GDPR and focus on privacy set to increase D&O risk

A growing focus on privacy and tougher EU data protection laws could drive future claims against directors and officers, experts warn. The recent alleged misuse of personal data belonging to Facebook users has shone the spotlight on privacy liability just as the EU implements its General Data Protection Regulation (GDPR) on 25 May. The GDPR introduces new rights for consumers and places increased responsibility on organisations that collect, store or use personal data relating to EU citizens. It also introduces hefty fines for breaches of data protection law – up to 4% of global turnover for the most severe cases. Had Facebook’s breach happened under the GDPR, the company may have faced a fine in excess of $1bn. The combination of large data breaches and tough regulation are creating significant liabilities for corporations and raising concerns for directors and officers. Cybersecurity and privacy breaches are increasingly resulting in litigation as investors seek to recover losses. Following revelations that Cambridge Analytica harvested the data of an estimated 87 million Facebook users without their permission, the social media company’s share price fell more than 10%. It now faces a number of securities class action lawsuits in the US. Similarly, flawed Intel and AMD processors – which create potential cybersecurity issues for users – have resulted in securities class action lawsuits against the companies, as have breaches at Equifax and Uber. In 2017, US plaintiffs filed nine federal class action securities fraud lawsuits following cybersecurity incidents, according to data from Bloomberg. Facebook and Uber are high-profile examples of privacy and data breaches, but they are occurring across financial services and other industries with an increasing degree of frequency, according to Graham Ludlum, insurance partner at law firm DAC Beachcroft. “The law continues to develop to give individuals greater rights of redress in the event of privacy or data breaches. This will inevitably drive claims in the future,” he said. Data breach and privacy claims have been made against directors in the US and Europe, but with limited success, according to Mr Ludlum. Many of the earlier cases in the US were derivative claims based on damages caused to a company, for which relatively limited redress is available in comparison to a securities action, he explained. However, Yahoo’s settlement in March was widely regarded as the most significant data breach-related shareholder lawsuit recovery to date. Yahoo was being sued by investors after revealing two massive data breaches in 2016, but has now settled a related securities class action lawsuit for $80m. “The majority of such claims failed because the board had taken reasonable steps to protect the IT security of the company. Cases have been filed against Yahoo because the announcement of its data breach, unusually, was of sufficient magnitude to materially affect its share price. As such the damages potentially payable, including by the board, are significant,” said Mr Ludlum. “As yet no trend is discernible, but the coming into force of the GDPR and potential implications for a company of failing to deal properly with a data breach suggests a likely increase in both the frequency and magnitude of claims,” he said. The focus of the GDPR on data protection emphasises that this is a matter of corporate governance, according to Mr Ludlum. “Failure of the board to ensure compliance with relevant data protection rules and principles could be a basis on which a claim could be made against a director. This could be either an investigation by a regulator or a derivative claim against directors. Such claims would be covered under a traditional D&O policy,” he explained. Carly Eveniss, management liability portfolio manager at QBE in London, explained that the GDPR requires directors and officers to certify that their company is compliant. Although any GDPR fine will be awarded against a company, it is not clear whether that firm could look to recover the cost from its directors and officers, she said. A recent paper on D&O from Airmic also warned risk managers that directors are open to lawsuits from company shareholders alleging they failed to exercise reasonable care and diligence. “Shareholder plaintiffs are using a company’s cybersecurity practices as a foundation for asserting allegations against the company’s directors and officers in the wake of a data breach disclosure, and with corresponding drop in the company’s stock price,” the association said. “While the tort environment remains the most punishing in the US, litigiousness is spreading globally, evidenced by the latest wave of collective actions across Europe,” it added. Unsurprisingly, the GDPR has prompted some insurance buyers to review their D&O cover and consider whether limits are appropriate. “Directors and officers’ policies typically do not exclude cyber claims, therefore most customers are comfortable with the cover that they have in place. No doubt, there are discussions taking place with brokers as to whether the limit purchase is sufficient, not just in respect of the GDPR but the general increase in directors’ duties,” said Ms Eveniss. D&O insurers are also keeping an eye on the GDPR and asking questions about compliance. “In the majority of customer meetings, the question of GDPR and whether companies feel that they will be compliant by 25 May 2018 is being raised. I’m pleased to say that the ones I have spoken to are confident that this is the case,” said Ms Eveniss. “For insurers it’s not just ensuring that our customers are compliant, but also third-party vendors that process data on their behalf,” she added. According to Airmic, senior management must be able to demonstrate they have taken necessary steps to prevent the loss of sensitive data and have a tried-and-tested breach response procedure in place. They risk fines and regulatory action for failing to do so. When a cybersecurity breach does take place, the actions of the board may be under scrutiny, Airmic said in its report. “It is important that senior management focus their attention on establishing responsibilities for implementing and managing cyber issues within a company, both before, and after, a cyber event,” it added. Some boards have done this by appointing a director with a security background. Some have also created a separate committee for cyber risk management, the association explained.

GDPR and focus on privacy set to increase D&O risk

Want to read this article?

Read Next

ISSB opens reporting projects on biodiversity and human capital

UK regulator widens net for sustainability disclosure rules

CFC forms team focused on M&A deals in renewable energy market

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

ISSB opens reporting projects on biodiversity and human capital

UK regulator widens net for sustainability disclosure rules

CFC forms team focused on M&A deals in renewable energy market

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Want to read this article?

Read Next

ISSB opens reporting projects on biodiversity and human capital

UK regulator widens net for sustainability disclosure rules

CFC forms team focused on M&A deals in renewable energy market

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Related Articles