Turkish policyholders and insurers urged to take fresh look at cyber cover

Turkish risk and insurance managers have been urged to take a fresh look at their cyber insurance coverage, following the rise of remote working and particularly the ability or otherwise of cover to respond to fines imposed by public bodies. Lale Defne Mete, Koksal Kaplan and Serra Kaya of leading Istanbul law firm Cetinkaya explained that it is generally assumed that damages incurred by third parties and the payments made to public institutions because of a cyberattack are covered by professional liability insurance. But the Cetinkaya team pointed out that article 1404 of the Turkish Commercial Code No. 6102 (TCC) strongly suggests that it is risky to cover administrative fines and any other penalties imposed by Turkish public institutions such as the Personal Data Protection Authority and the Banking Regulation and Supervision Agency through cybersecurity insurance. “According to article 1404 of the TCC, insurance that covers losses as a result of the policyholder's or insured's breach of mandatory rules, moral values, public order or rights of personality will be null and void,” stated the legal team. They argued that imposing administrative fines and any other penalties is intended mainly as a deterrent to force companies to act in accordance with the laws and regulations. “Therefore, it can be argued that insurance policies covering such fines and penalties should be considered as a breach of their purpose and a breach of public order. In this regard, liability insurance that covers fines and penalties may be evaluated as a breach of public order and courts may decide that an insurance contract should be deemed invalid from the date of its execution,” argued the Cetinkaya team. The lawyers explained that according to article 1444, following the execution of a contract, a policyholder cannot act or make any transaction causing the amount of indemnity to increase without the insurer's prior consent. In such cases, an insurer may request an additional premium or terminate a contract within one month of the date that they became aware of the policyholder's actions, they pointed out. “If a policyholder negligently causes such an act or transaction affecting the amount of insurance coverage, an insurer may request a reduction in insurance coverage depending on the degree of the fault. If the policyholder has acted with intent, the insurer will be discharged of its payment obligations,” stated the team. “In this regard, cybersecurity insurance policyholders should take technical, systemic and administrative measures in accordance with the market standards against cyberattacks. In addition, a company's software and hardware should be adequate to protect them from such attacks,” continued the lawyers. “If an insurance company determines that a risk occurred because of a company's negligence, it may request a reduction in insurance coverage depending on the degree of the fault,” they added. Risk and insurance managers in Turkey and across Europe are having to deliver more and more information about the protection they have in place and risk management systems in relation to cyber. They can only expect this to intensify over time. The Cetinkaya team advised insurers to carry out more detailed analysis of policyholders’ systems before offering cover, because of the recently heightened risk. Before signing a cybersecurity insurance contract, an insurer must examine a policyholder's computer systems, software and hardware systems, applications and cloud systems, it advised. Risk and insurance managers will also have to expect to work with third-party IT firms that are helping insurers assess and price the risk. “IT companies operating in Turkey are increasingly focused on providing such analysis services to insurers. In terms of cyber insurance, cooperating with IT companies that examine companies' systems in detail puts insurers in a more secure position,” stated the lawyers. The Cetinkaya team pointed out that the recent dramatic rise in cyber incidents and exposure, coupled with the lack of legal and regulatory clarity on whether the risk is actually covered and how, demands a far greater risk assessment and management effort by both policyholders and insurers. “Due to recent technological developments and the increase in remote working as a result of the Covid-19 pandemic, obtaining strong cybersecurity has become a necessity. Businesses globally hold a large amount of personal information data, which potentially exposes them to cyberattacks, fines by the relevant authorities and lawsuits from customers and their personnel,” they stated. “There are still no legal regulations regarding cybersecurity insurance; therefore, both insurers and policyholders should be aware of the risks… and ensure that they have made thorough assessments and/or taken additional policies in order to reduce those risks,” concluded the Istanbul-based expert legal team.

Turkish policyholders and insurers urged to take fresh look at cyber cover

Want to read this article?

Read Next

State National to enter UK market to serve MGAs

Markel appoints war and terrorism senior underwriter

Enel confirms first onshore captive in Italy

EC probes car battery cartel

Rate increases drive AM Best’s stable outlook for global reinsurers

State National to enter UK market to serve MGAs

Markel appoints war and terrorism senior underwriter

Enel confirms first onshore captive in Italy

EC probes car battery cartel

Rate increases drive AM Best’s stable outlook for global reinsurers

This website uses cookies to improve your experience. You can review our Cookie Policy here.

Want to read this article?

Read Next

State National to enter UK market to serve MGAs

Markel appoints war and terrorism senior underwriter

Enel confirms first onshore captive in Italy

EC probes car battery cartel

Rate increases drive AM Best’s stable outlook for global reinsurers

Related Articles

This website uses cookies to improve your experience. You can review our Cookie Policy here.