Data breach costs include forensic IT review and legal review
Data breach costs start with a forensic IT review, to find out the nature and extent of the breach and the number and identities of affected individuals, and a professional legal counsel review of the breach and how the Member should respond. The forensic review does not cover analyzing system vulnerabilities, security-standard compliance, or damage to data that is not personally identifying or personally sensitive information. If there is reasonable cause to suspect a covered breach, the insurer pays for these two reviews even if it is later found there was no covered breach, but stops paying further costs once that is determined.
Supporting quotations
Data breach costs means:
Forensic IT Review
Professional information technologies review if needed to determine, within the constraints of what is possible and reasonable, the nature and extent of the data breach event and the number and identities of the affected individuals.
Vulnerabilities in systems, procedures or physical security;
Compliance with security standards; or
The nature or extent of loss or damage to data that is not personally identifying information or personally sensitive information.
If there is reasonable cause to suspect that a covered data breach event may have occurred, we will pay for costs covered under Forensic IT Review, even if it is eventually determined that there was no covered data breach event. However, once it is determined that there was no covered data breach event, we will not pay for any further costs.
Legal Review Professional legal counsel review of the data breach event and how a Member should best respond to it.
If there is reasonable cause to suspect that a covered data breach event may have occurred, we will pay for costs covered under Legal Review, even if it is eventually determined that there was no covered data breach event. However, once it is determined that there was no covered data breach event, we will not pay for any further costs.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Data Breach is among them.
Use & Processing · Context
Notification and services for affected individuals are paid only for necessary and reasonable costs
Data breach costs also include the Member's necessary and reasonable costs to notify affected individuals, and, only if the Member has given that notification, necessary and reasonable costs of services to those individuals. For any breach the services are informational materials and a toll-free help line. For breaches involving personally identifying information they also include a credit report and electronic credit monitoring (subject to the individual enrolling with the designated service provider) and identity restoration case management for individuals who are or appear to be identity theft victims arising from the breach.
Supporting quotations
Notification to Affected Individuals
The Member’s necessary and reasonable costs to provide notification of the data breach event to affected individuals.
This coverage only applies if the Member has provided notification of the data breach event to affected individuals as covered under paragraph c. above.
The Member’s necessary and reasonable costs to provide the following services to affected individuals.
A packet of loss prevention and customer support information.
A toll-free telephone line for affected individuals with questions about the data breach event.
(b) below.
The following additional services apply to data breach events involving personally identifying information.
A credit report and an electronic service automatically monitoring for activities affecting an individual’s credit records. This service is subject to the affected individual enrolling for this service with the designated service provider.
With respect to any affected individual who is or appears to be a victim of identity theft event that may reasonably have arisen from the data breach event, the services of an identity restoration professional who will assist that affected individual through the process of correcting credit and other records and, within the constraints of what is possible and reasonable, restoring control over his or her personal identity.
Identity theft event means the fraudulent use of social security number or other personally identifying information.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Data Breach is among them.
Services to affected individuals depend on the Member first notifying them under the notification coverage.
Use & Processing · Context
A data breach event involves information in the Member's or an entrusted professional's custody
A data breach event is the loss, theft, accidental release or accidental publication of personally identifying or personally sensitive information about one or more affected individuals, while the information is in the care, custody or control of a Member or of a professional entity the Member contracted with and entrusted with it. If the date of the breach cannot be determined, it is deemed to be the date the Member first became aware of the loss, theft, release or publication. For data breach coverage, personally identifying information means information (including health information) that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of an affected individual.
Supporting quotations
Data breach event
Data breach event means the loss, theft, accidental release or accidental publication of personally identifying information or personally sensitive information as respects one or more affected individuals. At the time of the breach, such information must be in the care, custody or control of:
A Member; or
A professional entity with whom a Member has a contract and to whom a Member has entrusted the information.
if the date of the data breach event as defined in a. above cannot be determined, such date shall be deemed to be the date a Member first become aware of the loss, theft, release or publication of the personally identifying information or personally sensitive information.
personally identifying information means information, including health information, that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of an affected individual.
Affected individual means any person whose personally identifying information or personally sensitive information is lost, stolen, accidentally released or accidentally published by a data breach event covered under the policy.
Personally sensitive information means private information specific to an individual, the release of which requires notification of affected individuals under any applicable law.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Data Breach is among them.
Use & Processing · Company commitment
Data Breach coverage pays reasonable and necessary data breach costs
If a data breach event happens as a direct result of a stolen identity event, the policy summary describes payment of the Member's reasonable and necessary data breach costs, which are the forensic, legal, notification and affected-individual services described in the definitions. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Data Breach
If there has been a data breach event as a direct result of such stolen identity event, we will pay the Member’s reasonable and necessary data breach costs.
Data breach costs means:
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule. The conditions add a pre-notification consultation duty that applies to this coverage.
Use & Processing · Procedure
Data breach pre-notification: consult the insurer, use its suggested service provider or an approved one
For Data Breach coverage, the Member agrees to consult the insurer before notifying affected individuals; the insurer assumes no responsibility for services promised to affected individuals without its prior agreement. The insurer suggests a service provider for notification and services; if the Member prefers an alternate provider, it must be approved by the insurer and payment will not exceed what the insurer would have paid using its suggested provider. At the consultation the Member provides contact information about the affected individuals, information about the breach that may appropriately be communicated, and the scope of services desired, which may be structured to provide fewer services to more people without exceeding the limit. Data Breach is marked "Not Included" for Surfshark One+.
Supporting quotations
The Member agrees to consult with us prior to the issuance of notification to affected individuals under coverage B.2.h. Data Breach. We assume no responsibility for any services promised to affected individuals without our prior agreement.
We will suggest a service provider for Notification to Affected Individuals and Services to Affected Individuals. If the Member prefers to use an alternate service provider, our coverage is subject to the following limitations:
Such alternate service provider must be approved by us; and
Our payment for services provided by any alternate service provider will not exceed the amount that we would have paid using the service provider we had suggested.
The Member will provide us and the service provider the following at our pre-notification consultation with the Member:
Requested information about the affected individuals to be notified, including contact information;
Information about the data breach event that may appropriately be communicated with affected individuals; and
The scope of services that the Member desires for the affected individuals. For example, coverage may be structured to provide fewer services in order to make those services available to more affected individuals without exceeding the available limit of coverage.
Qualifications & exceptions
The Schedule marks Data Breach "Not Included" for Surfshark One+.