Outsourcing Global News

Archive for Legal Developments

Help Clients Insure Against Cyberattacks

This article was originally published in the July 22, 2013 issue of Texas Lawyer.

The constant threat of cyberattacks presents many and varying challenges for businesses. Insurance provides one way to deal with them. Because the market for insurance covering these risks and the law interpreting these policies both continue to develop, this is an area in which attorneys can help clients by maximizing their opportunity to secure the broadest possible coverage.

A look at federal and state action on cybersecurity risks provides some critical background. President Obama issued his Executive Order on Improving Critical Infrastructure Cybersecurity in February. In October 2011, the U.S. Securities and Exchange Commissions Division on Corporate Finance issued relevant guidance on financial-disclosure obligations concerning cybersecurity issues in CF Disclosure Guidance Topic No. 2 – Cybersecurity.

Texas law also imposes some key legal requirements on businesses. Texas Business & Commerce Code Chapter 521 imposes duties on companies to protect sensitive personal information collected or maintained in a company’s regular course of business and to notify affected individuals if the security of a computerized system containing that data is breached.

A look at cyberattackers also provides important perspective. Wrongdoers can target a company’s trade secrets or product-development pipeline for competitive, nationalistic or societal reasons. In addition, certain industries with a strong presence in Texas, such as energy, petrochemicals, transportation and technology, face particularly frequent attacks due to their unique characteristics and vulnerabilities.

When prevention efforts are insufficient, a data security breach often imposes first-party losses in the form of response costs and impacts on the company’s revenue stream. These can include expenses for detecting, investigating and eliminating the intrusion, notifying those affected by it, managing the company’s reputation and dealing with revenue impacts from damaged customer relationships. Third-party claims also can result, in the form of lawsuits and regulatory actions.

Because these issues touch on so many aspects of a company’s business, from negotiating vendor agreements to compliance to litigation, lawyers have many opportunities to help clients address these risks. Insurance coverage provides one such opportunity.

A company’s traditional insurance policies may offer at least some protection. In Retail Ventures Inc. v. National Union Fire Insurance Co. of Pittsburgh, PA (2012), the 6th U.S. Circuit Court of Appeals held that a “computer fraud” endorsement to a crime insurance policy covered more than $5 million in losses arising out of the illicit access to customer accounts stored in a retailer’s database. These losses included expenses for customer communications, public relations, customer claims, and investigations by multiple states and the Federal Trade Commission, as well as chargebacks, card reissuance costs, account monitoring and fines imposed by the credit card issuers.

The insurance industry’s offerings for specific cybersecurity policies also have grown rapidly in response to this threat. Just going through the process of applying for cyberinsurance can improve a company’s risk awareness. Large insurance brokers often use illuminating self-assessment questionnaires that pose dozens of queries on topics such as background checks, employee and contractor training, network security protocols, prior incidents and crisis-management procedures.

Attorneys will need to guide clients through varying policy options. Current cyberinsurance offerings lack the standardization that develops after court challenges refine policy language and the marketplace comes to accept that language.

Given the lack of industry-wide agreement on policy language, an “off the shelf” policy may be ill-suited to a particular business. Because the market is still developing, lawyers can have a greater impact in negotiating more favorable terms for a specific client’s unique needs. The policy should cover both first-party and third-party losses, as a cyberattack often triggers both.

Continue Reading →

Posted in: Author Morgan, Vince, Legal Developments, Privacy & Security

Leave a Comment (0) →

Are Your IT Costs Increasing Next Month? New Massachusetts Sales and Use Tax on Computer and Software Services becomes Effective July 31, 2013

On July 24th, 2013 the Massachusetts legislature passed An Act Relative to Transportation Finance (“the Act”), which, among other things, makes “computer system design services and the modification, integration, enhancement, installation or configurati…

Continue Reading →

Posted in: Author Williamson, Sean, Hot Topics in Outsourcing, Legal Developments

Leave a Comment (0) →

Payments Industry Update: European Commission announces regulation of Interchange Fees and a ban on Surcharges

Today the European Commission unveiled its legislative package to adapt the EU payments market to the opportunities of the single market and to support EU economic growth . The package includes a proposal for a cap on multilateral interchange fees (MIFs) for card-based payment transactions. MIFs are set by credit-card companies and collected by banks each time a consumer makes a purchase on a card. Fees across Europe vary widely, from less than 0.2% in the Netherlands to more than 1.5% in Poland. In addition, surcharges on consumer debit and credit cards will be banned by the new Payment Services Directive (PSD2). Surcharges are the extra charge imposed by some merchants for payments by card and, according to the Commission, are common notably for purchases of airline tickets online. In 95% of cases, merchants will no longer be allowed to surcharge consumers for using payment cards, whether for domestic or cross-border payments. This measure alone is set to save consumers 730m euro each year. So called ‘three-party schemes’ such as American Express and Diners, as well as commercial cards issued to businesses, which together account for the remaining 5%, are not covered by the surcharging prohibition. Retailers will be able to surcharge for these cards or refuse to accept them.

Introducing the legislative package, Michel Barnier, Internal Market and Services Commissioner, said “…the proposed changes to interchange fees will remove an important barrier between national payment markets and finally put an end to the unjustified high level of these fees.” Vice President Joaquín Almunia added “…interchange fees paid by retailers end up on consumers’ bills. Not only are consumers generally unaware of this, they are even encouraged through reward systems to use the cards that provide their banks with the highest revenues… the regulation capping interchange fees will prevent excessive levels of these fees across the board.”

MIFs have long been under regulatory scrutiny, with laws adopted in the United States, Australia and other countries, and several EC decisions under EU competition laws including the 2007 MasterCard case. Although included in a merchant’s cost of receiving card payments, regulators are concerned that interchange fees are ultimately passed through to consumers through higher prices amounting to tens of billions of euros each year. With Visa and MasterCard’s market share estimated at 96.8% in value, and with interchange fees already banned in countries such as Denmark and the United States, the Commission believes that regulation is required. This is despite the MasterCard case, the proceedings against Visa Europe (which lead to undertakings for consumer debit cards in 2010 and consumer credit cards in 2013) and a rash of other national competition proceedings.

Continue Reading →

Posted in: Author Wright, Tim, Legal Developments

Leave a Comment (0) →
Outsourcing Intelligence