What insurers need to know about online liability

Over the past year more insurance companies have launched cyber security liability insurance products. This comes after a combination of a spate of cyber-crime globally and numerous reports predicting an increase in cyber incidents, along with the increasing reliance on electronic business methods, mostly storage of information. It seems that hackers are becoming increasingly more powerful and sophisticated in their trade and that IT security cannot always keep up. Breach of cyber security is a risk that companies need to assess and deal with like any other risk, for example, burglary of their offices.

Cyber security liability products are aimed at assisting a company deal with the consequences of a loss of data from a server or even network interruptions. Products may cover any monetary liabilities, any public relations damage control necessary to mitigate brand and reputational damage, as well as the legal costs of damages claims arising from the owners of the information that was lost. Such liabilities would fall under the category of first party policies. If a company is outsourcing the storage of data to a third party it should contractually oblige the third party service provider to have adequate insurance to cover a data breach and ensure that its own cyber security liability policy covers the third party’s control of its data security.

Third party policies, on the other hand, regulate incidents such as permitting access to identifying information of customers, transmitting a computer virus or malware, failing to notify a third party of a security breach under a law or regulation, or potential advertising liability through use of electronic media, for example, unauthorised use of copyright material or defamation.

The question arises whether actions taken by a company over a social media platform are covered by the cyber security products described above.

Most cyber security policies cover first party liability only. For example, where an insured company has customer information on a server and that server is hacked and the security of the customer information has become compromised. This is the type of cover that most cyber security policies offer.

Liabilities arising from social media use would fall under third party policies where the insured has, for example, distributed copyrighted material or published a defamatory statement through electronic media. Insurance cover for these types of incidents would need to be specifically catered for and a standard cyber security policy which does not expressly state that social media is covered may not provide adequate cover.

There are few insurance companies with large portfolios of comprehensive policies already in place. We therefore cannot look to case law to see how the courts will determine what can and cannot be covered under these policies. For now, insurers would need to be specific as possible as to what their cyber security policies do and do not cover to avoid leaving that interpretation up to a court.

Insurance companies who participate in social media need to be mindful of the Policyholder Protection Rules (Rules) under both the Long-term and Short-term Insurance Acts. An insurance company’s use of social media would most likely fall under the definition of advertising in the Rules. Insurance companies are advised to ensure their social media use does not fall under the definition of direct marketing, which would require adherence to obligations such as recording and storing communications related to the direct marketing.

As the South African market becomes more accustomed to social direct marketing for insurance products may occur in a social media setting as well.