New standard conditions for cyber insurance released by the German Insurance Association only partly eligible for the market

Cyber Germany
New standard conditions for cyber insurance released by the German Insurance Association only partly eligible for the market

The German Insurance Association (GDV) releases standard conditions for almost every standard insurance product in the German market. The standard conditions are developed in working groups which consist of representatives of the GDV member insurance companies. Even though these conditions are not binding, experience has shown that there is a trend that most of the wordings are similar to the GDV standard conditions.

An exception to this trend was the first release of the GDV standard conditions on D&O insurance. The market did not adapt the first version of these GDV conditions. The reason for this was that the conditions stipulated were triggered on a claims-made basis but in addition to that the action or omission which led to the damage had to occur in the insured period as well. The market, however, operated on a mere claims-made basis more favourable to insureds.

Just a couple of days ago, GDV published its standard conditions on cyber insurance for small to medium sized businesses with a revenue of 50 million Euro or 249 employees. Similar to what exists in the market, the GDV standard conditions grant coverage mainly for third-party liability damages and first-party losses arising from IT security breaches. However, the GDV standard conditions on cyber insurance could share the same fate as the first version of the GDV standard conditions on D&O insurance. One reason for that is the definition of the insured event.

In the German market the majority of cyber policies stipulates two different definitions for the insured event – one for the third-party liability and respectively another for the first-party loss cover. The GDV standard conditions, however, stipulate one insured event for both parts. Within the GDV standard conditions the insurance will be deemed to occur when the damage is verifiably identified for the first time. In other words: the manifestation of damage presents the insured event. The identification of the damage can be made by anyone, regardless of his or her relationship to the insured (e.g. experts, third party which suffered a damage or any other third person).

Moreover, to limit the insurer’s risk, the GDV standard conditions stipulate that cyber-events which have occurred before the policy was concluded may be excluded by limiting retroactive coverage.

Whereas within the first-party loss module, the GDV standard conditions’ definition of the insured event could lead to a harmonisation in the market, it is doubtful insurers will give up on the established claims-made definitions within the third-party loss cover.

The definition of the insured event for first-party losses has been quite fragmented in the German market so far. These differences may lead to dangerous gaps when changing insurers. There are policies under which the occurrence of damage is the insured event. Other policies stipulate the manifestation of the cyber-event as the insured event. The most restrictive option defines the insured event as the occurrence of the cyber-event itself, regardless of whether the occurrence has already been notified or could have been notified by anyone. If an insured moves from an insurance concept relying on the manifestation of a cyber-event towards a coverage stipulating the occurrence of the cyber-event as the insured event, coverage gaps might exist. This is true if a cyber-event that has occurred unnoticed in the earlier insurance period was only discovered when the new contract is already running. In this case, though gapless cover exists, the event itself would remain uncovered. If the new GDV standard conditions would set a benchmark, this problem could be overcome.

Contrary to that, the GDV standard conditions’ definition of the insured event for third-party losses is most probably not eligible to be adapted by the market.

First of all, it is highly doubtful whether the market will shift from the internationally established and largely unified claims-made cover towards a new and still unknown coverage concept. New wordings always entail the risks of being misinterpreted by courts.

Secondly, the GDV standard conditions have an ambiguous wording in the third-party loss module. It remains unclear if apart from the manifestation of damage, the third party claim has to be made during the insurance period as well.

To sum up, GDV standard conditions might have a positive impact on the fragmentation of the definitions of the insured event for first-party losses. However, the wording in the third-party liability module will most probably not be adapted by the market.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: