Cyberinsurance and Small Business: when does it make sense?

As a data privacy expert who have spoken in a few
conferences, I sometimes need a break. One of the ways for me to clear my mind is participating in non-cybersecurity professional events. Recently, in one of such events, I ended up engaged in an enlightening discussion with the owner of a legal firm right here in North Carolina. Our conversation eventually led to the aspects of data security and privacy as applied to lawyers, which in turn led to a simple question: does a business need cyber insurance? It turns out the right answer is “it depends.” Let’s talk about it.

Is Cyber Insurance Legally Required for Law Firms in North Carolina?

There is no specific legal requirement for law firms in North Carolina to carry cyber insurance. However, certain laws mandate the implementation of reasonable security procedures to protect personal information. These include:

• North Carolina Identity Theft Protection Act (N.C. Gen. Stat. §§ 75-60 to 75-66): This law requires businesses to implement and maintain reasonable security procedures to protect personal information. While not mandating insurance, it creates a duty that cyber insurance could help address.
• North Carolina Consumer and Customer Information Privacy Act (N.C. Gen. Stat. § 75-65): This law mandates businesses to notify individuals in the event of a data breach.

Potential Costs of a Data Breach for a Law Firm in North Carolina

The costs associated with a data breach can be substantial, particularly for small law firms. While specific North Carolina data is limited, national reports provide insight:

• The North Carolina Identity Theft Protection Act mandates businesses to notify affected individuals in the event of a data breach, which can be costly.
• According to a 2023 IBM report, the average total cost of a data breach in the United States is $9.48 million. For small businesses, the average cost is $3.1 million as reported by Hiscox in 2023.

Average Cost of Cyber Insurance for a Small Law Firm in North Carolina

Though specific data for North Carolina law firms is not available, general data provides a useful benchmark:

• The average cost for small businesses is approximately $1,740 annually for $1 million in coverage with a $10,000 deductible.
• Law firms, considered high-risk, may face higher premiums. Costs can vary significantly based on factors like firm size, types of data handled, and security measures in place.

Specific North Carolina Laws Governing Data Protection for Law Firms

Key North Carolina laws that govern data protection include:

• North Carolina Identity Theft Protection Act (N.C. Gen. Stat. §§ 75-60 to 75-66): Requires businesses to implement reasonable security measures and notify individuals of data breaches.
• North Carolina Consumer and Customer Information Privacy Act (N.C. Gen. Stat. § 75-65): Focuses on the protection of consumer and customer information and mandates breach notifications.

Ethical Obligations for North Carolina Lawyers Regarding Data Protection

The North Carolina Rules of Professional Conduct highlight ethical obligations for lawyers concerning data protection:

• Rule 1.6(c): “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”

Potential Consequences of Not Having Cyber Insurance

While not having cyber insurance is not illegal, it leaves the firm exposed to significant risks and costs in the event of a breach. These could include:

• Notification Costs: Required by N.C. Gen. Stat. § 75-65, which can be substantial.
• Potential Fines: For non-compliance with state laws.
• Legal Defense Costs: If sued by clients.
• Reputational Damage: Resulting in loss of business and client trust.

Conclusion

While cyber insurance is not legally mandated in North Carolina, the financial risks of a data breach and the ethical obligations of lawyers make it a prudent consideration. The decision to purchase cyber insurance should be based on a careful risk assessment, considering the firm’s specific circumstances and the potential costs of a breach versus the cost of insurance.

References

1. Perkins Coie. Security Breach Notification Chart - North Carolina. Retrieved from Perkins Coie.
2. Insureon. Cyber Liability Insurance Cost. Retrieved from Insureon.
3. IBM. Cost of a Data Breach Report 2023.
4. North Carolina Bar. Rule 1.6: Confidentiality of Information. Retrieved from NC Bar.
5. Embroker. Do Law Firms Need Cyber Insurance?. Retrieved from Embroker.
6. AdvisorSmith. Cyber Liability Insurance Cost by Industry. Retrieved from AdvisorSmith.

By securing cyber insurance, you can safeguard your legal firm against the growing threat of cyber incidents, ensuring both financial stability and compliance with legal obligations.