Thinking of Expanding Your Business Overseas? Your Cyber Security Compliance Just Got More Complicated

China’s new data protection regulation, in addition to laws enacted by the U.S. and EU, all have huge implications for any business with international exposure.

By: Alex Wright | December 11, 2018

U.S. companies that do business abroad or handle overseas data will now have to comply with a host of new cyber security rules after China became the latest country to impose regulations on firms operating there.

This follows hot on the heels of the Clarifying Lawful Overseas Use of Data (CLOUD) Act, which came into force in the U.S. in March, and the European Union’s (EU) General Data Protection Regulation (GDPR), introduced two months later.

The implementation of these new protocols is driven by the recent surge in cyber attacks and, in the case of China, greater protectionism, exacerbated by the U.S. trade war, as the world becomes more divided than ever before.

Now, even if you are U.S.-based, you could be affected by a law in a country thousands of miles away. To date, 117 countries now have cyber security laws in place, not to mention each U.S. state having its own rules.

That has only led to greater ambiguity and conflict between the different regulations, increasing the burden and cost of compliance for organizations.

For many companies, these greater regulatory requirements have forced them to scale back their activity in certain countries, and in some cases, they have pulled out altogether.

“There’s a big call to action by governments to be seen to be doing something to protect their citizens, but it’s not being done in a way that’s consistent,” said Shannon Groeber, JLT Specialty’s cyber and E&O practice leader. “It’s a real challenge for companies operating on a global scale to make sure that they understand all of these new regulations and how they differ from country to country, or even state by state.

“Added to that, for many companies it seems that as soon as they have got up to speed with a new regulation, another one is introduced that they have to comply with,” she said.

The Second Great Wall of China

China’s new cyber security law, enacted in June, requires organizations operating in critical sectors such as finance, telecommunications and transport to store personal information and business data in the country, provide unspecified “technical support” to security agencies and pass national security reviews. It also stipulates that data must not be transferred overseas without government approval.

Shannon Groeber, cyber and E&O practice leader, JLT Specialty

Penalties for violations range from a company’s business activities being suspended and its website shut down to its forced closure or loss of license. The maximum fine for an offense is RMB 1 million ($150,000).

Carrie Yang, assistant vice president and team leader of Aon’s Cyber Solutions Group, said the new law significantly increases the cost of compliance for companies. It also exposes them to far greater regulatory action, she said.

“Companies will now have to adhere to much stricter rules requiring them to conduct local cyber security assessments, obtain local certification and have in place a local cyber security and compliance team,” she said. “We are also hearing anecdotal evidence that organizations have already been subject to informal regulatory inquiries under the new cyber security law.”

As recently as last month (November), Yang said that China introduced a new regulation on the Internet Security Supervision and Inspection, which gives the country’s police sweeping powers to inspect company networks onsite and remotely. It also requires firms to carry out security breach assessments, she said.

“It has huge implications for companies doing business in China, as well as increasing their exposure to third party liability,” she said. “The biggest challenge, however, will be how to protect their intellectual property and confidential information.”

Roy Hadley, cyber security attorney for Adams and Reese, said this increased scrutiny exposes companies to a greater risk of their information being misappropriated, shared with competitors or used by the Chinese government. In response, many have announced plans to separate their Chinese operations from the rest of their business by transferring data to government sponsored data centers, he said.

“The bottom line is that many global companies doing business in China are worried that under the broad wording of the new law and their compliance obligations, their trade secrets, proprietary information and data are now subject increasingly to oversight by the Chinese authorities, including possible misappropriation,” he said.

“Any international company needs to be very careful about operating in China and about how to protect this crucial information while simultaneously complying with the law.”

Kevin Richards, Marsh Risk Consulting’s global cyber risk consulting leader, said in the event of a criminal investigation, firms need to work with Chinese law enforcement and provide full access to data and unspecified “technical support” upon request. They must also store data gathered or developed in China on local servers and it must not be transferred abroad without government permission.

“Data sovereignty is a big topic for a number of countries — so that part isn’t new — but it does limit the types of service providers or cloud services firms that are available for use,” he said. “Minimally, companies will need to review their external vendor contracts to assure that they can achieve this ‘data sovereignty’ requirement.”

GDPR and the CLOUD Act

GDPR is the biggest overhaul of the EU’s data privacy policies in more than 20 years, standardizing data protection across all 28 member states and governing the control and processing of personal information. It applies to any company that accesses data from EU-based users, even if they don’t physically operate in any of the member states.

The maximum penalty for a violation is a fine of up to €20m or four percent of a company’s global annual turnover, whichever is higher.

Karen Schuler, BDO USA’s data and information governance leader, said GDPR served as a wake-up call to organizations to get their privacy policies in line with global standards. To comply, she said, some even went as far as to set up data centers in the EU.

“In certain cases, companies have decided it may be easier to comply with GDPR by opening up data centers in the EU,” she said. “Regardless, now when boards consider how their organizations can keep pace with mounting data-related challenges, their priority should be building a culture of privacy, with cyber security and regulatory compliance as critical components.”

The CLOUD Act requires U.S.-based technology companies to provide data stored on servers in any jurisdiction if requested by Federal law enforcement. Last year New York also brought in tough new cyber security rules for banks, insurers and other financial institutions.

“Companies will now have to adhere to much stricter rules requiring them to conduct local cyber security assessments, obtain local certification and have in place a local cyber security and compliance team.” — Carrie Yang, AVP and team leader, Cyber Solutions Group, Aon

But Annie O’Leary, assistant vice president of Aon’s Cyber Solutions Group, believes that the California Consumer Privacy Act, slated for 2020, will have a much bigger impact on companies.

The new law will put much greater restriction on the collection and use of personal information by companies, she said.

“Essentially it provides a number that a third-party individual can file if there’s damage due to loss of their information or any breach,” she said. “For any company operating in the state that handles citizens’ data, that’s a huge concern.”

Global Compliance

In order to comply with these new laws, companies need to ensure their cyber security policies and IT systems are up to speed, including carrying out risk assessments. They must also have the appropriate incident response and business continuity plans, as well as insurance coverage, in place.

Richards added companies need to have an ongoing and robust cyber regulatory readiness program in place that helps them understand the different jurisdictional requirements.

They must also maintain regular dialogue with their internal information security leadership and corporate counsel to keep up to date and review their cyber security policies, he said.

“A good starting point to maximize the utility of corporate cyber security policies is to map existing policies to one of the current internationally recognized security frameworks,” he said.

“The main two are the International Organization for Standardization ISO 27,000 series and the U.S. National Institute of Standards and Technology Cyber Security Framework.” &

Alex Wright is a UK-based business journalist, who previously was deputy business editor at The Royal Gazette in Bermuda. You can reach him at [email protected].

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.