GDPR And Insurance: Who Picks Up The Tab When Things Go Wrong?

Notwithstanding assurances from the Information Commissioner that they "prefer the carrot to the stick" the fact remains that the ICO will have the power under Article 83(4) the General Data Protection Regulation ("GDPR") to levy fines of up to €10million or 2% of annual global turnover on data controllers. Alison Padfield QC, Clare Dixon and Peter Morcos consider which aspects of GDPR compliance are likely to be insurable and/or insured, focussing in particular upon: (a) the insurability (or otherwise) of fines; (b) new potential liabilities under the GDPR; and (c) the potential pitfalls of assuming that cyber insurance will cover all civil liabilities under GDPR.

Insurability of Administrative Fines

Cyber insurance commonly excludes from cover criminal or regulatory sanctions save where they are insurable in the jurisdiction where they have been awarded. This begs the question, are ICO fines insurable in this jurisdiction?

Insurance against fines imposed for criminal or quasi criminal conduct is not permitted in this jurisdiction on public policy grounds. This is because permitting such an indemnity would all but negate the fine's deterrent effect. Consequently, such insurance, if it is entered into, is unenforceable or void. This being so: what constitutes quasi criminal conduct, and could such conduct include fines imposed by the ICO?

Lord Sumption, in his majority judgment in Les Laboratoires Servier v Apotex [2015] A.C. 430, said that an act of moral turpitude could include "the infringement of statutory rules enacted for the protection of the public interest and attracting civil sanctions of a penal character", and gave the example of competition law considered by Flaux J in Safeway Stores v Twigger [2010] 2 Lloyd's Rep. 39. In that case, a penalty was imposed on a company by the Office of Fair Trading, and the company sought an indemnity from its former directors and employers. Flaux J held, in refusing to strike out the claim, that the ex turpi causa principle could apply to non criminal conduct where there was a sufficient element of moral turpitude or reprehensibility, and that the penalty imposed by the OFT could engage the rule (reversed on other grounds:[2011] 1 Lloyd's Rep. 462, CA).

The imposition of administrative fines is governed by Article 83 of the GDPR. Not every breach will attract a fine. Issues in the balance include whether the infringement was intentional or negligent, and the degree of responsibility of the...