What's Happening?

Facebook Twitter Youtube Linkedin

NEED HELP? QUESTIONS@FIA.ORG.ZA

become A FIA member TODAY
member login

What is a Directors liability following a cyber breach?

ARTICLE BY

  • Candice Sutherland

SHARE THIS POST

The views expressed in this article are not necessarily those of the FIA. The article below was supplied by the 2018 FIA partner, ITOO Special Risk.

 

A breach is an incident in which sensitive, protected or confidential information is either stolen, copied, transmitted, viewed or used by an unauthorized party.  This data could belong to the company itself (intellectual property) or it could be employees or third parties (clients, suppliers, contractors) private information which is exposed either electronically or in paper format

In 2017 the phishing rate in South Africa was the highest in world, where 1 in 785 emails was a phishing attack.  According to the Ponemon 2018 Cost of Cyber Breach Study:  South Africa shows the following alarming statistics:

  • The average total cost of a cyber breach was R32 million
  • R1 755 is the average cost per lost or stolen record
  • Malicious attacks (43%) and human error (29%) caused most cyber breaches

Interesting findings is that the appointment of a CPO significantly decreased the per capita cost of cyber breach

Ultimately, a company’s financial, reputational and operational success rests on the Board.  Directors owe the corporation and its shareholders three duties: due care, skill and diligence in managing the business

Boards and Directors have significantly more to worry about following a cyber breach:  expenses such as response and remediation costs could be crippling for any business but perhaps the most onerous would be the consequential loss of bottom-line revenue as well as the impact on client, customer, patient and employee relationships

Directors and Executives can face personal liability in relation to cyber breaches under South African law.  The Board must proactively manage cybersecurity and drive the organisation’s attention to, and readiness for a cyber security incident.  It is extremely difficult if not impossible for anyone who doesn’t work full-time in cyber security to keep up with the ever-changing threat landscape and Directors are being named as defendants in costly and intrusive litigation.  A statement or claim of not having enough information or an insufficient understanding of the IT systems would not be an adequate defence

The failure to implement appropriate cyber security risk management measures could constitute a breach of Directors’ fiduciary duties. These fiduciary duties have been codified by the Companies Act No 71 of 2008 (Companies Act) and a breach of these fiduciary duties could lead to claims being brought against Directors and Executives.  South African common law principles stipulate that any person who contravenes the Companies Act is liable to any other person for any loss or damage suffered by that person as a result of that contravention

Regulatory action:  depending on the regulatory framework and industry within which the company operates, complaints can be made to the Companies and Intellectual Property Commission (CIPC) who will in turn investigate and allow action to be taken against a company or its Directors

Right to privacy:  Directors and Executives may face personal liability as a result of having breached privacy law in South Africa. The right to privacy is protected under the common law in South Africa. South Africa has also passed the Protection of Personal Information Act 3 of 2013 (POPI). Depending on the nature of the contravention, a Director may face civil fines, administrative fines, penalties and even a period of imprisonment

Parties affected by a cyber breach can hold the corporation’s management and Board of Directors accountable as they might feel that the corporation failed to address weaknesses in its systems and programs.

Good corporate governance steps a Board could implement to protect Directors from personal liability are:

  • Board meetings.  Ensure that cyber security and data privacy matters are discussed regularly at board meetings
  • Employee Education. Maintain a high level of cyber awareness.  29% of cyber breaches were caused by human error and strong security practices can minimise the possibility that attacks like phishing are successful
  • Breach Planning. How has management prepared for a cyber breach.  Have printed copies of your breach response plan readily available (not only saved electronically i.e., should there be a Denial of Service Attack you would not be able to access your systems)
  • Intrusion detection. Are there systems, personnel and software in place that can detect a security breach promptly
  • Vulnerability scans or penetration tests.  Hire third party consultants to audit the security systems.  Ask for recommendations to improve your network
  • Disclosure Obligations. Is the Board aware of these obligations, as failure to do so certainly increases the risk that clients may bring an action against the Board and the Company.
  • Post-Breach Review. The Board must act promptly.  Assess security gaps and evaluate the effectiveness of the corporation’s current policies and procedures. This may include updating technology controls and policies and procedures, revisiting existing plans and making appropriate changes
  • Insurance. A fundamental aspect of corporate governance and having a strong cyber risk management program would include cyber insurance policy as well as a D&O policy to protect the personal assets of Directors

Cyber insurance, more than any other insurance, allows access to the correct channel of service providers needed to recover fully from a cyber incident

ITOO CYBER INSURANCE SOLUTION

Triggers

  • Network security breach – means a Downstream attack, or Unauthorised Access to, Unauthorised Use of, Theft of Data from, Denial of Service Attack or transmission of Malicious Code to the Insured’s Computer System, including physical theft of the Insured’s Computer System, or any part thereof
  • Privacy breach – means a breach of confidentiality, infringement, or violation of any right to privacy, which results in harm to employees or third parties

Overview

Description

3rd party

Privacy liability

Defence and settlement of liability claims arising from compromised information

Network security liability

Defence and settlement of liability claims resulting from a system security incident affecting systems and data as well as causing harm to third-party systems and data

Media liability

Defence and settlement of liability claims resulting from disseminated content (including social media content) including:

• Defamation

• Unintentional copyright infringement

• Unintentional infringement of right to privacy.

Incident mitigation

Incident response costs

Costs to respond to a systems security incident, including incident triage, forensic investigation, legal, crisis communication, public relations and credit monitoring

1st party

Regulatory fines

Fines assessed by a government regulatory body due to an information privacy breach

Business interruption

Loss of income and increased cost of working as a result of a systems security incident

Data restoration

Costs to restore, re-collect or replace data lost, stolen or corrupted due to a systems security incident

Cyber extortion

Costs to investigate and mitigate a cyber extortion threat. Where required, costs to comply with a cyber extortion demand

 

For more information contact:

Ryan van de Coolwijk  083 794 4332    ryanv@itoo.co.za                      

Candice Sutherland       082 346 1716   candices@itoo.co.za

 

ITOO DIRECTORS AND OFFICERS POLICY

The ITOO D&O policy is structured as follows:

Directors & Officers – Provides cover for non-indemnified events – i.e. protects a director against personal liability or expenses not paid for by the company, and advances defence costs

  • Company Reimbursement – Reimburses the company when the company has indemnified a director for an insured event, including any defence costs and expenses
  • Company Securities – Cover for the entity where it is joined as a defendant with the directors in respect of actions relating to the sale or purchase of the company’s securities or shares

(An officer is defined as any employee in a managerial or supervisory capacity as well as the company secretary)

For more information contact:

Warwick Goldie    08082 653 7833  warwickg@itoo.co.za     

ITOO is a special risks Underwriting Management Agency (UMA) focused on liability, special and emerging risks underwritten on the Hollard Insurance licence.  www.itoo.co.za

Subscriber Terms and Conditions

  1. APPLICATION OF TERMS
    • These terms and conditions (“Subscriber Terms”) apply to the subscription by any qualifying member of the South African Underwriting Managers Association NPC (“SAUMA”) to the services and benefits offered by FIA Services (Pty) Ltd (“FIA Services”) under the SAUMA affiliation arrangement (“Subscription”).

  2. NATURE OF SUBSCRIPTION
    • A Subscription under this arrangement:
      • does not constitute membership of FIA NPC;
      • does not confer any voting rights or governance participation in FIA NPC; and
      • is governed solely by the contractual relationship between the Subscriber and FIA Services.

  1. ELIGIBILITY
    • To qualify for the Subscription, the applicant must, at the time of application, be a current paid-up member of SAUMA.
    • FIA Services will verify the applicant’s SAUMA membership status with SAUMA prior to activation, and may re-verify such status periodically.
    • If a Subscriber ceases to be a paid-up member of SAUMA, the Subscription will correspondingly be terminated.
    • Applicants are required to authorise FIA Services to confirm their SAUMA membership status with SAUMA as part of the application process.

  1. SERVICES
    • The Subscription entitles the Subscriber to the following benefits:
      • Complimentary access to the FIA CPD Platform;
      • Complimentary access to the FIA Insight Magazine (digital edition);
      • Advertising opportunities on FIA platforms at a discounted rate of 15% (fifteen percent) off the prevailing published rates; and
      • Invitations to attend FIA Technical Webinars annually.
    • FIA Services reserves the right to update, vary or substitute the Services from time to time, provided that the overall value and nature of the benefits remain materially the same.

  1. FEES AND PAYMENT
    • The monthly subscription fee is R260.00 (two hundred and sixty rand) for up to seven registered individuals (Key Individuals and Representatives), and R36.00 (thirty-six rand) per additional registered individual thereafter, excluding VAT.
    • The Subscriber shall provide FIA Services with the required details of each individual to be registered under the Subscription for the purposes of activation and billing.
    • All fees are exclusive of VAT, which shall be charged at the prevailing statutory rate.
    • Subscription fees are reviewed annually in March and may be adjusted with effect from 1 April.
    • Any changes to the Subscription, including but not limited to the number of Representatives and Key Individuals registered under the Subscription, may only be effected once annually during the annual review period in March of each year, with such changes taking effect from 1 April.
    • Subscription fees shall be billed monthly in arrears, unless the Subscriber elects an annual billing cycle at the time of application.
    • The Subscriber shall ensure that all billing information (including contact details, authorised signatories and bank account details) is kept accurate and up to date.
    • Non-payment of subscription fees may result in suspension of access to the Services until such fees are brought up to date.
    • The Subscriber acknowledges and agrees that all subscription fees payable under these Subscriber Terms may be collected by way of debit order, which shall be processed by the holding company, FIA NPC (The Financial Intermediary Association of South Africa), on behalf of FIA Services. Payment to FIA NPC shall be deemed to constitute valid and sufficient discharge of the Subscriber’s payment obligations to FIA Services under these Subscriber Terms.

  1. ONBOARDING
    • Onboarding will be conducted as a Subscription with FIA Services under the SAUMA affiliation arrangement.
    • Onboarding will not confer FIA NPC membership status or any associated rights.
    • Onboarding is conditional on confirmation of the Subscriber’s current SAUMA membership at the time of application

  1. DATA PROTECTION
    • FIA Services will process all personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) as set out in our POPIA policies.
    • By subscribing, the Subscriber authorises FIA Services to confirm their SAUMA membership status with SAUMA and to process personal information for the purposes of fulfilling the Subscription.

  1. TERMINATION
    • The Subscriber may terminate the Subscription by giving FIA Services one calendar month’s written notice.
    • FIA Services may terminate the Subscription on one calendar month’s written notice, or immediately if the Subscriber breaches these Subscriber Terms and fails to remedy such breach within 14 (fourteen) days of receiving written notice.
    • Termination of the SAUMA–FIA Services affiliation agreement shall not automatically terminate these Subscriber Terms.
    • Termination by the Subscriber shall not relieve the Subscriber of liability for any subscription fees accrued up to the effective date of termination.
    • FIA Services may suspend or terminate the Subscription with immediate effect in the event of non-payment of fees by the Subscriber.

  1. GENERAL
    • These Subscriber Terms are governed by the laws of the Republic of South Africa.
    • Any disputes arising under these Subscriber Terms shall be dealt with in accordance with the dispute resolution provisions contained in the FIA NPC membership terms and conditions, as modified to reflect that the contractual relationship is with FIA Services.
    • Any notices required under these Subscriber Terms may be validly delivered by email to the addresses provided in the Subscriber’s application form, and such notices shall be deemed received on the day of transmission if sent during business hours.
    • The Subscriber may not assign, cede or transfer any of its rights or obligations under these Subscriber Terms without the prior written consent of FIA Services.
    • No variation of these Subscriber Terms shall be of any force or effect unless reduced to writing and signed by both FIA Services and the Subscriber.