War exclusions, unpatched systems and late notice are being tested as insurers push back on large claims. In this article we look at the background, the key issues and what readers should do next.
The background
To understand why this matters now, it helps to look at how the position developed. For years the rules in this area were settled, and most practitioners could advise clients with confidence. That changed as courts, regulators and clients began asking harder questions, and as new technology and business models exposed gaps that the old approach never anticipated.
The result is a period of uncertainty. Different courts have reached different conclusions on similar facts, guidance has been issued piecemeal, and the practical burden has fallen on the people and businesses who have to make decisions before the law is fully settled. For readers, the most important point is that the outcome in any individual case will depend heavily on its facts.
The legal obligations
Organisations that collect personal data must keep it secure, use it only for proper purposes and be open about what they do. When something goes wrong, notification duties can start running within hours.
Regulators have made clear that a cyber attack does not excuse poor preparation. Fines and claims often turn on what the organisation did before the incident.
Preparation is the cheapest insurance any party can buy.
Placeholder quote
A readiness checklist
Privacy and security teams that handle incidents well tend to have the same foundations in place.
- A tested incident response plan with named decision-makers
- Up-to-date records of what data is held and where
- Contracts that set out supplier security obligations
- Pre-agreed contacts for forensics, legal advice and communications
Common questions
Does this apply everywhere? No. The rules differ between jurisdictions, and local procedure can change the practical outcome even where the principles are similar.
When should someone get advice? As early as possible. Deadlines in legal matters can be short, and early advice usually costs less than fixing problems later.
What happens next
Expect further guidance, test cases and commentary over the coming months. Criminal Minds Cast will keep following the story and update this article as the position develops.
Demo content from the Criminal Minds Cast theme. Replace or delete this article before launch.
Join the discussion