The Growing Concern: Privacy Lawsuits
Privacy lawsuits are becoming a significant concern for underwriters and actuaries as claims frequency rises and premiums continue to drop. Joe Earl, Cyber Group Practice Leader at C3 Risk and Insurance, describes the market as "very unhealthy." The gap between what policyholders believe they're covered for and what is actually covered is widening, especially regarding privacy claims. Let's explore the key questions and data surrounding this issue.
Why Are Privacy Claims Increasing?
There's been a notable rise in privacy claims, with AT-Bay reporting a 70% increase in pixel and wrongful collection lawsuits. These claims aren't about breaches but rather class actions alleging unauthorized data collection or improper consent. For example, the Kado settlement reached $1.8 million, while Kaiser's was $48 million. These aren't minor settlements; they're significant losses driven by plaintiff firms targeting tracking pixels on healthcare portals.
Policyholders often assume their Stand-Alone Cyber Policy covers these claims because they seem cyber-related. However, many wrongful collection sublimits were set when such claims were rare. If you haven't adjusted for a 70% annual increase in this category, you're not adequately prepared for current exposures.
Are Pixel Lawsuits Covered?
Coverage for pixel lawsuits varies by carrier and policy form. Some insurers cover these claims under wrongful collection provisions, while others exclude them through endorsements. This inconsistency poses two problems: you can't compare loss ratios across carriers, and policyholders remain uncertain about their coverage until a claim is filed.
If your underwriting guidelines don't explicitly address pixel liability, you're making coverage decisions on a case-by-case basis rather than managing risk across your portfolio.
Pricing for New Exposures
Without sufficient loss history for privacy claims, traditional Frequency-Severity Modeling is challenging. However, public settlement data and industry insights can guide you. Healthcare entities with patient portals face higher pixel exposure than other industries. Policyholders using tools like Meta Pixel or Google Analytics on sensitive data pages should be scrutinized.
Consider asking if they've conducted a pixel audit recently, if their privacy policy addresses third-party tracking, and if they've implemented server-side tagging to minimize data leakage. These factors should influence your Rate on Line calculation.
Using AI Tools in Underwriting
AI tools are already part of your underwriting process, whether you're aware of it or not. They provide quick insights into a company, but the key is using them systematically. If one underwriter uses AI-enhanced tools and another doesn't, you're introducing bias.
Treat AI tools as part of your decision-making process, not a substitute for judgment. Document which tools you're using and how they affect pricing. This documentation will be crucial when your actuary evaluates next year's rate filing.
AI as Both a Threat and Defense
AI is a double-edged sword in cybersecurity. It can enhance detection speed but also introduces new risks if not fully understood. Determine if your policy's Cyber Maturity Assessment credits AI-enhanced detection or penalizes AI adoption due to potential risks.
Ask if applicants use AI tools from established vendors and if their incident response plans account for AI-driven attacks. A consistent framework is essential.
Preparing for Market Changes
The market is expected to reach a $30 billion cap by 2030, but the path won't be smooth. Expect more exclusions and specialized policies for specific risks like pixel liability or AI discrimination claims. This fragmentation complicates your role but also allows for more defensible pricing.
Start by separating breach-related and privacy-related claims in your loss data. This distinction will help demonstrate your understanding of coverage to regulators and reinsurers.
Next Steps
Review your policy forms to determine if pixel lawsuits are covered under wrongful collection. If your form is silent, you might be making unintended coverage promises. Consult your claims team to ensure their handling of these losses aligns with your underwriting intent. Document your use of AI tools in underwriting before your actuary requires it for the next rate filing.
