Cyber Legislation Update: As We Wait for the Strengthening American Cybersecurity Act to Pass, Here’s Where States Stand

Cyber risk continues to be a top concern for businesses, but new legislation to mitigate the risk is on the rise.

By: Alex Wright | May 26, 2022

As cyber risks increase in their frequency, severity and complexity, regulations governing how businesses and their risk managers deal with the problem are emerging in force.

Across the board, at global, federal and state levels, a host of new regulations — whether data breach notification or data privacy laws and statutes — have been brought forward in recent months, with more pending.

At the same time, regulators have been tightening up existing laws and clamping down more heavily on offenders when personal data is compromised, coming down squarely on the side of the consumer.

As a result, companies of all sizes are facing an unprecedented level of regulatory risk as they try to shore up their cybersecurity and protect their customers’ data in the face of increasingly sustained and sophisticated cyberattacks by hackers.

This is a particular problem for firms that operate internationally and/or across multiple states, as well as smaller companies without the budget and resources needed to comply with these constantly evolving regulations.

“Every business will always have to face changing rules and regulations to security and privacy, whether specific industry trade sector bodies or countries they operate in, just as different cyber threat actors continuously seek to find new ways to impact an organization,” said Scott Sayce, global head of cyber for Allianz Global Corporate and Specialty.

Tighter Regulations

Among the most significant new pieces of legislation at the federal level is the Strengthening American Cybersecurity Act passed this year by the Senate and awaiting President Biden’s sign-off.

Mary Hildebrand, partner, Lowenstein Sandler

The new law will require institutions deemed to be part of the U.S.’s critical infrastructure to report all data breaches and ransomware payments to the Department of Homeland Security within 72 hours of an incident’s discovery and 24 hours of the payment, respectively.

“This is highly significant because it’s the first time a single privacy statute has been brought in at the federal level seeking to encompass multiple different areas of industry,” said Andrew Lipton, vice president and head of cyber claims at AmTrust Financial Services. “This extends to financial services such as banks and insurance companies as well as key infrastructure players like utility companies and cloud service providers.”

Then there are the proposed amendments to the Securities and Exchange Commission’s rules on disclosures in terms of cybersecurity risk management, strategy, governance and incident reporting by public companies, also put forward this year.

This follows new data security rules introduced in October 2021 governing financial institutions regulated by the Federal Trade Commission (FTC), as well as a final rule issued by U.S. Banking Regulators in November 2021, requiring banks to report any material cybersecurity incident no later than 36 hours after determining it had occurred.

The FTC also issued guidance in January advising that any company failing to take into account a well-known vulnerability such as the widely-used logging tool Log4j would be deemed to be violating their terms and privacy policies.

It has served as a clear warning that the FTC is prepared to exercise its rights and pursue offenders.

Increasing Agency Power

At the state level, California has led the way on data privacy with the California Privacy Rights Act (CPRA), which comes into force on January 1, 2023. The CPRA builds on the California Consumer Privacy Act, which was signed into law in June 2018, with the establishment of the California Privacy Protection Agency with its own regulatory investigative and enforcement powers.

“Increasingly, federal agencies such as the SEC and FTC are taking a more active role in cybersecurity enforcement,” said Mary Hildebrand, partner at Lowenstein Sandler.

“That’s now being extended to individual states, such as California setting up its own dedicated enforcement agency.”

Nevada amended its privacy law in June 2021 to include its own modified version of the CCPA’s “Do Not Sell My Personal Information” requirement. This obliges businesses to have a clear and conspicuous webpage enabling consumers to opt-out of having their data sold to third parties.

Other bills are set to follow suit, with the Virginia Consumer Data Protection Act being passed on January 1, 2023 and the Colorado Privacy Act on July 1, 2023. Utah is also awaiting the governor’s signature on its new law, set for December 31, 2023.

The General Data Protection Regulation, introduced in May 2018, remains the most significant data protection law in Europe and UK, with several cases having already been brought against companies in recent months. Then there’s the EU-U.S. Data Transfer Pact, which has been agreed to in principle, enabling entities to transfer data between the two regions.

Brazil also enacted its own General Personal Data Protection Law in September 2020, which restricts data transfer, while China did likewise with its Personal Information Protection Law in November 2021, intended to manage data flow out of the country.

However, the introduction of India’s new data protection law has been delayed by the COVID-19 pandemic.

“One thing is for certain, strengthening cybersecurity practices and consumer rights to privacy and control over their personal data are here to stay,” said Gamelah Palagonia, executive vice president, cyber development and regulatory leader at Willis Towers Watson. “Since the enactment of the EU’s GDPR, other countries have brought in their own regulations and more are expected to follow in their footsteps.”

Rule of One for Many

To come to grips with the new regulations, senior management needs to work with its general counsel and legal team to map out and understand all the different laws and how they will affect their business.

Given that much of the legislation is broadly similar, particularly at the state level, if they follow one law, they can then expand upon that to comply with the regulations in other jurisdictions.

“A possible path is to build your approach to the most restrictive standard so that you are compliant across all the jurisdictions in which your business operates; it makes administration a lot easier because if you’re compliant to the highest standard, then you clearly meet all the lower thresholds,” said Mehvish Femia, chief legal officer at Resilience.

“It also makes your operations run smoother, because there’s only one process to follow, rather than 50 — and when you have changes, you’re only changing one regime.”

Many regulators will also require firms to have a robust incident response and recovery plan that can be rapidly deployed in the event of an incident and is regularly tested. Risk managers also need to keep on top of changes in data privacy law and how data is being used.

“Risk managers must stay informed on any changes in the collection, use, transfer and retention of personal information,” said Elizabeth Shirley, co-chair of the cybersecurity and data privacy team at Burr & Forman.

“They should know what personal information is collected, where it is stored, what is the purpose of collecting it, who has access to it, how long it is retained and is any unnecessary personal information collected.”

It’s also key to carry out due diligence on third-party vendors and service providers to make sure that they comply with these new regulations. Similarly, employees need to be regularly trained on the latest cybersecurity practices, given that they are one of the biggest causes of data breaches.

Companies also need to ensure they have cyber insurance in place to provide defense against regulatory actions and associated fines and penalties following a data breach, where they are insurable by law. They must also understand the coverage terms to avoid potential claim denials. &

Alex Wright is a UK-based business journalist, who previously was deputy business editor at The Royal Gazette in Bermuda. You can reach him at [email protected].

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.