What's Happening?

Facebook Twitter Youtube Linkedin

NEED HELP? QUESTIONS@FIA.ORG.ZA

become A FIA member TODAY
member login

Insurance & Data Privacy

ARTICLE BY

  • Zamani Ngidi

SHARE THIS POST

Data Breach Financial Implications of the Protection of Personal Information Act

Evolving cyber risks and the Protection of Personal Information Act (POPIA) has created a greater awareness of the financial impact of cyber risks, considering the fact that maximum penalties under POPIA are a R10 million fine or imprisonment for a period not exceeding 10 years or both[1]. It emphasises the need for organisations to increase their understanding of cyber insurance.

Aon South Africa, insurance brokerage and risk advisors, today released its Insurance & Data Privacy report, which highlights the impact that POPIA will have on organisations and identifies how cyber insurance can assist.

POPIA came into effect on 1 July 2020 and following the 12-month transition period, organisations must be compliant with POPIA by 1 July 2021. The act was adopted to protect the rights to privacy of natural living persons and in addition, extended to include existing legal persons, putting forth minimum requirements for processing personal information[2], aiming to:

  • Give effect to the constitutional right of privacy, in particular the safeguarding of personal information.
  • Regulate the processing of personal information in harmony with international privacy standards.
  • Prescribe minimum requirements for the lawful processing of personal information.
  • Provide rights and remedies to protect data subjects against unlawful and illegal uses of their personal information.
  • Establish an Information Regulator – to promote, enforce and fulfil the rights protected by POPIA.

As organisations seek to comply with the requirements set out in POPIA, it will become increasingly important for their businesses to make operational changes to the way they process personal information.

“One of the requirements set out in the act is for organisations to appoint an independent member of their organisation to perform the function of a data protection officer (referred in POPIA as ‘information officer’), ensuring that the principles of POPIA are adhered to and form part of the overall organisational culture. The function can be performed by an individual or a group of individuals, who are familiar with the organisation’s operations and processes. This stipulation, alone, highlights the operational changes that need to be adopted in order to comply with the legislation,” explains Zamani Ngidi, Cyber Solutions Client Manager at Aon South Africa.

Cyber insurance and POPIA

The scope of POPIA is broader than most cyber insurance policies which are often triggered by privacy or security incidents, whereas POPIA violations can also be triggered by non-compliance, separate and apart from a privacy or security incident.

“The current insurance market does allow for some expansion of cover to specifically address certain instances of non-compliance as it relates to POPIA, but the language of such insurance policy must be carefully drafted and reviewed. Where a cyber insurance policy is intended to cover such fines, a key issue for organisations is the extent to which those fines are insurable,” says Zamani.

Typical cyber insurance policies only insure fines when insurable by applicable laws, and generally stipulate that the insurability of fines or penalties shall be determined by the “laws of any applicable jurisdiction that most favours coverage for such monetary fines or penalties.”[3]

“From a South African perspective, it is not possible to insure against criminal fines as a matter of law and public policy. Insuring administrative fines is not expressly prohibited but such fines are likely to be found uninsurable as a matter of public policy. Organisations should also consider other costs and liabilities that could result from non-compliance with POPIA,” says Zamani.

“Cyber insurance policies do, however, play a central role in how an organisation manages and mitigates cyber related risks. It may protect an organisation by not only providing financial indemnification after a cyber incident has gone wrong, but also offering other term consultancy to help improve security and on-the-ground incident response support during a period of crisis following a cyber incident,” Zamani explains.

“POPIA fundamentally changes business requirements in processes such as, incident response and business continuity, making it crucial for organisations to evaluate the value that can be unlocked from the insurance market via forensic consultants, experience in handling claims and incidents that may be somewhat unfamiliar to the business. Consulting with a professional broker that specialises in cyber risk will be well worth the effort in achieving a better understanding of their exposures and to navigate the complex relationship that exists between POPIA and cyber risk,” urges Zamani.

Download Aon’s Insurance & Data Privacy Report for an in-depth insight into data breach financial implications of the Protection Of Personal Information Act (POPIA)

[1] https://www.popiact-compliance.co.za/popia-information/16-offences-penalties-and-administrative-fines#:~:text=For%20the%20more%20serious%20offences,a%20fine%20and%20such%20imprisonment.

[2] https://www.justice.gov.za/inforeg/docs/InfoRegSA-POPIA-act2013-004.pdf  – Protection of Personal Information Act, 2013

[3] Aon GDPR Insurability of Fines white paper, 3rd Edition. May 2020

Subscriber Terms and Conditions

  1. APPLICATION OF TERMS
    • These terms and conditions (“Subscriber Terms”) apply to the subscription by any qualifying member of the South African Underwriting Managers Association NPC (“SAUMA”) to the services and benefits offered by FIA Services (Pty) Ltd (“FIA Services”) under the SAUMA affiliation arrangement (“Subscription”).

  2. NATURE OF SUBSCRIPTION
    • A Subscription under this arrangement:
      • does not constitute membership of FIA NPC;
      • does not confer any voting rights or governance participation in FIA NPC; and
      • is governed solely by the contractual relationship between the Subscriber and FIA Services.

  1. ELIGIBILITY
    • To qualify for the Subscription, the applicant must, at the time of application, be a current paid-up member of SAUMA.
    • FIA Services will verify the applicant’s SAUMA membership status with SAUMA prior to activation, and may re-verify such status periodically.
    • If a Subscriber ceases to be a paid-up member of SAUMA, the Subscription will correspondingly be terminated.
    • Applicants are required to authorise FIA Services to confirm their SAUMA membership status with SAUMA as part of the application process.

  1. SERVICES
    • The Subscription entitles the Subscriber to the following benefits:
      • Complimentary access to the FIA CPD Platform;
      • Complimentary access to the FIA Insight Magazine (digital edition);
      • Advertising opportunities on FIA platforms at a discounted rate of 15% (fifteen percent) off the prevailing published rates; and
      • Invitations to attend FIA Technical Webinars annually.
    • FIA Services reserves the right to update, vary or substitute the Services from time to time, provided that the overall value and nature of the benefits remain materially the same.

  1. FEES AND PAYMENT
    • The monthly subscription fee is R260.00 (two hundred and sixty rand) for up to seven registered individuals (Key Individuals and Representatives), and R36.00 (thirty-six rand) per additional registered individual thereafter, excluding VAT.
    • The Subscriber shall provide FIA Services with the required details of each individual to be registered under the Subscription for the purposes of activation and billing.
    • All fees are exclusive of VAT, which shall be charged at the prevailing statutory rate.
    • Subscription fees are reviewed annually in March and may be adjusted with effect from 1 April.
    • Any changes to the Subscription, including but not limited to the number of Representatives and Key Individuals registered under the Subscription, may only be effected once annually during the annual review period in March of each year, with such changes taking effect from 1 April.
    • Subscription fees shall be billed monthly in arrears, unless the Subscriber elects an annual billing cycle at the time of application.
    • The Subscriber shall ensure that all billing information (including contact details, authorised signatories and bank account details) is kept accurate and up to date.
    • Non-payment of subscription fees may result in suspension of access to the Services until such fees are brought up to date.
    • The Subscriber acknowledges and agrees that all subscription fees payable under these Subscriber Terms may be collected by way of debit order, which shall be processed by the holding company, FIA NPC (The Financial Intermediary Association of South Africa), on behalf of FIA Services. Payment to FIA NPC shall be deemed to constitute valid and sufficient discharge of the Subscriber’s payment obligations to FIA Services under these Subscriber Terms.

  1. ONBOARDING
    • Onboarding will be conducted as a Subscription with FIA Services under the SAUMA affiliation arrangement.
    • Onboarding will not confer FIA NPC membership status or any associated rights.
    • Onboarding is conditional on confirmation of the Subscriber’s current SAUMA membership at the time of application

  1. DATA PROTECTION
    • FIA Services will process all personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) as set out in our POPIA policies.
    • By subscribing, the Subscriber authorises FIA Services to confirm their SAUMA membership status with SAUMA and to process personal information for the purposes of fulfilling the Subscription.

  1. TERMINATION
    • The Subscriber may terminate the Subscription by giving FIA Services one calendar month’s written notice.
    • FIA Services may terminate the Subscription on one calendar month’s written notice, or immediately if the Subscriber breaches these Subscriber Terms and fails to remedy such breach within 14 (fourteen) days of receiving written notice.
    • Termination of the SAUMA–FIA Services affiliation agreement shall not automatically terminate these Subscriber Terms.
    • Termination by the Subscriber shall not relieve the Subscriber of liability for any subscription fees accrued up to the effective date of termination.
    • FIA Services may suspend or terminate the Subscription with immediate effect in the event of non-payment of fees by the Subscriber.

  1. GENERAL
    • These Subscriber Terms are governed by the laws of the Republic of South Africa.
    • Any disputes arising under these Subscriber Terms shall be dealt with in accordance with the dispute resolution provisions contained in the FIA NPC membership terms and conditions, as modified to reflect that the contractual relationship is with FIA Services.
    • Any notices required under these Subscriber Terms may be validly delivered by email to the addresses provided in the Subscriber’s application form, and such notices shall be deemed received on the day of transmission if sent during business hours.
    • The Subscriber may not assign, cede or transfer any of its rights or obligations under these Subscriber Terms without the prior written consent of FIA Services.
    • No variation of these Subscriber Terms shall be of any force or effect unless reduced to writing and signed by both FIA Services and the Subscriber.