HBIIThis past year was an eventful one in the corporate and securities litigation arena, with the U.S. Supreme Court’s decision in the Omnicare case, important rulings in the lower courts applying the Supreme Court’s Halliburton II decision, and a host of other important decision on critical securities law issues. In the following memorandum from the Haynes and Boone law firm, attorneys from the firm’s Securities and Shareholder Litigation group take a look at the important securities litigation developments during 2015. I would like to thank the firm and the group for their willingness to publish their memorandum on this site. I welcome guest post submissions from responsible authors on topics of interest to readers of this site. Please contact me directly if you are interested in submitting a guest post. Here is the Haynes and Boone firm’s memorandum.

 

*********************************************

 

Each year our Year in Review comments on significant securities-related decisions by the Supreme Court, federal appellate courts and district courts, notes key developments in SEC enforcement, and summarizes significant rulings in state law fiduciary litigation against directors and officers of public companies. Continue Reading Guest Post: Year in Review: Securities Litigation

buffA highly anticipated event in the financial world each year is the release of legendary investor and Berkshire Hathaway Chairman Warren Buffett’s annual letter to the company’s shareholders. Market watchers and other observers value Buffett’s annual letter for its valuable insights about the financial marketplace, as well as for Buffett’s homespun humor and his wise insights about the economy and the world. In this year’s letter (here), which the company released on Saturday morning, Buffett had quite a bit to say about the current prospects of the American economy. Many of Buffett’s remarks about the U.S. economy were expressly intended to counter the relentlessly negative tone of the current U.S. Presidential election campaign. The letter also contains an interesting commentary about both the beneficial and disruptive effects resulting from gains in productivity; the commentary includes a cautionary note about the need to assist those disadvantaged by the rapid changes that often accompany technical innovations. The letter also contains a rather sobering assessment of the risks the world currently faces. (Full disclosure: I own BRK.B shares, though not nearly as many as I wish I did.) Continue Reading A Closer Look at Buffett’s Annual Letter to Berkshire Shareholders

lifesciencesIn 2015, as was the case for several years prior, companies in the life sciences sector experienced a disproportionately greater number of securities class action lawsuits than companies in other industries. As I detailed in my analysis of 2015 securities class action lawsuit filings (here), 39 of the 191 securities class action lawsuits filed in 2015 involved companies in the life sciences sector, representing about one in five of all securities suit filings during the year. No other sector experienced anywhere near this number of securities class action lawsuit flings. For example, the sector with the second-most number of filings, software companies, had eleven filings during 2015, representing about 6% of securities suit filings during the year.

 

There are a number of reasons why there are more securities suit filings involving life sciences companies, as discussed below. The frequency and severity of lawsuits against companies in the life sciences sector have important D&O Insurance implications as well, as also discussed below. Continue Reading Securities Suit Frequency Means Challenging D&O Insurance Market for Life Sciences Companies

fdic sealIn the FDIC’s latest quarterly banking profile, the agency report overall reflects a generally healthy U.S.  banking sector. However, problems may loom on the horizon at least for some banks. In addition, the statistics reflect significant changes that have changed the face of the industry just in the past few years. The FDIC’s Quarterly Banking Profile for the Fourth Quarter 2015 can be found here, and the agency’s February 23, 2016 press release about the report can be found here. Continue Reading U.S. Banking Sector at Healthy Levels, But Do Problems Loom?

Rohan
Rohan Negandhi

Threats to data security and privacy are among the most important emerging exposures companies face. But it is not just companies in the United States that face these threats – these threats confront companies around the world. The purchase of insurance designed to deal with the liability exposures arising from these risks is an important way that companies around the world can confront these risk exposures. In the following guest post, Rohan Negandhi of Tata AIG General Insurance Company Limited takes a look at both the emerging cyber liability environment in India and the developing cyber liability insurance market in that country.

 

I would like to thank Rohan for his willingness to publish his article on this site. I welcome guest post submissions from responsible authors on topics of interest to readers of this blog. Please contact me directly if you would like to submit a guest post. Here is Rohan’s article.

 

************************************************************** 

 

Background :

It is a well known fact that with the advent of the Companies Act, 2013 the demand for Directors and Officers insurance in India saw an upsurge. The new Act for the first time introduced the concept of class action suits in India and also codified the duties owed by directors to companies and listed the applicable fines for breaches of such duty which could give rise to civil liability as well as fines and penalties. In another first, the Act also gave statutory recognition to Directors and Officers insurance.

But if the 2013 Act had such an impact on Indian body corporates, leading to an increase in demand for D&O insurance, why did the Information Technology Act, 2000 [amended in 2008] not have the same impact on the demand for Cyber Liability Insurance?

The only answer that seems plausible is that the body corporates do not feel immediately exposed to such risk.

I believe, both, the stock market and the insurance market, are driven by emotions. If the stock market oscillates between greed and fear, then the insurance market oscillates between comfort and fear. It is only when the media is flush with news of class action suits, a new law or amendment, or any other trigger events which cause fear or a sense of vulnerability, does the transition from a soft to a hard market begin. Premiums begin to rise, with the rise in claims, again displaying why the insurance industry moves cyclically, like the other commodities. Which is why like the principle advocated by value investors, of buying stocks when they are out of favour, can be applied to buying insurance – buy even when you think you don’t need it.

Legal Provisions:

Coming back to the Information Technology Act, 2000 [Amended in 2008], several provisions were laid down which make body corporates responsible for data breaches, in both cases – i.e. when holding the information directly on behalf of customers or in case when acting as an intermediary.

The relevant provision which expose the body corporates for such data breaches are as mentioned hereunder:

“S 43 A – Compensation for failure to protect data (Inserted vide ITAA 2006)

 Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees[1], to the person so affected. (Change vide ITAA 2008) Explanation: For the purposes of this section (i) “body corporate” means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities (ii) “reasonable security practices and procedures” means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit. (iii) “sensitive personal data or information” means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.

Liability of Intermediaries:

Before the amendment, an intermediary was defined under the Act, as any person, who on behalf of another person, receives, stores or transmits that message or provides any service with respect to that message. However, with the Information Technology Amendment Act, the definition of  “Intermediary” is laid down by specifically including the telecom services providers, network providers, internet service providers, web-hosting service providers in the definition. Also included under the definition are search engines, online payment sites, online-auction sites, online market places and cyber cafés

Under the old Act, intermediaries were exempted only if they were able to prove that they possessed no knowledge of the infringement or that they had exercised all due diligence to prevent such infringement. Therefore, this approach made websites liable in cases where constructive knowledge was proved or the website lacked sufficient measures to prevent such infringement.

The Amendment act acknowledged the fact that it is virtually impossible for any website, having significant traffic, to monitor its all its content, which too would require the company to incur certain cost and hence, under the Information Technology Amendment Act, 2008, Section 79 has been modified to the effect that an intermediary shall not be liable for any third party information data or communication link made available or hosted by him.

This exemption is subject to the following conditions:

  • the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hosted;
  • the intermediary does not initiate the transmission or select the receiver of thev transmission and select or modify the information contained in the transmission;
  • the intermediary observes due diligence while discharging his duties.

The direct consequence of this provision would be that social networking sites, would be immune from liability as long as they satisfy the conditions provided under the section.

Similarly, Internet Service Providers (ISP), blogging sites, etc. would also be exempt from liability. However, an intermediary would lose the immunity, if the intermediary has conspired or abetted or aided or induced whether by threats or promise or otherwise in the commission of the unlawful act.

Sections 79 also introduced the concept of “notice and take down” provision which is common in many foreign jurisdictions. It provides that an intermediary would lose its immunity if upon receiving actual knowledge or on being notified that any information, data or communication link residing in or connected to a computer resource controlled by it is being used to commit an unlawful act and it fails to expeditiously remove or disable access to that material.

This is one provision under which liability for the intermediary could arise. Several recent data breach cases in India display lack of maturity in terms of Cyber Security on the part of corporates. Even if the intermediary is not held liable as it has not abetted in the act, they may still be held liable if they, upon receiving actual knowledge or on being notified of such unlawful act, fail to remove or disable access to the same. For larger organizations which have forensic experts on their payroll, this may be possible, but for start-ups or other SMEs, the risk is comparatively high, as they are not well equipped to swiftly act in such circumstances.

Apart from that, the costs which would be incurred in monitoring the breach once it has occurred would be considerably high for the company to pay from its own pocket. In India, notification in case of a breach is not mandated under any law as of now, but it would be advisable as good governance practice to have a process in place so as to avoid derivative D&O claims resulting from the same.

Possible Triggers:

Recently India has been witness to several cases of cyber breach. In one recent case, when the managing director of a popular ice cream manufacturing company in Hyderabad turned on his computer to access his company’s database, was startled to read – “Pay $1,000 to get your data back and do the payment in Bitcoins.”[2]

Another recent data breach was that of an Indian cyber security firm Cyberoam, which confirmed a cyber attack on its systems, resulting in possible leakage of its database that contained personal details of its customers and partners.[3]

According to the latest KPMG Cybercrime survey report nearly 72% of Indian companies faced cyberattack in 2015. More than 250 respondents from the likes of CIOs, CISOs, CAEs, CROs, COOs and related professionals from across India participated in the survey. [4]

The KPMG in India Cybercrime Survey Report states that 94% respondents indicated that cybercrime is a major threat faced by organisations, but surprisingly only 41% indicated that it forms part of the board agenda.

74% respondents believe that the BFSI sector is a top target for cybercrime with 63% indicating these crimes more often than not amount to gross financial loss. Another important revelation was that 54% of the respondents indicated that spend on cyber defences is less than 5% of IT spend with only 2% organisations spent more than 20% of their IT budget on information security and cyber defences.

A similar report by PwC revealed that incidents of cybersecurity breach in India, during the period under consideration (July 2014—June 2015) surged by a record 117 per cent as compared to an increase of just 39 per cent globally.[5]

According to the 2014 Cost of Data Breach Study by IBM that was done in association with Ponemon Institute, India is one of the countries/regions that have the highest number of average data breaches, but its cost per capita is low. This study was conducted using qualitative questionnaires in 314 major companies across 10 countries.[6]

Why should a company buy Cyber Insurance?:

Considering the above scenario, a Cyber Insurance policy not only acts as an insurance against data breach, but also helps in mitigation of such risk because the policy offered by some leading insurers come with certain value added services such as a risk assessment call with forensic experts, an analytics report and a shunning device to block unwanted IPs. These services make Cyber Insurance a wholesome product, which may appeal to a lot of corporates, especially the e-commerce players in the country, whose revenue and reputation is solely dependent on their online presence, which needs to be closely protected.

Future Outlook:

It can be reasonably concluded from the findings of the reports cited above, that the Indian Insurance market is poised to see a significant increase in demand for Cyber Insurance if the trend continues. Currently, the total number of Cyber Insurance policies issued in India are still around 100-150, premiums are high, and claims are rare and few. But if the reports are to be relied upon, it can be said that most of the companies which face a breach either do not come out in the public and admit it, or worse, are not aware of the same. In either situation, there is a lot at risk. With the governments vision of 100 Smart Cities and the push to make India more Technologically advanced, the members of the insurance fraternity should keep their eyes and ears open and as Confucious said – “May you live in interesting times.”

______________________________

[1] USD 735,000 approx.

[2] http://timesofindia.indiatimes.com/tech/tech-news/Cyber-extortion-New-crime-on-the-block/articleshow/49038656.cms

[3] http://www.thehindubusinessline.com/info-tech/security-firm-cyberoam-turns-victim-in-cyber-attack/article8054964.ece

[4] https://www.kpmg.com/IN/en/IssuesAndInsights/ArticlesPublications/Documents/Cyber-Crime-Survey-2015-30Nov15.pdf

[5] http://www.newindianexpress.com/business/news/Incidents-of-Cybersecurity-Breach-Shoot-up-117-Percent-in-India-PwC/2015/10/14/article3079825.ece

 

 

 

 

The author of the article is a Bachelor of Business Administration and a Bachelor of Law from Symbiosis International University. The author also holds a Diploma in Cyber Laws from The Asian School of Cyber Laws.

Currently the author is working with Tata AIG General Insurance Company Limited, which is an Indian General insurance Company, and a joint venture between the Tata Group and American International Group (AIG)., as a Financial Lines – Underwriter.

The views expressed in this article are solely of the author and are not representative of the organisation where he currently works.

 

 

dissentAfter Justice Antonin Scalia’s recent death, one aspect of the deceased Justice’s long record on the Supreme Court that occasioned significant commentary was the extent to which he often dissented from the Court’s majority, sometimes employing sharp and even provocative language. While Scalia was a more frequent dissenter than many of his fellow justices, at least during the time he served on the Court, there was nothing particularly unusual about the fact that he was dissenting (or, for that matter, that he dissented so frequently). Dissenting opinions have been a part of the Court’s activities for many decades now; however, it was not always so. In the country’s earliest days, dissents were rare, becoming frequent only late in the 19th century, and becoming common only early in the 20th century. As well-documented in Melvin I. Urofky’s interesting and well-written book, Dissent and the Supreme Court (here), dissenting opinions at the U.S. Supreme Court have come to play an important role in our constitutional dialogue. Indeed, as Urshofsky argues, the leading dissents have played an important role in how the country thinks of itself. Continue Reading Book Review: “Dissent and the Supreme Court”

dandowhattoknowAfter attending the PLUS D&O Symposium  some years ago, several colleagues at Partner Re thought it might be worthwhile to provide D&O insurance professionals with historical overview of the evolution of Directors and Officers insurance (D&O) in the US marketplace.   As a result, Brian Sabia, SVP Senior Underwriter Specialty lines; Catherine Rudow, SVP Senior Underwriter Specialty Lines; and Nicholas DeMartini, AVP Senior Underwriter Specialty Lines, all of Partner Reinsurance Company, drafted the following article, which starts with the Securities Act of 1933 and progresses through the relevant Acts, key court rulings, and the ups and downs that have driven the D&O insurance market and the evolving features of the D&O insurance policy. Their complete paper can be found here.

 

I would like to thank Brian, Catherine and Nicholas for their willingness to publish their article on this site. I welcome guest post submissions from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is the authors’ guest post.

 

************************************************************************

 

This paper provides an historical overview of the evolution of Directors and Officers insurance (D&O) in the U.S. market since 1933, taking you through the relevant acts, key court rulings, ups and downs of the market, as well as the evolving coverage features of D&O insurance. This paper is intended for the insurance professional as an additional introduction to this increasingly relevant and ever evolving management liability product.  Continue Reading Guest Post: D&O What to Know: A Guide to the Evolution of Directors and Officers Insurance from 1933 to the Present

questionsBank directors often have many questions about their D&O insurance coverage, and rightly so. If significant reversals at the bank result in liability claims against the company’s senior officials, the bank’s D&O insurance could be the directors’ last line of defense. In this post, I address two issues that bank directors often ask about: first, does the bank’s D&O insurance cover civil money penalties? And, second, as the credit crisis retreats further into the past, when is the D&O insurance marketplace for banks going to “return to normal”? Continue Reading Answering Bank Directors’ D&O Insurance Questions

sdnyRegular readers of this blog know that the filing of a shareholder lawsuit following the disclosure of a bribery investigation is a well-established phenomenon (as discussed, for example, here). Readers will also recall that in March 2015 when the U.S. Supreme Court issued its Omnicare decision (about which refer here), there was significant discussion whether the Court’s ruling that omitted facts could make a statement of opinion misleading and support liability under the securities laws could prove helpful to plaintiffs and even lead to more securities lawsuits premised on alleged omissions.

 

The trend lines for both of these issues came together in a recent dismissal motion ruling in the Southern District of New York in the securities class action lawsuit involving Och-Ziff Capital Management Group. In a February 17, 2016 opinion (here), Southern District of New York Judge J. Paul Oetken ruled that the defendants’ alleged failure to disclosure alleged but uncharged violations of the FCPA and sanctions laws was not actionable. However, he also held that the defendants’ failure to disclose the existence of the DoJ and SEC investigations was actionable, in light of the statements the company did make about its exposure to regulatory investigations. As discussed below, the Court’s conclusion that these alleged omissions were actionable was made with express reference to and reliance on the Supreme Court’s Omnicare decision. Continue Reading Omissions Regarding Bribery Investigation Held Actionable

vw2Several years ago, when investors’ representatives used class claims settlement procedures available under Netherlands law to reach securities claim settlements involving Royal Dutch Shell (about which refer here) and Converium (about which refer here), there was a great deal of speculation whether the Dutch procedures could become an important vehicle for aggrieved investors to recover damages for alleged securities law violations.

 

This speculation was particularly magnified after the Amsterdam Court of Appeal, in connection with the Converium settlement, held that the Dutch settlement procedures could be used to resolve securities claims of non-Dutch investors against a non-Dutch company, in the form of judgment that is enforceable throughout the EU and among other European countries. Though many of these kinds of investor settlements were anticipated, the onslaught of securities settlements using the Dutch procedures never really did materialize.

 

However, a new initiative being organized in The Netherlands on behalf of Volkswagen securities holders whose investment interests were harmed as a result of the automobile company’s emissions-related scandal may represent the most significant effort since the Converium case to try to use the Netherlands procedures on behalf of an aggrieved class of investors. This initiative on behalf of Volkswagen’s securityholders has a number of interesting features. It also raises a number of potentially complicated questions about jurisdiction, priority, potential preemption, and international comity. Continue Reading Dutch Shareholder Foundation Seeks to Represent Global Class of VW Investors