The State of Complex Claims: Data Privacy Legislation and Lawsuits in the Digital Age 

Five Takeaways on the Current and Future State of Cyber Claims

by Linda Comerford , Head of Claims, North America

The ever-evolving landscape of technology is constantly pushing the boundaries of cyber insurance claims. While advancements in tech bring exciting possibilities, outdated legislation is struggling to keep pace. This creates a murky environment where data breaches can quickly morph into complex legal battles.

As the US Claims Operation Lead at Resilience, I’ve seen firsthand the complexities that come with managing modern cyber incidents. From ransomware to deep fake frauds, the threats are continuously evolving, demanding a proactive and informed approach to incident response and risk mitigation. Below are five key insights from my recent panel, “Back to the Future: A Roadmap for the Current & Future State of Cyber Claims,” at last week’s Complex Claims & Litigation Forum, offering a glimpse into the future of cyber claims management.

1. Lawsuits are a growing cost of ransomware and BEC.  

Cyber insurance claims arise from various situations, and understanding the triggers allows for better risk mitigation. Ransomware remains the top culprit, responsible for a staggering 81% of claims involving recovery expenses. However, the financial burden extends beyond data recovery. Legal action – including lawsuits, settlements, and class actions – is becoming increasingly commonplace following major breaches. In 2023, data breach class action filings reached record highs.

It’s not only ransomware incidents that are leading to lawsuits. Business email compromise (BEC) attacks are also leading to more litigation as their impact intensifies. Likewise, the liability in wire transfer losses is often complex, leaving victims with limited legal support. While cyber insurance can help offset the cost of a legal suit, it can rarely cover the entire cost.

Lawsuits are an unpredictable and significant cost of data privacy incidents, and they are likely to grow in prevalence as high-profile breaches receive more media attention. 

2.  New Tech, New Risks, New Lawsuits

The introduction of Artificial Intelligence (AI) has the cybersecurity community on high alert. AI-powered human-engineering attacks are becoming more sophisticated, tricking victims into divulging sensitive information that could spark litigation from both clients and other businesses.

Deepfakes and voice spoofing further complicate matters. These technologies lack a legal framework for detection and use, potentially leading to a surge in cyber breaches, claims, and data privacy lawsuits as AI’s influence grows. There is hope for new legislation in the future. In the meantime, AI is predicted to lead to an uptick in cyber breaches, claims, and data privacy lawsuits. 

The cyber-world is entering into the unknown regarding these new technological capabilities. However, the lack of modern legislation is not unique to AI. Most new technologies lack updated legislation to define the parameters of usage and data privacy, and old laws are being relied on to guide data privacy lawsuits. 

3. Outdated Laws vs. Cutting-Edge Tech: A Recipe for Disputes

The rapid pace of technological advancement dwarfs the glacial speed of legislative reform. This means most data privacy lawsuits rely on outdated laws that are ill-equipped to handle modern complexities. 

Consider the Video Privacy Protection Act (VPPA), which was established in 1988 for a pre-internet world that could never have imagined the introduction of social media. Now, courts interpret “video tape service providers” more broadly, encompassing companies offering recorded video content online. 

Take, for example, the class action lawsuit filed against Chick-fil-A, alleging they allowed a Facebook tracking pixel to monitor users’ video-watching behavior. The data sharing between the organization and Facebook breached the VPPA by sharing unique ID numbers that Facebook was able to use to identify users and send them targeted ads. 

Online tracking is a legal grey area, and several lawsuits have alleged VPPA violations over the past few years. Organizations must be mindful of what data they collect and how that data is used and more carefully consider what data they allow to be tracked when browsing online. 

4. Arbitration: A Streamlined Solution

As data privacy issues are increasingly brought into the courtroom, another less procedurally complex solution is growing in popularity. Arbitration offers an alternative dispute resolution that can be carried out in private, which means a simplified, less expensive, path to resolving conflicts. In an arbitration, lawyers for both sides present evidence to an independent party to make a well-informed and legally binding decision.  

Arbitration clauses are often included in large business contracts to establish a clear pathway for dispute resolution. For B2B and third-party businesses, an arbitration clause can be a preemptive strategy that keeps disputes out of a courtroom. Though arbitration is traditionally for businesses interacting with each other, individuals can contribute to mass arbitration regarding data privacy issues. 

Arbitration offers greater privacy than public lawsuits, which can minimize reputational damage and resolve disputes more quickly and confidentially.

5. Avoid Dispute: being mindful of how your organization uses and stores client data

While filing a claim is a great way to recover financially from an incident, avoiding one altogether is preferable. The best way to prevent a claim is to prevent an incident in the first place. Though cyber incidents are unpredictable, being mindful and following data privacy legislation is an easy step to help organizations avoid costly lawsuits. 

Resilience: Your Partner in Complex Claims

If you should experience an incident, navigating communications post-event requires experienced counsel to create a clear and succinct narrative. Oversharing can open the door to potential lawsuits if the public is made aware of details that were provided improperly. Likewise, expert guidance can help organizations mitigate reputational damage, resolve the incident more quickly, and offer guidance should the need for legal action or arbitration arise.

At Resilience, our expert claims team works hand-in-hand with our clients to keep claims from turning into complex litigation scenarios. When a complex situation is unavoidable, we offer access to a tailored network of forensics and legal experts who can help to navigate any challenges with old legislation, arbitrations, and more.

You might also like

Seven Essential Steps to Vulnerability Management: Learnings from the Ivanti Exposures  

In light of the most recent Ivanti vulnerability, the importance of a robust vulnerability management strategy and incident response plan has never been clearer.  The Ivanti vulnerabilities, particularly CVE-2024-22024, unveiled on February 8th, 2024, serve as a stark reminder of the relentless nature of cyber threats. These vulnerabilities, which allow unauthenticated, remote attackers to access […]

Five Predictions on the State of Cyber Claims in 2024

Unravel the complexities of cyber risk with the 2023 Mid-Year Claims Report by Resilience. Dive into our analysis and predictions for the cyber insurance industry in 2024, including the pivotal role of AI and regulatory changes.

Knowing Your Risk Surface: A Risk-Focused Approach to Incident Response

After decades of more damaging and less predictable cyber attacks, modern cybersecurity practitioners have recognized the critical need to incorporate more risk-based approaches to their planning efforts. However, despite the continuing advances within the cybersecurity field, analytics firms are noting record years for cybercriminals and breaches against some of the most well-defended organizations in the […]

Top Three Trends on Cyber Resilience from The World Economic Forum

With generative AI dominating the conversation at the World Economic Forum’s annual meeting in Davos this year – a massive 32 sessions in total – it’s easy to overlook another topic that was the focus of WEF’s 2024 Global Cybersecurity Outlook: Cyber Resilience.  The term has taken on a new importance in 2024 as enterprise […]

Do you Need Human Brains to make AI Useful in Cybersecurity?

As the world advances with data processing and artificial intelligence (AI) capabilities at a mind-boggling pace, we might feel as if humans are becoming obsolete. This is certainly the question of an endless series of articles that have clogged our inboxes since the release of ChatGPT publicly in late 2022. Maybe this development is a […]

Mastering Cyber Resilience

Cyber Resilience 101, 202, and accompanying Cyber Resilience Workshops are designed to teach brokers the fundamentals of proactive cyber risk management