actually paid by that other insurance”20 | Trends in Cyberinsurance
  21. 21. Ten Tips For Buying Cyber Insurance#10 – Negotiate favorable defense provisions • “Pay defense costs on behalf of” vs. “duty to defend” Will you control your own defense? • At least negotiate the right to choose your own counsel if the policy has a “panel” provision • Negotiate specific deadlines for payment by the insurer (e.g., within 30 days of invoicing) • If rates are an issue, negotiate them up front!21 | Trends in Cyberinsurance
  22. 22. Preparing for/Responding to an Incident1. Know what information you collect. Conduct an audit to identify what you have and what you really need. Determine whether you can encrypt what you must have. Securely dispose of information when it is no longer required - You can’t lose what you don’t have!2. Create an incident response team including: IT, HR, Legal, CEO/CIO/CFO, Media relations3. Develop incident response plan BEFORE you have an incident Plan for different scenarios (DDOS, insider breach, hacking attack, etc.) Know which third parties you plan to contact – computer security forensics, external legal, law enforcement, crisis communications Conduct practice exercises4. Acquire insurance based on risks and potential losses22 | Trends in Cyberinsurance
  23. 23. What If You Don’t Have Cyber Insurance? Insurance industry and brokers assert that there is no coverage under conventional insurance, but many courts disagree. Therefore, tender to all of your other insurers!23 | Trends in Cyberinsurance
  24. 24. General Errors & Liability Property Omissions Crime Cyber Data security breach POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Privacy breach POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Media liability POSSIBLE NONE POSSIBLE NONE COVERAGE Professional services NONE NONE POSSIBLE NONE COVERAGE Virus Transmission POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Damage to data POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Breach notification POSSIBLE NONE POSSIBLE POSSIBLE COVERAGE Regulatory investigation POSSIBLE NONE POSSIBLE POSSIBLE COVERAGE Extortion POSSIBLE NONE NONE NONE COVERAGE Virus/hacker attack POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Denial of service attack POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Business interruption NONE POSSIBLE POSSIBLE NONE COVERAGE loss24 | Trends in Cyberinsurance
  25. 25. Case Study – Sony PSN Attack Sony PS3 user posts code to “jailbreak” Sony PSN consoles and Sony sues user in US federal court April 4 - Members of Anonymous launch attack on Sony April 20 – Sony takes PSN and Qriocity networks offline April 26 - Sony announces that 77 million names, addresses, email addresses, birthdates, PlayStation Network/Qriocity passwords and logins, handle/PSN online ID, profile data, purchase history and possibly credit cards obtained April 27 – Sony shares fall 2% April 28 – Sony shares fall 4.5%; 1st class action lawsuit filed May 2 – Sony Online Entertainment attacked; 24.6 million customer dates of birth, email addresses and phone numbers, including 12,700 non-U.S. credit or debit card numbers and expiration dates and about 10,700 direct debit records including bank account number breached25 | Trends in Cyberinsurance
  26. 26. Case Study – Sony PSN Attack (cont) May 14 – Sony brings PSN/Qriocity back online; Offline for a total of 24 days May 23 – Sony estimates that PSN breach and restoration cost $171M At least 58 class action lawsuits filed against Sony Numerous additional attacks from other hacking groups target various Sony companies and online properties. Full timeline July 20 – Zurich Insurance filed suit seeking a declaration that various Zurich policies do not provide coverage for hacking claims Zurich issued: Primary CGL policy to Sony Online Computer Entertainment America LLC (“SCEA”) Excess liability policy to Sony Corp. of America. Policy attaches above a lead umbrella policy issued by National Union Primary CGL policy to SCEA for its Canadian operations Zurich policies provide coverage for “bodily injury,” “property damage” and “personal and advertising injury” arising out of an “occurrence.” Zurich argues Sony claims do not allege any such injury or damage and therefore Zurich does not owe a defense or indemnification to Sony under any of its policies26 | Trends in Cyberinsurance
  27. 27. Questions & Answers René Siemens Partner Pillsbury Winthrop Shaw Pittman LLP +1 213.488.7277 reynold.siemens@pillsburylaw.com John Nicholson Counsel Pillsbury Winthrop Shaw Pittman LLP +1 202.663.8269 john.nicholson@pillsburylaw.com27 | Trends in Cyberinsurance
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×