Cyber Crime and Cyber Terrorism

ICO NOTIFICATION
The regulation which is due to come into force in 2014 (possibly 2015) empowers 
each supervisory authority to impose administrative sanctions in accordance with the 
regulation and stipulates that within 24 h and provide a full report within 3 days of 
the event. The wording of Article 31 of the regulation states:
In the case of a personal data breach, the controller shall without undue delay 
and, where feasible, not later than 24 hours after having become aware of it, no-
tify the personal data breach to the supervisory authority. The notification to the 
supervisory authority shall be accompanied by a reasoned justification in cases 
where it is not made within 24 hours.
The regulation stipulates the information which is required and also the manner 
in which it should be reported. Furthermore, Article 79 (“Administrative Sanctions”) 

---

227
 
What does cyber liability insurance cover?
outlines the administrative sanctions the supervisory authority can levy against or-
ganizations who breach the regulations and states that the sanction 
“shall be in each 
individual case effective, proportionate and dissuasive”
(Article79.2). Article 79 of 
the regulation goes on to state that the amount of the administrative fine shall
be fixed with due regard to the nature, gravity and duration of the breach, the 
intentional or negligent character of the infringement, the degree of responsibil-
ity of the natural or legal person and of previous breaches by this person, the 
technical and organisational measures and procedures implemented [pursuant to 
Article 23] and the degree of cooperation with the supervisory authority in order 
to remedy the breach.
The above passage clearly indicates that organizations must be in a position to 
understand their risks and have clear understanding of how they are protecting them-
selves against these risks becoming incidents. The regulation goes on to stipulate the 
kinds of sanctions which the supervisory authority can impose and it is these sanc-
tions which organizations are becoming increasingly aware and concerned about, 
leading them to consider the uptake of some form of insurance which mitigates 
the increased risk of fines. These sanctions include fines of between 
€
250,000 and 
€
1,000,000 or between 0.5% and 2% of the annual worldwide turnover dependent 
upon the circumstances of the breach and the level of protection and mitigation that 
can be demonstrated.
As regulations therefore become more comprehensive businesses need not only 
to consider the most appropriate ways to improve their security controls (e.g., by 
adopting the international standard for information security, ISO27001:2013) but 
they must also look for ways to mitigate the potential losses from fines imposed by 
their local supervisory authority through the use of appropriate insurance.