The European Union’s sweeping Global Data Protection Regulation (GDPR), which took effect on May 25, 2018, dramatically expanded the compliance obligations of companies collecting or using European Union citizens’ personal information. It also substantially increased regulatory exposure for companies due to its strict requirements and draconian penalties for non-compliance, including potential fines of greater than 20 million Euros or 4% of a company’s annual worldwide revenue. GDPR Art. 83, § 5. See Perkins Coie’s GDPR Resources for an overview of the regulation, and Will Your Cyber Policy Provide Coverage for GDPR Violations? for a discussion of insurance coverage issues arising from the regulation. Yet the new regulatory landscape facing companies that collect, use, or manage consumers’ personal information has expanded far beyond the GDPR, and many United States jurisdictions have enacted or are in the process of enacting regulations governing the collection, storage, and use of consumer information. As a result, any company that handles consumer personal information must have a thorough understanding of these regulations and must make sure that its insurance program aligns with its regulatory exposure in order to effectively manage the risks arising out of burgeoning cybersecurity and privacy regulations.
Continue Reading Beyond GDPR: Insurance Coverage for Emerging Cybersecurity and Privacy Regulatory Exposure

Many businesses rely upon social media to raise awareness and enhance visibility of a new product or new line of business.  Social media platforms such as Facebook are often used to generate buzz around an opening or a launch before it takes place.  Anticipatory use of social media, however, can complicate insurance coverage if the right policies are not already in place.  The Idaho Supreme Court recently upheld the denial of coverage to a business that had published a preview of a new logo prior to opening.  Scout, LLC v. Truck Ins. Exch., 434 P.3d 197 (2019).  The court held that a Facebook post by the insured pub showing a close facsimile of the anticipated logo constituted a “prior publication,” triggering an exclusion under the pub’s subsequently purchased commercial general liability policy.  Although some other courts have reached different conclusions in relatively similar circumstances, the case stands as a cautionary tale for new businesses.
Continue Reading Social Media and New Businesses: Can Anticipatory Use of Social Media Threaten Insurance Coverage?

Often called the “wild west,” the cyber insurance marketplace offers a wide variety of policy forms that vary drastically in the scope of coverage provided.  This is further compounded by the relatively small amount of case law analyzing cyber policies and the quickly-evolving cyber risks that companies face.  Insurers are quick to deny coverage based on the many exclusions in cyber policies, often leaving policyholders with the option of either spending money to fight their insurer in court or accepting the carrier’s denial.  If your company is insured by a cyber policy (or, for that matter, any type of an insurance policy), you should carefully review the policy, understand its exclusions, and, where possible, take steps to implement practices and procedures to ensure that your company’s activities do not fall within the enumerated exclusions.  Cyber insurers are often willing to modify exclusions in cyber policies to carve back certain coverages, but only when asked to do so.  Analyzing the policy and negotiating with the carrier on the front end, before a claim occurs, can save your company both time and money on the back end if a claim arises. 
Continue Reading Common Exclusions Invoked by Cyber Carriers to Deny Coverage

Despite the increase in data breaches and cyberattacks involving large corporations, efforts to hold directors and officers personally liable for these events have largely been unsuccessful. However, recent developments in two high-profile data breach cases suggest that the relative safety directors and officers have previously experienced from cybersecurity-related suits may be coming to an end. On January 4, 2019, the Superior Court of California approved a $29 million settlement in consolidated derivative litigation brought against directors and officers of Yahoo, Inc. arising out of two data breaches compromising sensitive information of over one billion Yahoo users. See In re Yahoo! Inc. Shareholder Litig., Case No. 17-CV-307054, (Cal. Supp. Ct Jan. 4, 2019). This settlement, which includes a court-approved plaintiff’s counsel’s fee of $8.6 million, represents the first significant recovery in a data-breach related derivative lawsuit targeting directors and officers for breach of fiduciary duty.
Continue Reading Recent Developments in Yahoo and Equifax Data Breach Litigation Suggest Increased Risk of Personal Liability for Directors and Officers for Cybersecurity Incidents

Selecting an appropriate cyber insurance policy can seem daunting. There are a number of different cyber events that have the possibility to impact businesses differently based on a number of factors, including the company’s network design and cyber security readiness. The market for cyber insurance policies does not have a widely-accepted form that is predominantly used by carriers, brokers, or policyholders, resulting in approximately 70 carriers drafting their own cyber insurance policies, many of which are negotiable. Lastly, the risks and technology at issue evolve quickly, adding uncertainty and the potential for a “new” event that may not be covered appropriately by your company’s current policies.
Continue Reading Evaluating Your Company’s Coverage for Ransomware Attacks Under Its Cyber Insurance Policy

For approximately the past decade, cryptocurrencies were used by those who wanted to transact business anonymously and without oversight or restrictions imposed by any governmental authority.  More recently, the concept of cryptocurrencies has been used to raise capital outside of traditional financial structures.  Indeed, the rise of raising money through the issuance of “virtual tokens” using “Initial Coin Offerings” (“ICOs”) has caused a sharp rise in the prevalence and market value of cryptocurrencies.

Those involved with cryptocurrencies believe that their virtues include stronger security against theft, easier transactions, and insulation from government-induced currency fluctuations, among other things.  But the inescapable reality is that hackers, technical errors, and fraud happen.  In addition, regulators have been taking notice and have been attempting to flex their authority, although the manner in which any given regulation applies to cryptocurrencies is far from certain.  One thing that is certain, is that the cryptocurrency “industry” poses unique and evolving risk.  Given this, the insurance industry is also engaged in attempting address the needs of this emerging market, although underwriters can be expected to rigorously assess the risks posed, and insurance procurement can be a challenge for some.
Continue Reading The New Money: Cryptocurrencies and the Role of Insurance

Social engineering and electronic impersonation scams have increased in recent years, as have cases involving resulting claims for insurance coverage. Claims typically involve the impersonation of a company executive, employee, or client and a fraudulent electronic communication directing an employee of the policyholder to transfer funds to another account. As outlined in our update of November 8, 2017, courts differ significantly as to whether or not this situation triggers coverage under a standard crime policy or fidelity bond. For example, some courts have held that the scheme does not produce a loss “resulting directly” from the “use of a computer” as required for certain “computer fraud” coverage. E.g., Apache Corp. v. Great Am. Ins. Co., 662 Fed. Appx. 252, 258 (5th Cir. 2016); Incomm Holdings, Inc. v. Great Am. Ins. Co., No. 1:15-cv-2671-WSD, 2017 WL 1021749, at *8-*10 (N.D. Ga. Mar. 16, 2017). Other courts have reached the opposite conclusion and found coverage. E.g., Principle Solutions Grp., LLC v. Ironshore Indem., Inc., No. 1:15-CV-4130-RWS, 2016 WL 4618761, at *2, *5 (N.D. Ga. Aug. 30, 2016).

Continue Reading False Pretense Exclusion No Bar to Coverage of Fraudulent Impersonation Scams

The European Union’s Global Data Protection Regulation (GDPR) took effect on May 25, 2018, and drastically expanded the compliance obligations of companies involved in the collection, use, and management of any European Union citizens’ data. The GDPR imposes a strict regulatory scheme with steep penalties for non-compliance, with maximum fines set at the greater of 20 million Euros or 4% of a company’s annual worldwide revenue. GDPR Art. 83, § 5. Please refer to Perkins Coie’s GDPR Resources for a more comprehensive overview.
Continue Reading Will Your Cyber Policy Provide Coverage for GDPR Violations?

Welcome to The Perkins Coie Tech Risk Report, a source for updates on, and analysis and interpretation of, insurance issues relevant to emerging technologies. We will address coverage issues related to cyber coverage, privacy, digital assets like cryptocurrency, Blockchain and other emerging technologies. The blog is written for start-ups and other companies dealing with emerging

The potential for cyberattacks and data breaches continues to loom large in any company’s calculus of risk, with events like the recent WannaCry attack only highlighting the threat. For years, the insurance industry has responded in kind by offering variations on forms of cyber risk insurance. However, not all policies are created equal. It is important for the insured to be aware of what is covered—and what is not.

At its most basic level, cyber risk insurance can be divided into first-party and third-party coverages. Most policies will contain some combination of these coverage types. Both of these coverages potentially contain pitfalls for the unwary. 
Continue Reading How to Protect Against Cyber Liability Threats