MOLITOR AVOCATS A LA COUR – GDPR : Insurability of administrative sanctions

Article written by Molitor Avocats a la cour as part of their sponsorship of ACA Insurance Days 2022.

In the context of a cyber-risk insurance policy, MOLITOR Avocats à la Cour’s insurance law experts present the reasons why administrative fines issued by the National Commission for Data Protection should be considered as criminal sanctions and therefore currently uninsurable under Luxembourg law.

Are fines imposed by the National Data Protection Commission for breach of data protection regulations insurable?

There is no shortage of recent examples of cyber-attacks[1] and the COVID-19 pandemic as well as the Russian-Ukrainian conflict have undoubtedly provided a playground for cybercriminals[2]. While such attacks can be devastating for a company and paralyse its operations, they can also be accompanied by personal data breaches within the meaning of the General Data Protection Regulation[3] (GDPR) that may give rise, on the one hand, to an investigation on the protection of personal data carried out by the competent administrative authority and, on the other hand, to pecuniary sanctions at the end of that investigation.

In Luxembourg, the National Commission for Data Protection (NCDP) has in particular [4] the power to impose substantial administrative fines in the event of a breach of the applicable data protection regulations, the amounts of which may be as high as EUR 20 million or 4% of a company’s annual turnover, whichever is higher[5].

Given the level of fines and the economic stakes for businesses, the question of insurability of such fines is of definite practical interest. While there has been the development of so-called “cyber-risk” insurance contracts whose purpose goes well beyond compensation for damage suffered by the insured and/or caused to third parties, but also aim to offer a genuine crisis management solution, an analysis of existing clauses shows a certain hesitation on the part of insurers to offer cover of financial penalties imposed by an administrative authority.

By way of illustration, an extract from the general terms and conditions of a cyber-risk insurance issued by a Luxembourg provider concerning this issue states:

“DATA PROTECTION FINES

The insurer will pay to or on behalf of any insured all data protection fines which are legally insurable in the most favourable jurisdiction, and that the insured is legally liable to pay upon the conclusion of a regulatory investigation by a regulator for an infringement of the data protection legislation”.

By referring to an expression such as “which are legally insurable in the most favourable jurisdiction” in the context of fines imposed by an administrative authority, the insurer thus intends to protect itself against legislation, or even case law, which would enshrine the uninsurability of such sanctions.

The question of whether the hesitation of the insurers is well-founded requires a review of the applicable laws and related case law.

Under Luxembourg law, insurance contracts are governed by the amended law of 27 July 1997[6] which is itself based on the Belgian law of 25 June 1992 on non-marine insurance contracts[7]. Both Luxembourg and Belgian laws are silent on the question of the insurability of administrative fines.

Only the principle of the uninsurability of criminal sanctions is expressly provided for in Article 97[8] which states: “No fine or penal transaction can be the subject of an insurance contract, except for those which are borne by the civilly liable person“.

This prohibition to insure such fines is a matter of public policy and derives from Article 6 of the Luxembourg Civil Code which provides that: “No derogation may be made, by special agreements, from laws which concern public order and morality“. As the specific doctrine clearly expresses it, “When, traditionally, it is explained that insurance cannot run counter to criminal sanctions, it is because in this case it would call into question the personal scope of criminal sanctions, which are a matter of public policy embodied here by the decisions of the public service of justice. (…) Fines imposed by a criminal court and the related costs are never covered by insurance, as there is a public policy prohibition on compensating criminal debts. Indeed, these debts are personal and are therefore attached to the convicted person, who is the only person who can pay them”[9].

It is also on the basis of this same ground of violation of public order that the majority of case law and doctrine have traditionally concluded that administrative sanctions are in principle uninsurable.

In this respect, two decisions of the French Court of Cassation^[10] have been interpreted by certain French authors^[11] as adding a nuance to this categorical view: according to these authors, public policy is no longer the basis to be taken into account in order to exclude the insurability of such fines, but rather – in the context of the 2012 judgment – the criterion of the intentionality of the act and, in the context of the 2019 judgment, the criterion of the insured’s knowledge of the loss prior to the conclusion of the insurance contract.

In other words, pursuant to this case law, administrative penalties would no longer be “uninsurable per se, but would be so only if the act giving rise to them was committed intentionally. One could then consider a policy that would stipulate that only administrative sanctions that did not result from an intentional fault would be covered. It is indeed theoretically possible to have an administrative sanction without intentional fault“^[12].

In this spirit, administrative fines would therefore be insurable provided that the infringement giving rise to such sanctions was not intentional, respectively that the insured was not aware of the wrongful acts that gave rise to the administrative proceedings before concluding the insurance contract.

Other authors^[13] firmly reject giving such a scope to these judgments: “In these two judgments, questions of insurance (intentional fault, knowledge of the loss) were dealt with; but the substantive question of the validity of the insurance of an administrative sanction was never raised and therefore not answered. It does not seem possible (…) to interpret these judgments in the sense of a possible insurability of administrative sanctions based on unintentional faults. As the law stands, it must therefore be concluded that administrative fines and any financial penalty are uninsurable. A clarification of the texts in the sense of the uninsurability of these administrative pecuniary sanctions seems desirable in order to put an end to the uncertainties which remain in many insurance contracts envisaging the insurability of administrative sanctions, but within the limits permitted by the law”^[14]. 

A similar debate on this topic has not yet taken place in Luxembourg, to the best of our knowledge, either in doctrine or case law. However, on reading the Luxembourg law on insurance contracts, a vision of openness (as defended by certain French authors) in favour of the insurability of administrative fines (under certain conditions) has not automatically been rejected. As we have seen above, the law does not in any way regulate the question of the insurability of administrative penalties. It nevertheless declares the consequences of intentional or fraudulent fault uninsurable by stating that “Notwithstanding any agreement to the contrary, but without prejudice to Article 103 point 1, the insurer may not be required to provide cover in respect of any person who has caused the loss intentionally or fraudulently“^[15]. Similarly, it concludes that the insurance contract is null and void if, at the time the contract is concluded, the risk has already occurred^[16]. The deliberate or non-contingent nature of an intentional or fraudulent breach as well as in the event of knowledge of the claim prior to the conclusion of the contract explains the penalty imposed by the legislator.

Even considering that the French Court of Cassation may have wanted to pave the way and to rule in favour of the insurability of certain administrative fines or, at the very least, the rejection of the systematic uninsurability of such sanctions, it seems to us that another element must be taken into account before a conclusion can be reached concerning the particular case of fines imposed by the NCDP.

As indicated above, Luxembourg law enshrines the uninsurability of criminal sanctions. Consequently, if, by its nature, the sanction imposed by the NCDP is of a criminal or quasi-criminal nature, it could not be covered by insurance.

According to the GDPR, it is necessary that the sanctions provided for are “effective, proportionate and dissuasive” (Articles 83 and 84).

To our knowledge and to date, there is no normative text or case law dealing specifically with the (quasi-)criminal or non-penal nature of an administrative fine imposed by the NCDP[17].

In order to determine whether or not an administrative sanction – such as that imposed by the NCDP – is of a (quasi-)criminal nature, an analysis of the so-called “Engel” criteria identified by the European Court of Human Rights[18] and used to determine, on the one hand, what actually falls within the scope of a criminal charge and, on the other hand, what the scope of the ne bis in idem principle[19] is, is relevant. These three criteria are as follows:

• the classification of the offence under national law;
• the nature of the offence; and
• the degree and severity of the sanction.

In this respect, we can only agree with the analysis made by the doctrine with regard to the GDPR: “as explained by the doctrine based in particular on the Grande Stevens v. Italy case law of the European Court of Human Rights, the sanctions provided for in the Regulation meet these three criteria, since the sanctions are administrative sanctions under the Regulation, they are intended to have a deterrent and repressive effect and to protect the general interest, and the amounts of the fines reflect an undeniable severity. These elements sufficiently convince of the penal nature of the sanctions provided for by the Regulation, at least of the fines. It follows that the administrative fines imposed by the NCDP should be subject to some of the procedural guarantees applicable in criminal matters (…)“[20].

The financial measures imposed by the NCDP, in that they meet the three Engel criteria and are therefore of a criminal nature, must therefore be subject to the same rules and principles as those governing criminal sanctions. This leads us to conclude that they are uninsurable under Luxembourg laws currently in force^[21].

Michel Molitor

Managing Partner – MOLITOR Avocats à la Cour

Michel.molitor@molitorlegal.lu

Virginie Liebermann

Counsel – MOLITOR Avocats à la Cour

Virginie.liebermann@molitorlegal.lu

Ariane Wourwoukas

Senior Associate – MOLITOR Avocats à la Cour

Ariane.wourwoukas@molitorlegal.lu