Lawyers divided over insurability of GDPR fines

Lawyers are divided over whether data protection fines under the General Data Protection Regulation (GDPR) are insurable, with Herbert Smith urging caution against the position that all such fines cannot be covered by insurance in the UK. Last week, UK regulator the Information Commissioner’s Office (ICO) proposed GDPR fines against British Airways for £183.4m (€204.8m) and Marriot International for £99m (€110m). These are some of first real tests of the GDPR and raise unanswered questions about the insurability of fines. Law firm Herbert Smith said that while many insurance policies cover civil fines, the GDPR does not specify whether insurance for fines is permitted or prohibited. It also noted that the ICO itself has said it is unaware of insurance that would cover its fines. But Herbert Smith said until there is some clarity from courts, it would “urge caution against the school of thought that treats all GDPR fines as uninsurable”, adding: “They may be in some cases but there is a debate to be had.” Questions over the insurability of GDPR fines become even more complicated given the different legal positions in each European country. Last week, DLA Piper said GDPR fines are insurable in only two European countries – Norway and Slovakia. The law firm said the issue remains a grey area in ten countries – Croatia, Czech Republic, Estonia, Germany, Greece, Hungary, Lithuania, the Netherlands, Poland and Sweden. DLA Piper believes that in all remaining countries it studied, including the UK, GDPR fines are not insurable. “There are only a few jurisdictions where it is clear that civil fines can be covered by insurance – even then there must be no deliberate wrongdoing or gross negligence on the part of the insured . Criminal penalties are almost never insurable. GDPR administrative fines are civil in nature, but the GDPR also permits European member states to impose their own penalties for personal data violations. If those penalties are criminal, they almost certainly would not be covered by insurance,” the DLA Piper guide states. But it does note that legal costs can be covered by insurance. Herbert Smith said that using the principles of common law, a fine for a deliberate or criminal act cannot be reimbursed by insurance, but the general principles are muddied by the range of breaches and conduct covered by GDPR and ICO fines. It said the illegality defence, or ex turpi causa, where a legal right of action can be prevented by the courts when founded on immoral or illegal conduct, is central to the argument. “The issue is whether an insurer is entitled to rely on this defence, and refuse cover, in response to an insured’s claim for indemnity for an ICO fine,” Herbert Smith said. One of the main issues is the range of conduct and behaviours covered by the GDPR and the scale of breaches. “The insurability of an ICO fine may turn on the nature of the GDPR provision that has been breached, and the behaviour that caused the breach,” Herbert Smith said. It said fines levied for an unintentional data breach as part of a nation cyberattack may be treated differently by the courts to those levied against firms that knowingly process customers’ personal data without consent. Herbert Smith said several factors fall in favour of the uninsurability-of-fines argument, including the GDPR’s intention to protect individuals’ rights and corporate responsibility for penalties resulting in breach of the GDPR. At the same time, it could be argued that ICO fines under the GDPR are insurable in some circumstances, it added. In particular, Herbert Smith said “the imposition of a fine for breach of the GDPR does not necessarily require intent and many offences are strict liability offences”.

Lawyers divided over insurability of GDPR fines

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles