The Insurability of GDPR Fines

The introduction of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) has raised data protection to a board level issue, as companies are faced with potentially vast fines in the event of an infringement of the GDPR.  This level of focus has also led to an increase in the take up of cyber insurance policies.  As the first fines are imposed across Europe, a question will now be asked of insurance companies: are GDPR fines actually insurable?

In January 2019, a fine of €50 million (the most significant fine to be imposed under the GDPR regime to date) was imposed by the French data protection authority (the CNIL) on Google LLC. More recently on 8 July 2019, the UK Information Commissioner’s Office announced its intention to fine British Airways £183.39 million (which will be the largest fine to date under the GDPR regime if imposed) for infringements of GDPR relating to a cyber-security incident which occurred in September 2018 and the following day (in response to a statement made by Marriott in a regulatory filing) announced its intention to fine the Marriott hotel chain £99 million fine for infringements of the GDPR relating to a cyber incident in November 2018.

Although the Irish Data Protection Commission (the “DPC”) is yet to impose any fine under the GDPR, it seems likely it will only be a matter of time before we see the first fine imposed in Ireland.  In 2018, the DPC received 4,113 complaints and a number of statutory investigations have since been commenced under the GDPR.[1]  It appears it will not be long before we see the first Irish administrative fine under the GDPR and, indeed, the DPC’s 2018 Annual Report strongly suggests this to be the case.

While some cyber insurance policies expressly exclude cover for fines and penalties, others provide cover “to the extent insurable by law”.  However, the extent to which GDPR fines are insurable is still uncertain in Ireland and in a number of other jurisdictions, including the UK.  Such uncertainty has prompted the Global Federation of Insurance Associations to call for guidance from the Organisation for Economic Cooperation and Development (the “OECD”).  While such guidance would not be binding, it would be a helpful starting point for both insurers and insureds to consider their potential exposure.

GDPR Fines

The GDPR introduced a new regime of administrative fines for data protection infringements and provided for a tiered penalty structure based on the nature of the infringement.  Under the old regime, the DPC was required to initiate court proceedings in order to prosecute offending organisations.  It would then be the Irish Courts, rather than the DPC, that would impose the (often modest) monetary sanction on the offending company.  Under the GDPR, the DPC can now directly impose fines on offending organisations.[2]  This makes it much easier for the DPC to target companies that do not meet their data protection responsibilities.

The GDPR splits administrative fines into two tiers.  The lower-tier administrative fines, which we will call ‘tier 1’ fines, allow for fines of up to €10 million, or 2% of the company’s total worldwide annual turnover of the preceding financial year, whichever is greater.  Examples of actions that will attract this level of fine are where a company does not obtain a child’s consent for the processing of their personal data or where a company infringes its data governance obligations, such as failing to communicate a personal data breach to the DPC, improperly appointing processors, failing to maintain data protection records or failing to implement appropriate security measures.

The higher-tier administrative fines, which we will call ‘tier 2’ fines, allow for fines of up to €20 million or 4% of the company’s total worldwide annual turnover of the preceding financial year, whichever is greater.  Examples of actions which will attract this level of fine are where a company fails to follow one of the core data protection principles (ie, transparency, data minimisation, data retention or accountability) or where a company does not have a lawful basis for processing personal data, unlawfully processes special categories of personal data, or infringes the data protection rights of data subjects.

The third level of fine, which we will call a ‘tier 3’ fine, is a fine which has been specifically implemented by legislation in a Member State.  In Ireland, these fines are set out in the Data Protection Act 2018 (the “2018 Act”).  The 2018 Act sets out a number of offences which could lead to prosecution against a company or person.  The penalty for committing such an offence is a fine of up to €5,000 and / or up to 12 months imprisonment on summary conviction or a fine up to €250,000 and / or up to 5 years’ imprisonment on indictment.  Therefore, while ‘tier 1’ and ‘tier 2’ fines are expressly stated by the GDPR to be administrative in nature, ‘tier 3’ fines are criminal in nature.  Examples of actions that will attract a ‘tier 3’ fine are forcing an individual to make a data subject access request (which can often occur in the employment context), failing to respond to an information notice or enforcement notice issued by the DPC, not cooperating with an officer of the DPC in the course of an investigation, or the disclosure of personal data without the prior authority of the controller or processor.

Whether a ‘tier 1’ and ‘tier 2’ fine is imposed by the DPC will depend on the nature of the GDPR infringement.  The level of the fine, within that tier, which is ultimately imposed is dependent on a number of factors, including the severity of the infringement.  Critically, the GDPR provides that the DPC must ensure that the imposition and amount of all fines under the GDPR is “effective, proportionate”, and importantly “dissuasive”. That is, the fines are designed to dissuade companies from infringing their data protection obligations and responsibilities.

“Insurability”

As a new regime, the question of insurability of GDPR fines has not yet come before the courts in Ireland and the 2018 Act is silent on insurability of administrative fines.Criminal or punitive fines and penalties have long been considered uninsurable for public policy reasons.  However, there is less clarity where fines are administrative in nature.  In the absence of clarification from the courts or legislature, it is helpful to consider the public policy considerations underpinning this question.

The legal doctrine of ex turpi causa prevents a claimant from pursing legal remedies in order to recover or benefit as a result of their own illegal acts.  Where a fine or penalty is intended to be a deterrent or dissuasive, public policy would clearly be undermined if a wrongdoer could simply insure against the payment of a fine.

The English Court in Safeway v Twigger[3] considered a fine imposed on a company under the UK Competition Act 1998.  The company sought to recover the fine from its directors and employees (the defendants) who argued in turn that the claim was barred as a matter of public policy.  The directors and employees claimed that the company was seeking an indemnity for liability resulting from an unlawful act.  While the court considered it was irrelevant to the issues to be determined, it observed that the real target of the claim was not the assets of the defendants but the D&O policy which would “presumably respond” in the event the defendants were found liable (the court did not consider the question of whether it was permitted to respond).  The court at first instance held that the company could not recover the payment of the fines from its directors and employees who were responsible for the breach, as this would be contrary to the principle of ex turpi causa.  The court considered that the purpose of these fines is to protect the public and if the fines could be passed on, the deterrent and protective purpose of the statute would be undermined.  In order for the principle to apply, some element of “moral turpitude” was required.  This seems to suggest that a purely innocent breach or wrongdoing would not attract the doctrine, and could in theory be insurable.  Although the judgment at first instance was later reversed, the issue of “moral turpitude” was not considered on appeal.  Pill LJ did consider however that the policy of the statute would be undermined if companies were able to pass on the liability to their employees or the employees’ D&O insurance, “only if the undertaking itself bears the responsibilities and meets the consequences of their non-observance are the public protected.”[4]

In Patel v Mirza[5] the English Supreme Court applied the ex turpi causa maxim.  This case involved an unjust enrichment claim relating to an agreement to place bets on share prices on the basis of inside information.  When the intended insider information did not materialise, and the betting did not take place, the claimant sought the return of £620,000.  The English Supreme Court dismissed the appeal and upheld the Court of Appeal’s decision that the money be repaid.  The Supreme Court considered whether the purpose of the prohibition which was breached would be enhanced by refusing the claim, whether there were public policy reasons to refuse the claims, and whether the refusal of the claim would be a proportionate response to the illegality.  The Court identified a number of factors which may be relevant in assessing whether it would be disproportionate to refuse relief to the claimant for public policy reasons, including “the seriousness of the conduct, its centrality to the contract, whether it was intentional and whether there was marked disparity in the parties' respective culpability”[6].  The Supreme Court held that it would “not be a just and proportionate response to the illegality” if the money was not repaid.

The Irish Supreme Court has quite recently said that the position in relation to the ex turpi causa maxim in Ireland is somewhat unclear, in the case of Quinn v IBRC[7].  In that case, the Supreme Court held that the application of the maxim would depend on the nature of the wrongdoing, and that it is not an absolute rule.

Insurability of GDPR fines?

The position on the insurability of GDPR fines remains a grey area. As the law currently stands, there is a large question mark over whether GDPR fines will be insurable in Ireland where there is any element of “moral turpitude” in the infringement.  The GDPR calls for fines to be “dissuasive”, and if all GDPR fines are indemnifiable under insurance, the public policy behind the fines could arguably be undermined.  It may be that some element of moral turpitude or wrongdoing would be required in order for the fine to be uninsurable, which could potentially result in a “sliding scale” of insurability, with criminal or quasi-criminal fines likely being uninsurable.

Given that cyber insurance is still a relatively new product on the market, there is no standard wording or extent of cover and it is important for policyholders to properly understand the scope of their cover and more importantly its limits. It is recommended that policyholders review their cyber liability cover and consider if fines and penalties are covered “to the extent insurable by law” or, indeed, if they are expressly excluded.  Cyber liability insurers will need to consider how they will respond in the event of a claim for a GDPR fine, where this wording is included in their policies, in circumstances where insurability for the ‘tier 1’, ‘tier 2’ or ‘tier 3’ fines has not yet been determined.  We expect to see another surge in interest in cyber insurance as the first large GDPR fines are imposed in the Irish market, although it may be some time until the question of insurability makes its way before an Irish court.

This article was co-authored by Commercial Litigation and Dispute Resolution partner April McClements, Commercial Litigation and Dispute Resolution senior associate Aisling Kavanagh, Corporate partner Chris Bollard and Corporate senior associate Finín O'Brien.

1. https://www.dataprotection.ie/sites/default/files/uploads/2019-03/DPC%20Annual%20Report%2025%20May%20-%2031%20December%202018.pdf