Insights
Publications

Time to Check Your Cyber Insurance

February 20, 2020 Articles
TAG Cyber Law Journal

Now that the CCPA is in effect, some companies will need to revise their policies.

The cyber insurance markets are beginning to adapt to the new California Consumer Privacy Act (CCPA) which went into effect on January 1.

There is great variation in how cyber insurance policies currently address risks under the CCPA. And further developments are expected as the law begins to impact companies under its jurisdiction—that is, companies that, regardless of their location, are for-profit, collect data from California residents, and either have annual revenue of at least $25 million; or collect, store and/or save the data of at least 50,000 California data subjects; or realize at least half of their revenue from the sale of data.

It is critical that companies subject to the CCPA understand the nuances of cyber insurance policies, and how they may be able to negotiate favorable coverage terms when they buy or renew them this year. But first, a little background.

The CCPA provides rights to California residents whose personal data is collected by a company. For example, consumers have the right to understand what categories of data will be collected (and have already been collected) and what the companies do with that data. They have the right to opt out of the sale of their data, the right to have it deleted, the right to avoid pricing discrimination based on data choices they make, and the right to expect companies that hold their data to protect it.

All of those rights except the right to data security are enforced by the California Attorney General’s Office through its investigation and fining powers granted under the act. While the attorney general can impose fines of up to $7,500 per violation of the CCPA, even more significant liability can arise through the private right of action available to consumers whose data is at risk because of a breach where reasonable security measures were not in place.

Specifically, an individual consumer may recover anywhere from $100 to $750 in statutory penalties “per [data breach] incident” if his or her nonencrypted and unredacted personal information was subject to unauthorized access as a result of a business’s failure to implement and maintain reasonable security procedures and practices. Thus, the potential liability can be significant in a class action lawsuit. Indeed, because it is unlikely that an individual consumer will file a lawsuit for $750, the true power here lies within the class action realm. If a data breach impacts 1 million consumers, the potential recovery could be up to $750 million.

The Impact on Insurance Policies

A company with California operations buying or renewing its cyber insurance policy at this time should proceed with caution. It should avoid making unfounded assumptions about how the privacy liability and regulatory action aspects of a cyber insurance policy work. These may not cover all claims brought under the CCPA.

First, most cyber insurance policies defend and indemnify insured companies against certain types of regulatory actions. One might assume that an action brought by the California attorney general for an alleged violation of the CCPA would qualify as a covered regulatory action. In many instances, however, the regulatory action coverage is triggered only by a data security breach.

As is evident from the long list of consumer rights under the CCPA set out above, there are many opportunities for a company to violate the CCPA without having suffered a data security breach. If the regulatory action coverage is defined too narrowly, and applies only to regulatory claims arising from a data security breach, the insured company will have no chance of securing reimbursement of defense costs or any settlement or award that doesn’t involve a breach. The insurance buyer should seek to expand the agreement to encompass all enforcement actions brought under the CCPA.

Second, even if the regulatory action coverage applies broadly to enforcement arising from privacy violations other than data security breaches, many cyber insurance policies define privacy violation too narrowly. They may not capture some violations that the insured company might be alleged to have committed.

Cyber insurance policies often define this provision with a laundry list of possible infractions based on antiquated conceptions of what privacy rights exist. But the CCPA grants new privacy rights to consumers, which creates the risk of claims based on violations that are not identified in the cyber insurance policy. For example, many policies do not state that coverage includes the right to be free of pricing discrimination. Accordingly, insurance buyers would be wise to either ensure that the laundry list of covered privacy violations includes those identified by the CCPA or, even better, that privacy violation means simply any violation of the CCPA.

Third, cyber insurance policies may exclude coverage for certain fines, penalties and punitive damages, or applicable law may bar insurers from extending such coverage. California law broadly prohibits insurers from covering remedies aimed to punish. Much of the relief that the California attorney general can recover under the CCPA is based on statutory fines. Whether these fines are intended solely to punish a company that violates the CCPA will depend on the circumstances of each particular case. But insurance buyers can strengthen their positions by negotiating a broad choice-of-law clause into the policy that will allow the insurer to cover fines, penalties and punitive damages to the extent permissible under any jurisdiction’s laws, or at least any jurisdiction with some connection to the policyholder or the claim. This will give the policyholder (and the insurer) a stronger basis to justify the provision of coverage for a fine imposed under the CCPA.

There is no standard cyber insurance policy, in part because the cyber risk landscape has changed so drastically and unpredictably over the past decade. Each insurer has its own policy language, but most insurers are willing to negotiate the policy terms. As a result, an insurance buyer should not blindly accept whatever policy the insurer offers them. They should closely review the proposed policy to ensure that it addresses their unique risks—and, if it does not, request enhancements. Otherwise, when a claim is received, they may be in for a sore surprise that the policy they bought does not clearly provide the coverage they need and thought they had.

Sushila Chanana is special counsel at Farella Braun + Martel. She is a high-stakes technology litigator and legal adviser who counsels companies on compliance with various data protection laws, including the CCPA. Her litigation experience includes complex patent, trademark, copyright and trade secrets disputes. Prior to her legal career, Chanana was a cyber security consultant at PricewaterhouseCoopers.

Nate A. Garhart is special counsel at the firm and counsels clients on internet issues, online privacy and compliance with laws such as the CCPA and the EU’s GDPR. His practice also focuses on maximizing the value of trademark and copyright properties.

Tyler Gerking is chair of the firm’s insurance recovery group and co-chair of its privacy and cyber security group. He represents corporate policyholders in complex, high-stakes insurance matters. He also helps clients negotiate policy terms, shepherds clients through the claim process, and pursues breach of contract and bad faith claims against insurance companies.

Firm Highlights

Publication

Wine 'Smoke Taint' Blurs Insurance Coverage Distinctions

Recent wildfires in California Wine Country, particularly those that devastated parts of Napa and Sonoma counties in October 2017, have focused attention on whether insurance covers smoke taint damage to grapes and wine. Many...

Read More
Publication

Reimbursement of Employment-Related Expenses Is Not a “Wage and Hour” Claim Within the Meaning of EPLI Exclusion

A recent California appellate court decision found that a wage and hour exclusion in an Employment Practices Liability Insurance (“EPLI”) policy did not bar coverage for claims under California Labor Code sections 2800 and...

Read More
News

Calif. Justices Set Montrose's Excess Enviro Coverage Path

Insurance recovery partner Mary McCutcheon commented on the California Supreme Court's decision in the Montrose Chemical Corp. of California v. Superior Court of Los Angeles County case. In the article, Mary noted that although...

Read More
Publication

Business Interruption Coverage for the Coronavirus (COVID-19)

The coronavirus (COVID-19) has already caused severe disruption to the economy. In the U.S., governmental entities as well as the private sector are implementing more and more drastic measures to respond to the coronavirus...

Read More
Publication

Another Federal Circuit Finds Phishing Loss Covered Under Crime Policy

Companies of all sizes have fallen victim to attacks whereby fraudsters will use deceptive communications, such as spoofed emails, to trick an employee into transferring money into the fraudsters’ control. While these increasingly prevalent...

Read More
Publication

Are Losses Resulting from Phishing Incidents Covered by Crime Policies Insuring Against Computer Fraud?

It is an all-too-common dilemma. As phishing schemes have become more prevalent and more sophisticated, businesses of all sizes have fallen victim to these attacks where a fraudster will use a spoofed email or other...

Read More
News

Insurers Brace for Coronavirus Hit to ‘Event Driven’ D&O Line

Mary McCutcheon was quote in the Claims Journal article,"Insurers Brace for Coronavirus Hit to ‘Event Driven’ D&O Line." Link to read the full article .

Read More
News

North Bay Wineries Taking Insurers to Court Over Denied Smoke Taint Claims

Tyler Gerking, chair of Farella's Insurance Recovery Group, was quoted in the Napa Valley Register article, "North Bay Wineries Taking Insurers to Court Over Denied Smoke Taint Claims." In the article, Tyler said he would expect...

Read More
Publication

Directors & Officers Liability Issues and the Coronavirus: Is That a “Thing”?

Over the last few weeks we have seen a number of informative articles discussing the crucial issue of coverage for business interruption claims arising out of government shutdowns of businesses to inhibit the spread...

Read More
Publication

INSIGHT: California Ruling in Wage-Hour Coverage Suit Offers Employers a Defense Hook

Wage-and-hour exclusions are common in EPLI policies, frequently with defense-only sub-limits that are woefully inadequate. Farella Braun + Martel LLP’s Shanti Eagle looks at a recent decision adding an avenue to establish or expand...

Read More