Goodbye Passwords and Hello Retinal Scans: How Believers in Biometrics Are Making Their Data Protection Case

By: Kelly Geary | May 29, 2020

Kelly Geary is a Managing Principal with EPIC Insurance Brokers and Consultants based in the New York City area. She serves as the National Practice Leader – Executive and Cyber Risk as well as Coverage Counsel & Claims Leader for Lemme, a division EPIC.

The global pandemic has pushed us all outside our comfort zone as individuals and as organizations. A crisis of this magnitude forces us to adapt, grow and, ultimately, transform. There is no question that our post-COVID-19 world will look very different.

Biometric technology will likely play a role in our transformation, in our new normal. The use of biometric technology is not new, but it is receiving more attention today due to our abrupt need to conduct business remotely and with as little physical touch as possible.

Technological advances in biometrics, coupled with our new aversion to close physical contact, could very well mean the end of the PINs and passwords and a wider (and perhaps rapid) adoption of biometrics.

But we must tread lightly.

Behind the scenes of biometric innovation is a rising wave of comprehensive Biometric Information Privacy (BIP) regulations and associated litigation.

Unfortunately, whether and to what extent your insurance policies will protect against this emerging risk is … complicated.

Use of Biometrics

The term “biometrics” is defined by Merriam-Webster’s dictionary as “the measurement and analysis of unique physical or behavioral characteristics (such as fingerprint or voice patterns) especially as a means of verifying personal identity.”

Biometrics can include things such as facial scans/geometry, keystrokes/typing rhythm, gait, even some types of sleep and exercise data can be used to specifically identify an individual.

Biometrics are believed to be a more efficient and reliable means of verifying identity than PINs and passwords, because people will not “forget” a biometric identifier and cannot share it with others.

Cyber insurance policies are likely to be one of the first places an organization will look for protection.

In recent years, companies have been incorporating biometric technology into their business operations to strengthen security, combat fraud, monitor employee time, login to computers and improve customer service.

The use of retinal scans, voice authentication and facial recognition may ultimately prove more cost efficient, reliable and convenient.

Today, we are also seeing discussions about how biometrics may be useful in supporting public health and safety.

Biometric technology solutions may assist organizations in their return-to-work campaigns and help mitigate the risk and impact of future pandemics or public health emergencies.

Artificial intelligence combined with biometric technology can create solutions that monitor infection rates, track geolocation to gauge compliance with quarantine restrictions, determine body temperature and trace contacts.

While there are significant benefits to the use of biometrics, the potential for exploitation already exists. Cyber criminals are using artificial intelligence to replicate fingerprints, voiceprints and facial geometry.

Although we cannot forget or share biometric identifiers, when those unique identifiers are compromised, they are forever compromised. If someone steals our password, we can change the password. We cannot change our biometrics.

Biometric Regulation and Legal Risk

There is significant privacy risk associated with the collection and use of biometric data. This risk has led three states to enact standalone, comprehensive biometric information privacy laws.

The Illinois Biometric Privacy Act (BIPA) was the first of its kind, enacted in 2008. BIPA is the most well-known and considered to be the most stringent state biometric privacy law.

One of the key aspects of BIPA is that it permits a private right of action for any violation of the law, which allows individuals to file suit against companies that violate any provision of the law without the need to prove any actual harm suffered as a result of the violation.

Texas and Washington state also have comprehensive biometric privacy laws, but neither provides a private right of action.

Today, a growing number of other states have enacted laws like BIPA or expanded existing privacy regulations to include biometric information.

Notably, the California Consumer Privacy Act (CCPA), which went into effect in January 2020, includes “biometric information” within the definition of “personal information.”

It is significant to note that the CCPA does permit a private right of action. However, the CCPA allows for a more limited private right of action, requiring an individual to establish that the biometric information was disclosed in some way.

In addition, the New York SHIELD Act, with an effective date of March 2020, amends the definition of “private information” to encompass biometric data.

Florida and Massachusetts have proposed laws as well, both of which contemplate a private right of action.

The ability for consumers and employees to bring a private right of action in Illinois under BIPA has resulted in a significant amount of litigation in recent years. Within a two-year period of time, there have been over 200 class action lawsuits brought by a mix of consumers and employees, alleging violations of BIPA.

Many of these lawsuits resulted in multi-million-dollar settlements. Although the CCPA provides a more limited private right of action, companies operating in California are certainly at risk in the event they are not in compliance with the requirements set forth in the regulation and biometric information data is disclosed.

As more companies explore increasing the use of biometrics and more states enact regulations addressing the collection, use, storage and destruction of such information, it becomes increasingly important for organizations to prepare themselves for the associated legal risk.

Insurance Coverage – Beware of the Gap

Commercial insurance products currently available may not adequately protect companies against claims arising in connection with collection, use and destruction of biometric information.

Organizations should not assume that any of the insurance policies they have in their portfolio will respond to a biometric privacy claim. This is an emerging risk, and one that could likely experience sudden and rapid growth in the months ahead.

Existing policies may not fully contemplate the risk and therefore may not have appropriate definitions or coverage triggers. Alternatively, insurance underwriters may be proactively limiting the risk via exclusionary endorsements or enhanced underwriting.

Cyber insurance policies are likely to be one of the first places an organization will look for protection. Most standalone cyber insurance policies contain insuring agreements intended to respond to third-party liability lawsuits and regulatory proceedings.

However, the devil is in the details: Cyber insurance policies are all far from “standard.” The terminology and scope of coverage differs greatly from policy to policy.

Many standalone cyber policies that exist today are structured such that they will only trigger in the event there is a network security or privacy “breach.” Violations of biometric privacy laws that do not arise from a breach event may not trigger coverage under some cyber policies.

In addition, many cyber insurance policies preclude coverage for “wrongful collection” of personal information. Claims alleging failure to obtain proper consent to collect biometric information may be precluded.

If a claim is brought by a group of employees, a potential source of coverage might be an Employment Practices Liability (EPL) policy.

In order to trigger coverage under an EPL policy, the policyholder needs to be able to establish that a “wrongful employment practice” was committed. Typically, that term will include things such as “invasion of privacy” or “failure to adopt or enforce adequate workplace or employment policies and procedures.”

However, many carriers are now adding Biometric Privacy exclusions to EPL policies or are requiring policyholders to complete detailed Biometric Privacy questionnaires outlining potential exposure and compliance efforts.

Policyholders may also look to Commercial General Liability (CGL) policies and possibly even a Director & Officer Liability (D&O) policy. Most CGL policies contain fairly broad cyber exclusions. It is unclear whether these exclusions would apply to biometric data. Similarly, D&O policies could also contain broad cyber exclusions or an exclusion relating to “invasion of privacy.”

Of course, the availability of coverage under any of these policies depends largely on the facts of the case and the specific policy wording. The bottom line is coverage for this emerging risk is complicated.

Conclusion

There is always some degree of tension between innovation and regulation. Whether, and to what extent, existing or emerging privacy laws will support (or hamper) the widespread adoption of biometrics has yet to be seen.

As things stand now, biometric privacy regulation (like all privacy regulation) is a bit of a moving target. The states laws that exist today all differ slightly.

To complicate matters further, there are multiple other states with proposed regulations all of which differ. No two laws are exactly alike.

Companies currently collecting and using biometric information (or planning to) should pay close attention to the evolving regulatory landscape and should conduct a thorough review of their insurance policies to determine if changes to their policies are necessary to cover this emerging risk. &

Vermont’s Future Is Golden

Challenging market conditions are driving insureds to captives. Vermont offers a reliable domicile.

By: State of Vermont | November 21, 2024

Hard markets in commercial insurance lines have been a problem for years now. Many lines don’t show signs of softening, though some, like cyber, have ebbed over the past few years.

High claims volumes and costs have caused carriers to tighten terms and conditions, introduce new exclusions and increase premiums. A variety of different risks are included in this market tightening, and it’s affecting both public and private companies.

As Sandy Bigglestone, deputy commissioner for the State of Vermont’s captive insurance division, explained, schools, churches and other nonprofits are contending carriers are “excluding sexual abuse and molestation from coverage for a lot of these types of entities. These organizations understand the risk and the public needs to have confidence the organizations are addressing the risks, so they must have the coverage.”

Though many commercial lines are affected, property has perhaps been hit the hardest. Increased claims, inaccurate property valuations and other challenges have caused insurers to tighten their books in recent years. 2024’s spate of hurricanes will likely make matters worse.

“There continues to be challenges in the commercial market,” Bigglestone said. “Some companies are coming to us with risks that they say they’ve been self-insuring on their balance sheet, and why not transfer that to a captive to receive greater benefits?”

Consistency and Stability

Sandy Bigglestone, Deputy Commissioner for the State of Vermont’s Captive Insurance Division

With the commercial insurance market so unstable, companies are turning to captives to house their exposures. Vermont, a long-time domicile, is getting increased attention because of their strong reputation and their leadership as the top domicile worldwide.

“All stakeholders enjoy the stable political and regulatory environment Vermont has to offer to operate in,” Bigglestone said.

Of course, a lot of consideration goes into deciding whether or not a captive is the right choice for a particular company. Businesses need to assess their exposures and their books to make sure they can adequately operate a captive.

There are significant advantages, however. “For low frequency, high severity risks, captives can access the reinsurance markets directly, so it’s very attractive for businesses to put a captive in place,” Bigglestone said.

And carriers are more accepting of captives as part of a broader insurance program.

“Captives are changing the relationship businesses have with commercial carriers,” Bigglestone said. “Commercial carriers are wanting to see companies with skin in the game; therefore, the relationships have evolved to be less transactional and more strategic.”

Balancing Bureaucracy

With 76 global domiciles, companies have a lot of options when it comes to selecting a captive partner. “Captive insurance domiciles compete globally for the business,” Bigglestone said. “If you were to put all 7,000-plus captive insurance companies around the world, all in New York, it wouldn’t have the same economic impact as 700 captives in Vermont does. The captive insurance industry is very important to our state and we will continue to support it in any way we can.”

Businesses should look for domiciles that balance a need for quality regulations with a process that isn’t overly bureaucratic and is seamless for business owners to navigate.

“Companies are attracted to an environment with quality regulatory standards and a stable regulatory environment,” Bigglestone said. “Vermont sets the regulatory standard in terms of financial analysis and examinations.”

In addition to quality regulations, firms will want to seek out a domicile that is agile enough to license captive insurance companies that fit their unique needs. It is important that a domicile have firm but fair regulation and the experience to consider new ideas and implement them. Companies must consider a variety of factors when choosing a domicile and not everyone will be the right fit for every company.

“You have to consider the captive owner and the industry sector that that owner operates in, as well as the insurance risks that are going into the captive program,” Bigglestone said. “Captive laws and regulations have to have a reasonable degree of flexibility to accommodate all the varying needs of owners and then impose rules based on the merits of each captive program.”

She added that creativity is a critical part of the process: “The ability to vet concepts and ideas with trusted individuals is key to having quality standards,” Bigglestone said. “And it can make captives appealing to insureds who are tired of commercial carriers not meeting the needs of the business, and who desire more control over their insurance programs.”

“When you think about the commercial marketplace, commercial insurers are supposed to operate in each jurisdiction in a competitive manner. Commercial carriers often look the same. They sell auto coverage to anyone with a driver’s license. The rules and regulations imposed upon commercial insurance companies are designed to be more formulaic for that reason,” Bigglestone said.

“Uniform regulatory standards apply to commercial carriers for the protection of the policyholders. These are standards all insurance regulators focus on, and standards captive insurance regulators need to understand, but with a specialized focus.”

A Quality Domicile Built for the Future

A combination of experience, regulatory standards and talent make Vermont a top domicile for companies looking to form a captive. The longevity of licensing captive insurance companies for over forty years is a testament to the quality work they’ve provided in the past and will continue to provide for many years to come.

Vermont’s reputation has helped the state attract and retain top captive talent, ensuring the businesses it serves are in good hands. The state has 32 employees dedicated to captives, and their average employee retention is 15 years. The Vermont Captive Insurance Association, the largest captive insurance trade organization, also helps companies connect with professional services needed to make their captive successful.

“There’s a whole host of service providers with proven expertise right here in Vermont,” Bigglestone said.

Taken together, Vermont’s resources, expertise and talent make it a prime domicile. They’ve been on a growth trajectory over the last few years and that’s unlikely to change anytime soon. Companies can trust their captive will be in good hands when they choose Vermont.

“Vermont has always competed on quality,” Bigglestone said. “We do have a mission and that hasn’t changed in over 40 years. It’s to maintain a system, or domicile that attracts quality business to Vermont, to promote our reputation in the industry, and to uphold a regulatory framework to protect the solvency of the companies that choose to place their business here.”

To learn more, visit: www.vermontcaptive.com

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with State of Vermont. The editorial staff of Risk & Insurance had no role in its preparation.

The State of Vermont, known as the “Gold Standard” of captive domiciles, is the leading onshore captive insurance domicile, with over 1,200 licensed captive insurance companies, including 48 of the Fortune 100 and 18 of the companies that make up the Dow 30.