Search

Brian Pennington

A blog about Cyber Security & Compliance

Month

May 2017

Technological Change and Cyber Risk Overtake Regulation as Top Risks for Insurers

The global insurance industry’s ability to confront structural and technological changes is now the greatest risk it faces, according to a new survey of insurers and close observers of the sector.

The CSFI’s latest Insurance Banana Skins 2017 survey, conducted with support from PwC, surveyed 836 insurance practitioners and industry observers in 52 countries, to find out where they saw the greatest risks over the next 2-3 years.

Insurance Banana Skins 2017 
(2015 ranking in brackets)
1 Change management (6)
2 Cyber risk (4)
3 Technology (-)
4 Interest rates (3)
5 Investment performance (5)
6 Regulation (1)
7 Macro-economy (2)
8 Competition (-)
9 Human talent (15)
10 Guaranteed products (7)
11 Political interference (16)
12 Business practices (11)
13 Cost reduction (-)
14 Quality of management (12)
15 Quality of risk management (10)
16 Social change (20)
17 Reputation (18)
18 Product development (17)
19 Corporate governance (21)
20 Capital availability (22)
21 Complex instruments (25)
22 Brexit (-)

Change management is at the head of a cluster of operating risks which have jumped to the top of the rankings. The report raises concerns about the industry’s ability to address the formidable agenda of digitisation, new competition, consolidation and cost reduction it faces, especially because of rapidly emerging technologies which could transform insurance markets, such as driverless cars, the ‘internet of things’ and artificial intelligence.

Cyber risk follows close behind, with anxiety rising about attacks on insurers themselves as well as the costs of underwriting cyber-crime. Other major concerns include the adequacy of insurer’s internal technology systems and new competition, particularly from the ‘InsurTech’ sector.

The next cluster of high-ranking risks, interest rates, investment performance and macro-economic risk, shows that concern about economic instability remains high. Although respondents acknowledged signs of growth, confidence in the recovery is not strong for reasons as widely dispersed as the slowdown in China, the risk of Trump-era protectionism, and populism in Europe. The risk of political interference was seen to have risen sharply. However, Britain’s exit from the EU was seen to be a minimal source of risk for insurers, particularly those without operations in the UK.

Regulatory risk, which has topped the last three editions of this survey, has fallen out of the top five this year. This is largely because recent regulatory changes are settling in to business as usual (e.g. Solvency 2), though the cost and complication of regulation continue to be a concern.

The report shows that the industry’s ability to attract and retain human talent is a fast-rising concern, particularly to handle the digital challenge.  Conversely, an area of declining risk is the governance and management of insurance companies. These were seen as high-level risks during the financial crisis but have fallen sharply since, because of both initiatives from the industry itself and regulatory pressure.

Overall, the climate for insurers is becoming more challenging, according to respondents. The 2017 Banana Skins Index, which measures the level of anxiety in the industry, is at a record high, while the industry’s preparedness to handle these risks has fallen from 2015.

David Lascelles, survey editor, said: “For the first time in six editions of this survey, operating risks pose the greatest threat to insurers. Structural and technological changes to the industry could upend traditional business models. At the same time, insurers are grappling with a very difficult economic climate, which helps explain why anxiety is at an all-time high.”

Mark Train, PwC Global Insurance Risk Leader, comments: “Both the challenges and opportunities presented by change underline the vital importance of being clear about where you’re best able to add value, and then being ruthless in targeting investment and management time at these priorities. A key part of this ‘fit for growth’ strategy is differentiating the capabilities needed to fuel growth, ‘good costs’ targeted for investment, from low-performing business and inefficient operations, ‘bad costs’ targeted for overhaul or elimination.”

Advertisements

Will GDPR Change the World?

Rob Luke’s keynote speech ‘Will GDPR Change the World?’.

Introduction

Thank you.

Let me take a moment to thank TechUK for putting together this event and for offering me the platform to speak with you this morning.

Our Commissioner, Elizabeth Denham, has been clear that the ICO’s vision – of increasing data trust and confidence among the UK public – can only be achieved by working in partnership with the private, public and third sectors.

An important part of that is developing key relationships with representative or umbrella organisations as multipliers and amplifiers for our engagement with different constituencies. Helping us reach new or hard-to-reach audiences.

Our strong relationship with Tech UK is a great example of that partnership approach.

We appreciate the role you play in bringing together representatives from across the sector and your ongoing constructive dialogue with us around issues of importance to your members and the sector as a whole.

I’m glad to have the opportunity to continue that dialogue this morning.

Will GDPR change the world?

Will the General Data Protection Regulation change the world?

Wow, what a question. On the face of it, even the most ardent data protection advocate would struggle to make a case that a blandly titled piece of European legislation deserves that billing.

So despite my professional obligation to emphasise the importance of data protection in the digital age, I am not going to make the argument for the world revolving around GDPR.

What I will try to do is highlight some of the opportunities and challenges GDPR brings for organisations.

Ultimately, of course, GDPR is an indicator of change as much as it is an instigator. And no sector is more relevant to that rapidly changing landscape than yours.

GDPR is part of the response to the challenge of upholding information rights in the digital age. Of protecting the rights and interests of the individual in the context of an explosion in the quantity and use of data and in an environment of extremely rapid technological change.

So I feel it is particularly relevant to mark One Year To Go in dialogue with the tech sector in particular.

I should be clear early on that this is not a speech about Brexit or an exploration of the UK’s possible post-Brexit data protection framework.

In a pre-election period, and with the need to adhere to the guidance on purdah, I hope you will understand that I am not in a position to speculate about the post-Brexit environment, nor indeed to comment on proposals in political party manifestos.

I apologise in advance if there are questions, or elements of the panel discussion, where I am limited by the caution that purdah requires.

What we can safely say however, is that one way or another, GDPR is going to be an important part of the global data protection landscape over the years ahead, with great relevance to UK organisations, the public and their data.

Fit for the digital age

The moment at which GDPR takes effect in the UK on 25 May 2018 will of course mark a change. In delivering legislation fit for the digital age GDPR confers new rights and responsibilities and organisations need to be working now to prepare for them.

I assume that this audience has a familiarity with the core features of GDPR and the key requirements it places on organisations. I hope you have already deployed our ’12 steps to take now’ guidance and our ‘Overview to GDPR’ and that you are drawing on our wider resources.

One consistent feature of our outreach with organisations is a high demand for granular guidance – often people will say to us: “tell us what we need to do”.

We are working at pace to produce detailed guidance, both at national level but also European level guidance produced by the Article 29 EU Working Party to which we are making a major contribution.

I will flag up some particular pieces of guidance in a minute, and the pipeline of guidance will continue to flow.

But I urge you not to wait, nor to take a reactive approach to your GDPR preparations, motivated solely by a mindset of compliance or risk management.

Those organisations which thrive under GDPR will be those who recognise that the key feature of GDPR is to put the individual at the heart of data protection law.

Thinking first about how people want their data handled and then using those principles to underpin how you go about preparing for GDPR means you won’t go far wrong.

Transparency and accountability

It can be boiled down to two words: “transparency” and “accountability”.

Being clear with individuals how their personal data is being used.

And placing the highest standards of data protection at the heart of how you do business.

An issue for the boardroom

That means this is an issue for board level, whatever the size of your business.

Not least because under GDPR the regulator wields a bigger stick. For the most serious violations of the law, the ICO will have the power to fine companies up to twenty million Euros or four per cent of a company’s total annual worldwide turnover for the preceding year.

And as we’ve seen in well-publicised examples the cost to business of poor practice in this area goes above and beyond any fine we can impose. Losing your consumers’ trust could be terminal for your reputation and for your organisation.

We would all prefer a win-win outcome. A model where organisations take an approach to data protection which earns the trust of consumers in a more systematic way. And where that trust translates into competitive advantage for those who lead the charge.

Nowhere does that feel more relevant than for your sector.

GDPR and the tech sector

The UK tech industry is at the forefront of our vibrant digital economy, changing how we live our lives and offering huge potential for positive change and wide social benefit.

Data is the fuel that powers that economy and tech companies are involved at every level.

GDPR is a response to this evolving landscape, building on previous legislation but bringing a 21st century approach and delivering stronger rights in response to the heightened risks.

The right of an individual to be informed about use of their data; their right to access their information and move that information around; the right of rectification and erasure of data where appropriate; the right to remove consent; and the right to enable automated decisions to be challenged.

Good practice tools that the ICO has championed for a long time – such as privacy impact assessments and ensuring privacy by design – are now legally required in certain circumstances.

The ICO covers privacy impact assessments in its existing Privacy by Design guidance and the European Article 29 Working Party has also issued draft guidelines.

Being transparent and providing accessible information to individuals about how you will use their personal data is another key element of the new law and our privacy notices code of practice is GDPR-ready.

Increased responsibilities for data processors are another feature. Data processors, companies using personal data on behalf of others, will have specific legal obligations to maintain records of personal data and processing activities.

Data breach reporting will also change under the GDPR. You’ll be obliged to notify the ICO, within 72 hours, of a breach where it is likely to result in a risk to the rights and freedoms of individuals.

The widespread availability of personal data on the internet and advances in technology, coupled with the capabilities of big data analytics mean that profiling is becoming a much wider issue.

People have legitimate concerns about surveillance, discrimination and the use of their data without consent.

Data protection can be challenging in a big data context and some types of big data analytics, such as profiling, can be intrusive.

We explore many of these issues in detail in our recently updated paper on big data, artificial intelligence, machine learning and data protection.

We’ve also recently published a consultation paper on profiling under GDPR to which TechUK has responded. We’ll be using this to feed into the European Article 29 Working Party guidelines.

Harnessing the benefits of big data, AI and machine learning, as it relates to healthcare for example, will be sustained by upholding the key data protection principles and safeguards set out in GDPR.

Whilst the means by which personal data is processed are changing, the underlying issues remain the same. Are people being treated fairly? Are decisions accurate and free from bias? Is there a legal basis for the processing? These will remain key questions for us as a regulator under GDPR as they have been under the DPA.

The GDPR is a principles based law well equipped to take on the challenges of 21st century technology.

It aims to be flexible – protecting individuals from harm while enabling you to innovate and develop services that consumers and businesses want.

Data analytics

As data becomes the fuel powering the modern economy, so it becomes a key element of many of the debates in modern society.

Take the announcement last week by Elizabeth Denham of her opening of a formal investigation into the use of data analytics for political purposes.

Given the big data revolution I have mentioned it is understandable that political campaigns are exploring the potential of advanced data analysis tools to help win votes. The public have the right to expect that this takes place in accordance with the law as it relates to data protection and electronic marketing.

This is a complex and rapidly evolving area of activity and the level of awareness among the public about how data analytics works, and how their personal data is collected, shared and used through such tools, is low.

What is clear is that these tools have a significant potential impact on individuals’ privacy. It is important that there is greater and genuine transparency about the use of such techniques to ensure that people have control over their own data and the law is upheld.

We will provide an update on that investigation later in the year.

Rising to the challenge

I’ve talked about some of the challenges and opportunities GDPR brings for organisations. Likewise it is a moment for us at the ICO to reflect on how we do our work.

Clearly there are practical aspects such as preparing for a higher volume of activity given enhanced breach notification requirements.

But we are thinking more widely than that.

One example, again with particular relevance for the tech sector, is how we might be able to engage more deeply with companies as they seek to implement privacy by design.

How we can contribute to a “safe space” where companies can test their ideas. How we can better recognise the circular rather than linear nature of the design process.

Separate but related we need to become more comfortable about recognising good practice and drawing on exemplars.

We should be able to find ways to give credit where credit is due without that translating into a free pass for an individual organisation or practice. GDPR explicitly foresees wider use of tools such as codes of conduct and certification schemes, which potentially have an important role to play.

To deliver on the above and more broadly we also need to build our own tech know-how and capability. We are working on a new Technology Strategy which will outline our means of adapting to rapid technological change as it impacts information rights.

We are also committed to exploring innovative and technologically agile ways of protecting privacy.

And of course we need to exercise global reach and influence. Effective protection of the UK public’s personal information becomes increasingly complex as data flows across borders.

The ICO will continue to develop and deepen effective relationships with our international partners, reacting to changes in the global regulatory environment.

These goals among others feature in our new Information Rights Strategic Plan, being launched today by Elizabeth Denham, which sets out the ICO’s plan for the coming four years.

The tech sector will be a priority for our engagement as we look to seize these opportunities set out in the strategy.

Conclusion

With 12 months to go until GDPR takes effect in the UK, I hope I have offered a brief insight into some of the implications and impacts of GDPR on UK businesses.

I hope I have also signposted key actions you should be taking and key tools on which you can draw to rise to the challenge.

GDPR brings big changes, important changes. But GDPR is an evolution of the existing rules, not a revolution.

And as I said at the outset it is also a mirror of the changes in the practices and environment it seeks to regulate.

It is not GDPR which is pushing data protection up the public, political and media agenda. It is the changing nature of the world in which we live, and the ubiquity of data, which is causing society to reflect on the consequences for our personal information and for privacy itself.

You are at the heart of that change. Your response to the challenges and opportunities of GDPR will set a marker for other sectors.

You have a major stake in the enterprise of increasing data trust and confidence among the UK public. By putting the individual in genuine control of their own data you can help achieve that goal, delivering benefits for your consumers, your business and society as a whole.

Thank you.

ICO statement on recent cyber attacks on the NHS

The ICO has released the following statement concerning the recent cyber attacks on the NHS:

“All organisations are required under the Data Protection Act to keep people’s personal data safe and secure.

“Following the news on Friday afternoon that many organisations had been the subject of a cyber attack, the ICO made contact with both NHS Digital and the National Cyber Security Centre (NCSC).

“Our enquiries will continue this week and we note that NHS England have said they have no evidence that patient data has been accessed.

“Any appropriate next steps for the ICO will decided once these initial enquiries are complete.

“The ICO has published a useful blog on how to prevent ransomware attacks.”

Blog at WordPress.com.

Up ↑

%d bloggers like this: