Cyber Insurance Law and Practice

At the end of 2016, global premium volume in cyber insurance was thought to be in excess of US$ 4bn, with around 80% coming from the US.

The other 20% was split between Europe and Asia, where the product is still catching up.

Premium volume in Europe is expected to rise from US$ 300m in 2016 to US$ 900m in 2018 – a growth rate of 200% in two years. Why this staggering increase? Cyber threats are one of the biggest threats to companies and organisations in the 21st century.

A website linked to cyber attacks on UK banks has recently been shut down following a UK and Netherlands led operation; in May last year the NHS was the victim of a large scale cyber attack; and in March last year the details of 43,000 holiday makers were put at risk of being accesssed after ABTA was hacked. Companies are becoming more and more exposed to the threat of cyber attacks. With traditional commercial general liability insrance policies, in the main, not covering internet-based risks and general IT infrastructure risks cyber insurance policies are on the increase.

In the London market alone there are now 15 policies whereas two years ago there were only 6.

The number of policies is only likely to increase. What do cyber insurance policies cover? Cyber insurance policies cover things such as:- first-party coverage against losses such as data destruction, extortion, theft and hacking; and - liability coverage indemnifying companies for losses to others caused by, for example, errors and omissions, failure to safeguard data, or defamation. Covering both UK and EU law, Cyber Insurance Law and Practice provides a detailed description of cyber risks analysis and the underwriting of cyber risks.

It includes chapters on each section of typical cyber policies, finishing with a chapter on claims and cyber breach response.

In view of the new Data Protection Bill, professionals need guidance as to what type of cyber coverage to obtain and lawyers need instruction.

There are sample clauses and exclusions in the main policy chapters.

There are sections of the GDPR and WP29 Guidelines on Notification and Fines, as well as sections of the Data Protection Act and its explanatory notes.

There are also extracts from the ABI Gross Profit Business Interruption form in the Appendices.