Insurability of regulatory fines
The question whether a policy may reimburse a fine imposed on the insured by an authority, which most legal systems answer in the negative on public policy grounds, hence the cautious wording of cyber policies.
Cyber and directors' liability policies often offer to cover regulatory fines and penalties, with a decisive proviso: to the extent permitted by applicable law. The proviso is not a formality. In most legal systems, a monetary sanction imposed by a public authority has a punitive and deterrent function that transferring it to an insurer would nullify; covering it would be contrary to public policy. Criminal law excludes it everywhere, and most European lawyers extend the solution to administrative fines, such as those imposed by data protection or competition authorities. Some authorities have said so explicitly, like the UK financial conduct regulator, whose rules prohibit the firms it supervises from insuring against its own fines. Other penalties remain insurable because they are not public sanctions: contractual penalties, reimbursements demanded by card networks. For the underwriter, fines cover is therefore mainly defense cost cover before the authority, and a source of litigation over the applicable law when the insured operates in several countries.
In July 2021, the Luxembourg data protection authority fined Amazon 746 million euros under the General Data Protection Regulation. A fine of that kind cannot be transferred to an insurer under most European legal systems: only defense costs and the civil consequences of the breach fall under the policy.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.