IS YOUR BUSINESS READY FOR MANDATORY PRIVACY BREACH REPORTING AND OTHER TYPES OF CYBER LOSS?

Effective November 1^st, 2018, all Commercial Activity Organizations are subject to Mandatory Privacy Breach Reporting. The exceptions are Non-Profit organizations unless they sell or release for example, members lists to outside organizations.  For Non-Profit Organizations the point to remember is that even though you may be exempt what would your donors, members etc. expect you to do for their benefit in the event of a data breach?

Commercial activity is defined in the act as any particular transaction, act or conduct, or any regular course of conduct that is of a commercial character.

As of November 1^st, 2018, all Commercial Activity Organizations that experience a data breach will have the following obligations to which they must adhere.

• Identify individuals whose information was involved in the breach by conducting a risk assessment. The assessment of risk must consider the sensitivity of the information involved and the probability that the information will be misused;
• When the organization considers that a breach is posing a real risk of significant harm, it must notify affected individuals and report to the Privacy Commissioner of Canada (the Commissioner) as soon as feasible;
• The organization must notify any other organizations that may be able to mitigate harm to affected individuals; and
• The organization must maintain a record of any data breach that the organization becomes aware of and provide it to the Commissioner upon request.
• Also conducting business with individuals or businesses in the E.U. brings you under their protocols, which are far more onerous than those in Ontario or Canada.

We have not seen the final amendments to the original PIPEDA Act. (Personal Information Protection and Electronic Documents Act).  We do know that amendments to the original act as stipulated above will be implemented November 1^st, 2018.

As more information is released, we will make that information available on our website under the heading “The Digital Privacy Act”.  If you send me an email, I will forward to you additional information as it is received rather than you having to check our website.

If your organization has delayed the purchase of this relatively new coverage it has now become in my opinion, a mandatory component of your Insurance Portfolio. This coverage is often being mandated by other commercial enterprises with whom you are doing business. Expect this trend to increase.

When discussing Cyber Risk, “my data is in the cloud” is a common reaction by Insureds, who equate this to safety.  Not Correct! In fact the contracts with cloud providers excuse them from responsibility in almost all circumstances! Similarly “my data is kept, housed, used by, or at a third-party service provider”.  If it is your data you are responsible for its demise and the associated costs and damages resulting from the breach!

Cyber exposure is not just the mandatory reporting requirement that I have discussed. Cyber exposure is multifaceted as are Cyber Insurance coverages. Cyber Insurance normally includes payment for mandatory reporting associated costs and potentially a host of other coverages such as, Business Interruption and Extra Expense Coverage, Digital and Written Record Recovery Costs Coverage, Extortion Coverage, Social Engineering Coverage, Third Party Liability Coverage for your At-Fault Cyber and Network Security Liability activities that harm others, including Electronic, Social and Printed Media Liability that causes harm to a third party.

Cyber Insurance also includes Cyber Coaching in the event of an incident. This entails a group of dedicated specialists that can lead you through a cyber event.  This service is available 24/7, 365 days/year via an 800 number, all courtesy of your Insurer as a value-added service. This is specific to the Insurer we prefer as an Underwriter of this class. You know what to do if you have a water loss but can you instinctively react to a cyber loss? Probably Not! The first four (4) hours post-event are critical! This is the purpose of Cyber Coaching!