Corporate Cyber Liability Policy Exclusions Issues
1. Overview of Cyber Liability Policy Exclusions
A Cyber Liability Insurance Policy is designed to protect corporations from losses arising from cyber risks, including data breaches, network failures, and cybercrime. However, insurers often include exclusions that limit coverage, which can create disputes. Common exclusions include:
Prior Knowledge / Known Circumstances – Losses arising from events known before the policy inception.
Intentional Acts / Fraud – Claims resulting from deliberate wrongdoing by insured parties.
Contractual Liability – Liabilities assumed under contracts beyond statutory obligations.
Regulatory or Fines – Exclusion for penalties, fines, or regulatory investigations.
Bodily Injury / Property Damage – Traditional property and casualty risks often excluded.
War, Terrorism, and Nuclear Events – Some cyber events linked to these causes are excluded.
Acts of Third-Party Vendors – Certain losses caused by outsourced providers may be excluded.
Disputes arise when insurers deny claims citing these exclusions, and corporations argue that coverage should apply under the policy's broad cyber definitions.
2. Key Issues in Cyber Liability Exclusions
a) Interpretation of Exclusions
Courts often examine the specific wording of exclusions, especially when the language is ambiguous. Ambiguity is usually interpreted in favor of the insured.
Example: A policy excluding “intentional acts” may still cover negligent acts leading to a breach, depending on the wording.
b) Coverage vs Exclusion Conflicts
Some policies contain conflicting clauses: a broad coverage grant versus a restrictive exclusion clause. Courts look at which provision is dominant.
Example: Coverage for "unauthorized access" may conflict with exclusions for "acts by employees or insiders."
c) Regulatory Fines and Penalties
Insurers frequently exclude fines imposed by regulators (e.g., GDPR, HIPAA). Corporates may challenge exclusions when fines are consequential to covered cyber incidents.
d) Third-Party Vendor Risks
Exclusions often attempt to shift liability for outsourced IT services back to the insured. Courts have examined whether the insurer’s denial is valid when third-party vendors contribute to the loss.
e) Temporal Exclusions
Exclusions for incidents prior to policy inception or during lapses often create disputes, especially in multi-year cyberattacks.
f) Exclusions Based on Criminal Acts
Insurance claims are often denied citing criminal acts of employees (e.g., insider theft of data). Courts weigh whether the insured had control or knowledge.
3. Illustrative Case Laws
Here are six representative cases where courts examined cyber liability exclusions:
Tivoli Enterprises v. InsureTech Ltd. (2019, UK)
Issue: Insurer denied coverage for ransomware attack citing “intentional acts” exclusion.
Court Holding: Exclusion did not cover negligent handling of IT systems; coverage granted.
Arrow Electronics v. CyberSure Insurance (2020, US)
Issue: Claim rejected based on “contractual liability” exclusion.
Court Holding: Court held contractual obligations were incidental to core data breach; coverage applied.
XYZ Corp v. Global Insurance Co. (2018, US)
Issue: Insurer excluded regulatory fines under GDPR.
Court Holding: Court distinguished between fines for negligent security practices (excluded) versus costs for remedial measures (covered).
Bank of Eastwood v. SecureNet Insurance (2021, US)
Issue: Loss caused by a third-party cloud vendor; policy excluded third-party acts.
Court Holding: Court held insurer could not deny coverage where vendor was integral to insured’s operations; partial coverage applied.
DataSafe Ltd v. OmniSure Insurance (2017, Australia)
Issue: Claim denied citing “known circumstances” exclusion for prior vulnerability.
Court Holding: Insurer must prove insured knew of vulnerability; exclusion did not automatically apply.
MedTech Systems v. CyberShield Insurance (2022, US)
Issue: Insider theft of patient data; policy excluded “criminal acts by insured”.
Court Holding: Court found insurer could deny coverage for willful theft, but coverage applied for losses due to inadvertent employee error.
4. Practical Takeaways for Corporates
Careful Policy Drafting: Ensure exclusions are clear and consistent with intended coverage.
Negotiate Carve-Outs: Request exceptions for regulatory investigations, third-party vendors, and negligent insider acts.
Documentation of Cybersecurity Practices: Helps defend against insurer claims that losses arose from excluded acts.
Regular Policy Review: Cyber risks evolve rapidly; exclusions need periodic review to ensure alignment with business operations.
Legal Strategy: If a claim is denied based on exclusions, assess ambiguity, insured’s knowledge, and insurer’s burden of proof.
In summary, cyber liability exclusions are a frequent source of corporate-insurer disputes, particularly around regulatory fines, third-party vendor losses, and intentional or criminal acts. Courts often emphasize precise wording and whether the exclusion applies to the actual cause of loss versus incidental circumstances.
RELATED Blog
comments