Cyber Risks and Insurance: The Legal Principles

Description

DELETE Preface Table of Statutes Table of Statutory Instruments Table of European Material Table of Cases Chapter 1 Introduction Data The growth of cyber insurance Conclusion Chapter 2 Data Obligations and Breaches Generally Introduction Data obligations in respect of personal data What is the scope of the GDPR? What are the personal data obligations under the GDPR? (a) The Data Protection Principles (b) Rights of data subjects (c) Transfers of personal data to third countries or international organisations What are the personal data obligations under the DPA 2018? Who enforces personal data obligations in the UK? (a) The ICO (b) The courts Data obligations under the PECR What are the data obligations under the PECR? (a) Electronic marketing and non-essential website cookies (b) Security of public electronic communications services (c) Privacy of users of electronic communications services Who enforces the PECR data obligations in the UK? (a) The ICO (b) The courts Data obligations under the NIS Regulations What are the data obligations on digital service providers under the NIS Regulations? Who enforces the obligations on digital service providers under the NIS Regulations in the UK? Data obligations under the common law of confidentiality When will information be protected under the common law of confidentiality? (a) When will information have the necessary quality of confidence? (b) What circumstances import an obligation of confidence? Who do the obligations under the common law of confidentiality apply to? Breaches of data obligations What are breaches of data obligations? What to do if there has been a breach of data obligations (a) What practical steps can be taken to limit the damage caused by a data breach? (b) Who needs to be notified of a data breach? (c) What remedies are available to seek redress for a data breach? What are data obligations now after the Brexit implementation period? (a) GDPR (b) The PECR and NIS Regulations (c) Common law of confidentiality Conclusions on data obligations and breaches Chapter 3 Data Protection as it Applies to Insurance Introduction Specific data protection considerations for the insurance industry under the GDPR What is the scope of the GDPR? What are the specific data protection considerations for the insurance industry under the GDPR’s Data Protection Principles? (a) Data Protection Principle 1: lawfulness, fairness and transparency (b) Data Protection Principle 4: accuracy (c) Data Protection Principle 5: storage limitation (d) Data Protection Principle 6: integrity and confidentiality What are the specific data protection considerations for the insurance industry under the GDPR’s rights of data subjects? (a) Right to access (b) Right to data portability (c) Right not to be subject to a decision based solely on automated processing What are the specific data protection considerations for the insurance industry with respect to relationships with third parties? (a) Joint controllers (b) Controller-processor relationships Brexit and the GDPR Data protection considerations for the insurance industry under the PECR What are the data protection considerations for the insurance industry under the PECR? (a) Unsolicited electronic marketing (b) Cookies Brexit and the PECR Data protection insurance Conclusions on data protection as it applies to insurance Chapter 4 Insurance for Artificial Intelligence Products What is artificial intelligence? Autonomous vehicles Driverless cars Autonomous ships Hacking of autonomous vehicles Artificial intelligence in healthcare Artificial intelligence in toys Artificial intelligence and the Internet of Things What is the Internet of things? Use of the Internet of Things Classroom monitoring Operation of cities Conclusion Chapter 5 Cyber Extortion Introduction What is cyber extortion? Ransomware What is cyber extortion insurance? What are the things to look out for in a cyber extortion policy? Consent In what circumstances can an insurer refuse to pay the sums demanded? Attackers believed to be terrorists Associated costs Costs of rectification Cross-over with business interruption insurance Loss of personal data How important is it? Conclusion Chapter 6 Responding to an Attack Introduction Common scenarios Response Stage 1 – the period of the attack itself Stage 2 – the immediate aftermath Stage 3 – the long-term fallout Conclusion Chapter 7 Cyber Insurance and the Blockchain Introduction What is cyber insurance? What is a blockchain? Consensus models Proof of work Proof of stake Round Robin Proof of Authority Proof of Elapsed Time What are the possible use cases for blockchain technology in cyber insurance? Data provision, risk analytics and underwriting Cyber insurance policies, premiums and claims Insuring cyber products Should blockchain technology be used to provide cyber insurance? So why this scepticism? Cyber insurance for blockchains Is cyber insurance needed for blockchain technology? Cyber insurance for cryptoassets (a) Platform insurance (b) Individual wallet insurance Conclusions Chapter 8 Shipping Introduction What are the risks? What are the possible consequences of cyber attacks? Recent incidents of cyber attacks ‘Spoofing’ The industry response Stuxnet worm UK Code of Practice: Cyber Security for Ships IMO Guidelines on maritime cyber risk management IMO Maritime Cyber Risk in Safety Management Systems US Coast Guard Further guidance Conclusion The insurance position The Institute Cyber Attack Exclusion Clause PRA response Lloyd’s response Lloyd’s Market Association model clauses Autonomous ships Maritime Safety Committee Guidelines Conclusion Chapter 9 Remedies Introduction Injunctions Non-disclosure orders Blocking injunctions Freezing injunctions – England and Wales Freezing injunctions – worldwide Norwich Pharmacal Bankers Trust GDPR Pursuing a claim Conclusions Chapter 10 Exclusion clauses Introduction How are exclusion clauses interpreted? Common exclusion clauses to look out for Failure to maintain required security practices War/terrorism exclusion clause Examples Bodily injury Intellectual property Double insurance Conclusion Chapter 11 Cyber Issues in Energy Introduction What legislative measures guard against cyber attacks and digital disruptions in the energy sector? NIS Regulations (a) Who are operators of essential services? (b) Who is the designated competent authority for operators of essential services within the energy sector? (c) What obligations do operators of essential services within the energy sector have to comply with under the NIS Regulations? (d) What are the powers and responsibilities of the designated competent authorities in respect of operators of essential services within the energy sector? (e) NIS Regulations and Brexit Computer Misuse Act 1990 (a) Territorial scope of the Computer Misuse Act 1990 (b) Offence under CMA 1990, s 3ZA What practical steps can be taken to prepare for a serious cyber attack or digital disruption in the energy sector? Cyber innovations in the energy sector (a) AI in exploration and production (b) AI in security, control and monitoring systems Conclusions on cyber issues in energy Index