The last year has been a relatively kind period for cyber insurance buyers, with a slight softening in market conditions, caused by a reduction in loss-causing events.

Cyber remains a new market but one that is rapidly maturing, meaning that insurers are much better at recognising and evaluating risks than they were even a short time ago. Nonetheless, it remains a highly unpredictable sector, and as the technology and tracking software adopted by firms become ever more sophisticated, the risk of unexpected, large-scale losses increases.

A potential problem for insurers

In Africa, these risks are exacerbated by the continent’s rapid digital transformation and the fact that information security has not kept pace. The market is growing, but this is constrained by a lack of cybersecurity infrastructure.

Customers’ low awareness of cybersecurity risks and lack of proper security measures is a potential problem for insurers, impacting how they refine their pricing strategies.

Intermediaries have an important role to play, by working with clients to make sure that they have effective data protection measures in place and that they are abreast of the rapidly changing risks they face.

Pixel privacy claims

We are increasingly having to engage with clients and insurers on the growth of ‘pixel’ privacy claims. Pixels are widely used pieces of code that track user behaviour online. They have spawned significant data privacy concerns, especially when they are used to collect data without consent, or the data collected is shared with a third party. The rise in claims highlights the need for firms to treat data sensitively, as well as how cyber claims can arise from unexpected places.

Companies working in the health sector have been particularly vulnerable to claims regarding their use of pixels or the data collected by them. The sensitive nature of much of the data they collect means that the fallout from a breach can be much more severe than in other sectors. As an example, as well as class-action lawsuits, pixels can introduce regulatory risk if firms are in breach of South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA). That said, firms in any industry can and have been affected by pixel tracking risk.

Insurers are raising the standards

The insurance industry has moved quickly in response to the growth in claims, with many underwriters carefully scrutinising policies and amending them where necessary. Typically, cyber insurance will cover third-party privacy liability, however, insurers are beginning to explicitly exclude wrongful data collection claims, including those relating to pixel tracking. Given the flux, intermediaries must ensure they are confident of the terms that clients are agreeing to and be able to explain them properly.

Insurers are also raising the standards they require of policyholders, toughening up their expectations regarding privacy policy and the notices given to website users. Intermediaries should be aware of these requirements and support clients to meet them. Typically, coverage will depend on proactive risk mitigation by policyholders, including regular audits of web infrastructure, including pixel tracking, robust privacy policies, and detailed incident response plans.

African businesses, like businesses everywhere, are facing numerous cybersecurity challenges and insurers are constantly evolving their coverage to reflect changing risk profiles. Intermediaries are essential to ensuring that companies are putting themselves in a position where they have strong privacy measures in place and can secure the coverage that they need. The growth in pixel claims highlights how preparedness is an ever-moving target, and that agility is vital to navigating the market successfully.

You can read the original article on the FA News website