The D&O Diary was on assignment in London last week for meetings, a conference, and a reception. The itinerary allowed for some time abroad in the city, and included a weekend stopover in Paris. The main event for the London visit was the annual C5 D&O Liability conference, in which I participated as a panelist. In the picture below, I am standing with my good friends and fellow panelists, Nilam Sharma, of Nilam Sharma Limited; Stephen Reilly of Beale & Company; and Chris Warrior of Hiscox. Continue Reading A Tale of Two Cities (Illustrated Edition)
Guest Post: Fidelity Bonds and Cybercrime Policies: 2015 Year in Review
This past year was a very eventful one in the world of fidelity bond, commercial crime, and cybercrime coverages. In the following guest post, David Bergenfeld of the D’Amato & Lynch law firm’s Fidelity Bond Practice Group, and Laura Lang, Esq., take a look at the important developments during 2015 regarding these coverages. I would like to thank David and Laura for their willingness to publish their article as a guest post on this site. I welcome guest post submissions from responsible authors of topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is David and Laura’s guest post. Continue Reading Guest Post: Fidelity Bonds and Cybercrime Policies: 2015 Year in Review
Reps and Warranties Insurance: When Do You Need It – and What About the Claims?
Insurance to protect against breaches of the representations and warranties provisions of mergers and acquisitions purchase agreements is an increasingly important part of many M&A transactions. Among other things, reps and warranties insurance can help facilitate the transaction by reducing the amount of the purchase price that must be set aside to provide the buyer with indemnification protection against breaches of the representations and warranties. As detailed in a March 2, 2016 Law 360 article entitled “A Buyer’s Guide to Reps and Warranties Insurance” (here, subscription required) by Wayne Bradley and Jonathan Picard of the Dentons law firm, there are certain situations in which representations and warranties insurance may be particularly appropriate. And as detailed in a recent study from a leading insurer, claims activity suggests that a significant number of transaction do run into trouble after the deal has closed, underscoring the need for this type of insurance. Continue Reading Reps and Warranties Insurance: When Do You Need It – and What About the Claims?
Guest Post: Apple Versus The FBI: Some Common Sense Reflections from “Cool Hand Luke”
Many of us have been following the continuing battle between Apple and the U.S. government on whether the government can required the company to unlock the iPhone of the San Bernardino terrorist, Syed Rizwan Farook, with a combination of confusion and concern. In the following guest post, John Reed Stark, President of John Reed Stark Consulting and former Chief of the SEC’s Office of Internet Enforcement, sorts out the issues involved in the battle between Apple and the government, in light of all the circumstances, including the February 29, 2016 opinion by Eastern District of New York Judge James Orenstein in the separate Apple iPhone unlocking case. A version of this article originally appeared on CybersecurityDocket.com. I would like to thank John for his willingness to publish his article on this site. I welcome guest post submissions from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is John’s guest post. Continue Reading Guest Post: Apple Versus The FBI: Some Common Sense Reflections from “Cool Hand Luke”
Field Notes on Recent Corporate Suit Filing Trends
As part of our beat here at The D&O Diary
, we regularly monitor new lawsuit filings and try to identify trends and patterns. Over the years, we have noted and commented on this blog about many of the trends and patterns we have identified. More than once we have noted the incidence of director and officer liability litigation arising out of environmental issues. We have also noted that D&O litigation often follows after the announcement of FCPA investigations. As discussed below, there has been a flurry of recent filings involving environmental issues. I have also noted below an interesting variant on the FCPA follow-on civil lawsuit pattern. Continue Reading Field Notes on Recent Corporate Suit Filing Trends
Guest Post: Year in Review: Securities Litigation
This past year was an eventful one in the corporate and securities litigation arena, with the U.S. Supreme Court’s decision in the Omnicare case, important rulings in the lower courts applying the Supreme Court’s Halliburton II decision, and a host of other important decision on critical securities law issues. In the following memorandum from the Haynes and Boone law firm, attorneys from the firm’s Securities and Shareholder Litigation group take a look at the important securities litigation developments during 2015. I would like to thank the firm and the group for their willingness to publish their memorandum on this site. I welcome guest post submissions from responsible authors on topics of interest to readers of this site. Please contact me directly if you are interested in submitting a guest post. Here is the Haynes and Boone firm’s memorandum.
*********************************************
Each year our Year in Review comments on significant securities-related decisions by the Supreme Court, federal appellate courts and district courts, notes key developments in SEC enforcement, and summarizes significant rulings in state law fiduciary litigation against directors and officers of public companies. Continue Reading Guest Post: Year in Review: Securities Litigation
A Closer Look at Buffett’s Annual Letter to Berkshire Shareholders
A highly anticipated event in the financial world each year is the release of legendary investor and Berkshire Hathaway Chairman Warren Buffett’s annual letter to the company’s shareholders. Market watchers and other observers value Buffett’s annual letter for its valuable insights about the financial marketplace, as well as for Buffett’s homespun humor and his wise insights about the economy and the world. In this year’s letter (here), which the company released on Saturday morning, Buffett had quite a bit to say about the current prospects of the American economy. Many of Buffett’s remarks about the U.S. economy were expressly intended to counter the relentlessly negative tone of the current U.S. Presidential election campaign. The letter also contains an interesting commentary about both the beneficial and disruptive effects resulting from gains in productivity; the commentary includes a cautionary note about the need to assist those disadvantaged by the rapid changes that often accompany technical innovations. The letter also contains a rather sobering assessment of the risks the world currently faces. (Full disclosure: I own BRK.B shares, though not nearly as many as I wish I did.) Continue Reading A Closer Look at Buffett’s Annual Letter to Berkshire Shareholders
Securities Suit Frequency Means Challenging D&O Insurance Market for Life Sciences Companies
In 2015, as was the case for several years prior, companies in the life sciences sector experienced a disproportionately greater number of securities class action lawsuits than companies in other industries. As I detailed in my analysis of 2015 securities class action lawsuit filings (here), 39 of the 191 securities class action lawsuits filed in 2015 involved companies in the life sciences sector, representing about one in five of all securities suit filings during the year. No other sector experienced anywhere near this number of securities class action lawsuit flings. For example, the sector with the second-most number of filings, software companies, had eleven filings during 2015, representing about 6% of securities suit filings during the year.
There are a number of reasons why there are more securities suit filings involving life sciences companies, as discussed below. The frequency and severity of lawsuits against companies in the life sciences sector have important D&O Insurance implications as well, as also discussed below. Continue Reading Securities Suit Frequency Means Challenging D&O Insurance Market for Life Sciences Companies
U.S. Banking Sector at Healthy Levels, But Do Problems Loom?
In the FDIC’s latest quarterly banking profile, the agency report overall reflects a generally healthy U.S. banking sector. However, problems may loom on the horizon at least for some banks. In addition, the statistics reflect significant changes that have changed the face of the industry just in the past few years. The FDIC’s Quarterly Banking Profile for the Fourth Quarter 2015 can be found here, and the agency’s February 23, 2016 press release about the report can be found here. Continue Reading U.S. Banking Sector at Healthy Levels, But Do Problems Loom?
Guest Post: The Need for Cyber Liability Insurance – Indian Perspective
Threats to data security and privacy are among the most important emerging exposures companies face. But it is not just companies in the United States that face these threats – these threats confront companies around the world. The purchase of insurance designed to deal with the liability exposures arising from these risks is an important way that companies around the world can confront these risk exposures. In the following guest post, Rohan Negandhi of Tata AIG General Insurance Company Limited takes a look at both the emerging cyber liability environment in India and the developing cyber liability insurance market in that country.
I would like to thank Rohan for his willingness to publish his article on this site. I welcome guest post submissions from responsible authors on topics of interest to readers of this blog. Please contact me directly if you would like to submit a guest post. Here is Rohan’s article.
**************************************************************
Background :
It is a well known fact that with the advent of the Companies Act, 2013 the demand for Directors and Officers insurance in India saw an upsurge. The new Act for the first time introduced the concept of class action suits in India and also codified the duties owed by directors to companies and listed the applicable fines for breaches of such duty which could give rise to civil liability as well as fines and penalties. In another first, the Act also gave statutory recognition to Directors and Officers insurance.
But if the 2013 Act had such an impact on Indian body corporates, leading to an increase in demand for D&O insurance, why did the Information Technology Act, 2000 [amended in 2008] not have the same impact on the demand for Cyber Liability Insurance?
The only answer that seems plausible is that the body corporates do not feel immediately exposed to such risk.
I believe, both, the stock market and the insurance market, are driven by emotions. If the stock market oscillates between greed and fear, then the insurance market oscillates between comfort and fear. It is only when the media is flush with news of class action suits, a new law or amendment, or any other trigger events which cause fear or a sense of vulnerability, does the transition from a soft to a hard market begin. Premiums begin to rise, with the rise in claims, again displaying why the insurance industry moves cyclically, like the other commodities. Which is why like the principle advocated by value investors, of buying stocks when they are out of favour, can be applied to buying insurance – buy even when you think you don’t need it.
Legal Provisions:
Coming back to the Information Technology Act, 2000 [Amended in 2008], several provisions were laid down which make body corporates responsible for data breaches, in both cases – i.e. when holding the information directly on behalf of customers or in case when acting as an intermediary.
The relevant provision which expose the body corporates for such data breaches are as mentioned hereunder:
“S 43 A – Compensation for failure to protect data (Inserted vide ITAA 2006)
Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees[1], to the person so affected. (Change vide ITAA 2008) Explanation: For the purposes of this section (i) “body corporate” means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities (ii) “reasonable security practices and procedures” means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit. (iii) “sensitive personal data or information” means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.
Liability of Intermediaries:
Before the amendment, an intermediary was defined under the Act, as any person, who on behalf of another person, receives, stores or transmits that message or provides any service with respect to that message. However, with the Information Technology Amendment Act, the definition of “Intermediary” is laid down by specifically including the telecom services providers, network providers, internet service providers, web-hosting service providers in the definition. Also included under the definition are search engines, online payment sites, online-auction sites, online market places and cyber cafés
Under the old Act, intermediaries were exempted only if they were able to prove that they possessed no knowledge of the infringement or that they had exercised all due diligence to prevent such infringement. Therefore, this approach made websites liable in cases where constructive knowledge was proved or the website lacked sufficient measures to prevent such infringement.
The Amendment act acknowledged the fact that it is virtually impossible for any website, having significant traffic, to monitor its all its content, which too would require the company to incur certain cost and hence, under the Information Technology Amendment Act, 2008, Section 79 has been modified to the effect that an intermediary shall not be liable for any third party information data or communication link made available or hosted by him.
This exemption is subject to the following conditions:
- the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hosted;
- the intermediary does not initiate the transmission or select the receiver of thev transmission and select or modify the information contained in the transmission;
- the intermediary observes due diligence while discharging his duties.
The direct consequence of this provision would be that social networking sites, would be immune from liability as long as they satisfy the conditions provided under the section.
Similarly, Internet Service Providers (ISP), blogging sites, etc. would also be exempt from liability. However, an intermediary would lose the immunity, if the intermediary has conspired or abetted or aided or induced whether by threats or promise or otherwise in the commission of the unlawful act.
Sections 79 also introduced the concept of “notice and take down” provision which is common in many foreign jurisdictions. It provides that an intermediary would lose its immunity if upon receiving actual knowledge or on being notified that any information, data or communication link residing in or connected to a computer resource controlled by it is being used to commit an unlawful act and it fails to expeditiously remove or disable access to that material.
This is one provision under which liability for the intermediary could arise. Several recent data breach cases in India display lack of maturity in terms of Cyber Security on the part of corporates. Even if the intermediary is not held liable as it has not abetted in the act, they may still be held liable if they, upon receiving actual knowledge or on being notified of such unlawful act, fail to remove or disable access to the same. For larger organizations which have forensic experts on their payroll, this may be possible, but for start-ups or other SMEs, the risk is comparatively high, as they are not well equipped to swiftly act in such circumstances.
Apart from that, the costs which would be incurred in monitoring the breach once it has occurred would be considerably high for the company to pay from its own pocket. In India, notification in case of a breach is not mandated under any law as of now, but it would be advisable as good governance practice to have a process in place so as to avoid derivative D&O claims resulting from the same.
Possible Triggers:
Recently India has been witness to several cases of cyber breach. In one recent case, when the managing director of a popular ice cream manufacturing company in Hyderabad turned on his computer to access his company’s database, was startled to read – “Pay $1,000 to get your data back and do the payment in Bitcoins.”[2]
Another recent data breach was that of an Indian cyber security firm Cyberoam, which confirmed a cyber attack on its systems, resulting in possible leakage of its database that contained personal details of its customers and partners.[3]
According to the latest KPMG Cybercrime survey report nearly 72% of Indian companies faced cyberattack in 2015. More than 250 respondents from the likes of CIOs, CISOs, CAEs, CROs, COOs and related professionals from across India participated in the survey. [4]
The KPMG in India Cybercrime Survey Report states that 94% respondents indicated that cybercrime is a major threat faced by organisations, but surprisingly only 41% indicated that it forms part of the board agenda.
74% respondents believe that the BFSI sector is a top target for cybercrime with 63% indicating these crimes more often than not amount to gross financial loss. Another important revelation was that 54% of the respondents indicated that spend on cyber defences is less than 5% of IT spend with only 2% organisations spent more than 20% of their IT budget on information security and cyber defences.
A similar report by PwC revealed that incidents of cybersecurity breach in India, during the period under consideration (July 2014—June 2015) surged by a record 117 per cent as compared to an increase of just 39 per cent globally.[5]
According to the 2014 Cost of Data Breach Study by IBM that was done in association with Ponemon Institute, India is one of the countries/regions that have the highest number of average data breaches, but its cost per capita is low. This study was conducted using qualitative questionnaires in 314 major companies across 10 countries.[6]
Why should a company buy Cyber Insurance?:
Considering the above scenario, a Cyber Insurance policy not only acts as an insurance against data breach, but also helps in mitigation of such risk because the policy offered by some leading insurers come with certain value added services such as a risk assessment call with forensic experts, an analytics report and a shunning device to block unwanted IPs. These services make Cyber Insurance a wholesome product, which may appeal to a lot of corporates, especially the e-commerce players in the country, whose revenue and reputation is solely dependent on their online presence, which needs to be closely protected.
Future Outlook:
It can be reasonably concluded from the findings of the reports cited above, that the Indian Insurance market is poised to see a significant increase in demand for Cyber Insurance if the trend continues. Currently, the total number of Cyber Insurance policies issued in India are still around 100-150, premiums are high, and claims are rare and few. But if the reports are to be relied upon, it can be said that most of the companies which face a breach either do not come out in the public and admit it, or worse, are not aware of the same. In either situation, there is a lot at risk. With the governments vision of 100 Smart Cities and the push to make India more Technologically advanced, the members of the insurance fraternity should keep their eyes and ears open and as Confucious said – “May you live in interesting times.”
______________________________
[1] USD 735,000 approx.
[2] http://timesofindia.indiatimes.com/tech/tech-news/Cyber-extortion-New-crime-on-the-block/articleshow/49038656.cms
[3] http://www.thehindubusinessline.com/info-tech/security-firm-cyberoam-turns-victim-in-cyber-attack/article8054964.ece
[4] https://www.kpmg.com/IN/en/IssuesAndInsights/ArticlesPublications/Documents/Cyber-Crime-Survey-2015-30Nov15.pdf
[5] http://www.newindianexpress.com/business/news/Incidents-of-Cybersecurity-Breach-Shoot-up-117-Percent-in-India-PwC/2015/10/14/article3079825.ece
The author of the article is a Bachelor of Business Administration and a Bachelor of Law from Symbiosis International University. The author also holds a Diploma in Cyber Laws from The Asian School of Cyber Laws.
Currently the author is working with Tata AIG General Insurance Company Limited, which is an Indian General insurance Company, and a joint venture between the Tata Group and American International Group (AIG)., as a Financial Lines – Underwriter.
The views expressed in this article are solely of the author and are not representative of the organisation where he currently works.