Fines And Penalties: Are They Insurable In California?

California's Consumer Privacy Act (CCPA) has raised questions about the insurability of fines and penalties imposed by the Attorney General for non-compliance. While the CCPA does not define what constitutes a violation, the Attorney General can seek financial penalties and injunctive relief for breaches, with fines ranging from $2500 to $7500 per violation. The insurability of these fines is uncertain, with California Insurance Code Section 533 precluding coverage for losses caused by willful acts. Case law and public policy arguments also suggest that insuring against fines or penalties imposed by law may be considered void under California law. However, broad regulatory coverage for civil fines and penalties is a feature of many cyber insurance policies, and the specific circumstances of each case will determine whether coverage is provided.

Explore related products

California Life and Health Insurance License Exam Prep: Updated Yearly Study Guide Includes State Law Supplement and 3 Complete Practice Tests

$29.95 $29.95

California Property and Casualty Insurance License Exam Prep: Updated Yearly Study Guide Includes State Law Supplement and 3 Complete Practice Tests

$29.95 $29.95

Fin

$5.99

Fin

$32.98

The Longest Week / Une Semaine Sans Fin

$9.89

Un jour sans fin - Edition collector [Import belge]

$47.28 $19.99

California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) was enacted in 2018 to protect the personal information of California residents, including individuals, households, employees, job candidates, and business contacts. The CCPA grants California residents the right to know what personal data is being collected about them, whether their personal data is being sold or disclosed and to whom, and the right to request that a business delete any personal information about them. It also grants consumers the right to opt out of the sale of their personal information and protects them from being discriminated against for exercising these rights.

The CCPA applies to any business that collects consumers' personal data, does business in California, and meets at least one of the following criteria: annual gross revenues of over $25 million, buys, receives, or sells the personal information of 100,000 or more consumers, or earns more than half of its annual revenue from selling consumers' personal information.

Businesses that fall under the CCPA are required to implement and maintain reasonable security procedures and practices to protect consumer data. They must also provide required public notices, honor consumer rights requests, and ensure non-discrimination in their practices.

The CCPA is enforced by the California Attorney General (CAG) and the California Privacy Protection Agency (CPPA). The CAG has the power to investigate violations and seek civil penalties of up to $2,500 for each unintentional violation and $7,500 for each intentional violation. The insurability of these civil fines has been a significant concern since the CCPA's enactment. While some insurance policies may cover civil fines, it is argued that indemnifying against fines or penalties imposed by the CAG would be contrary to public policy and considered void under California law. This view has not been tested by U.S. courts specifically in the context of the CCPA, but it is likely that such fines or penalties would not be considered "insurable by law" under California law.

To guard against regulatory risks, businesses can consider cyber insurance as a part of their risk management strategy. Cyber insurance can help protect businesses from Internet-based risks, but it is important to carefully review the terms of the policy to ensure coverage for potential risks.

Explore related products

Fin de partie

$67.86

The Fines Hours (Blu-ray 3D) (Single Disc) (2016)

$89.99 $10.88

Red One

$14.99

Kill Me Again

$3.99

Sans Fin [DVD - MK2]

$13.47

Fin de Semana

$1.99

Civil fines and penalties

The California Consumer Privacy Act (CCPA) permits the Attorney General to bring a civil action in the name of the people of California to enforce the CCPA. Civil penalties under the CCPA range from $2,500 for each unintentional violation to $7,500 for each intentional violation. The CCPA does not define what constitutes a "violation", but it is likely that the Attorney General will use the same system and rules that are used to enforce the 2003 California Online Privacy Protection Act (COPPA). Under COPPA, each instance where a person's personal information is processed in violation of the Act will represent an independent violation. The risk of incurring fines for non-compliance will therefore depend on the number of California residents whose personal information is processed.

There is no definitive answer as to whether civil fines and penalties are insurable in California. Some sources suggest that certain insurance policies tend to exclude fines and penalties unless they are "insurable by law". Additionally, California Insurance Code section 533 precludes coverage for losses caused by the willful acts of the insured. In particularly egregious situations, a fine may be considered punitive in nature, triggering a punitive damages exclusion. However, broad regulatory coverage, including civil fines and penalties, is an important feature of many cyber insurance policies. These policies may grant coverage for civil fines unless the fine is uninsurable under the law of the jurisdiction imposing it.

The legislative history of section 533.5 suggests that its purpose was to prevent insurers from providing a defense in civil and criminal actions brought by the Attorney General. Despite this, it remains unclear whether section 533.5 represents a "fundamental public policy" of California, which could preclude coverage for civil fines not directly covered by that section. There is case law to support the idea that, as a matter of public policy under California law, one cannot insure against fines or penalties imposed by law. However, this view has not been tested by U.S. courts specifically in the context of the CCPA.

In addition to civil penalties under the CCPA, there are various other civil penalties that may be assessed under California law. For example, civil penalties may be assessed for violations of permit requirements, failure to report serious injuries or illnesses, or violations of occupational safety and health standards. These civil penalties are typically adjusted based on factors such as the size of the business, good faith efforts, and history of violations.

Public policy

California Insurance Code section 533.5 prohibits "any policy of insurance providing, or being construed to provide, coverage or indemnity for the payment of a fine, penalty, or restitution in any civil or criminal action brought by the Attorney General, district attorney, or city attorney regardless of what the policy says". This statute was enacted to hold individuals personally accountable for behaviour constituting unfair business practices or false and misleading advertising.

The California Legislative Counsel's Digest indicates that the assembly bill that became Insurance Code section 533.5 would prohibit any policy of insurance from providing coverage for fines or penalties. This is in line with the state's public policy, which considers such coverage to be contrary to the goal of holding individuals accountable for their actions.

Additionally, California Insurance Code section 533 precludes coverage for losses caused by the willful acts of the insured. In certain circumstances, the insured's acts may trigger an intentional acts exclusion, and a fine might be considered punitive in nature, triggering a punitive damages exclusion.

There is also case law in California that supports the idea that, as a matter of public policy, one cannot insure against fines or penalties imposed by law. For example, in Bulluck v. Maryland Casualty Company and Allen v. Steadfast Insurance Company, the courts held that insurance provisions that indemnify the insured against fines or penalties would be contrary to public policy and considered void under California law.

However, it is important to note that not all fines and penalties are uninsurable in California. Some cyber insurance policies, for example, may provide coverage for civil fines unless they are specifically excluded by law. Additionally, some policies may apply the law of the jurisdiction issuing the fines, which could allow for insurability in certain circumstances.

Cyber insurance

The CCPA imposes civil penalties for violations, ranging from $2,500 for each unintentional violation to $7,500 for each intentional violation. While the CCPA does not define what constitutes a "violation", it is likely that the Attorney General will use the same system as the 2003 California Online Privacy Protection Act (COPPA). This means that each instance of processing a California resident's personal information in violation of the law will be considered an independent violation, increasing the risk of substantial fines for non-compliant businesses.

The insurability of these civil fines and penalties under the CCPA has been widely debated. Some argue that indemnifying the insured against such fines or penalties imposed by the Attorney General would be contrary to public policy and considered void under California law. This interpretation is supported by case law, including Bulluck v. Maryland Casualty Company and Allen v. Steadfast Insurance Company. Additionally, California Insurance Code section 533 precludes coverage for losses caused by the willful acts of the insured.

However, it is important to note that the legislative history of relevant statutes, such as section 533.5, indicates that the purpose was to preclude insurers from providing a defense in civil and criminal actions brought by the Attorney General. The specific applicability of section 533.5 as a "fundamental public policy" of California, which would preclude coverage for civil AG fines, remains uncertain.

Broad regulatory coverage, including civil fines and penalties, is a common feature of many cyber insurance policies. These policies address insurability through choice of law and choice of venue. Some policies permit coverage unless the jurisdiction imposing the penalty forbids it, while others allow coverage if the most favorable applicable venue permits it. Additionally, certain cyber insurance policies may provide coverage for costs incurred during a governmental investigation related to a claimed violation.

When considering cyber insurance coverage for CCPA-related fines, it is essential to carefully review the relevant jurisdiction's laws and the specific terms of the insurance policy. Consulting with knowledgeable personnel in risk and legal departments can also help clarify the extent of coverage and address any concerns regarding fines and penalties.

California Insurance Code

The California Insurance Code (CIC) is maintained by the California Legislative Counsel Bureau and contains all the laws relating to insurance in California.

The insurability of civil fines imposed by the California Attorney General under the California Consumer Privacy Act (CCPA) has been a significant concern since the CCPA's enactment in 2018. The CCPA does not define what constitutes a "violation", but the Attorney General will likely use the same system as the 2003 California Online Privacy Protection Act (COPPA). This means that each instance of processing a California resident's personal information in violation of the COPPA will constitute an independent violation. The risk of incurring fines for non-compliance depends on the number of California residents whose personal information is processed. Fines under the CCPA range from civil penalties of up to $2,500 for each unintentional violation to up to $7,500 for each intentional violation.

There is a compelling argument that provisions in insurance policies that indemnify the insured against fines or penalties imposed by the Attorney General would be contrary to public policy and considered void under California law. Case law supports the idea that, as a matter of public policy under California law, one cannot insure against fines or penalties imposed by law. This view has not been tested by U.S. courts specifically in the context of the CCPA, but it is likely that at least under California law, this type of fine or penalty is not "insurable by law".

Additionally, California Insurance Code section 533 precludes coverage for losses caused by the willful acts of the insured. In egregious situations, a fine might be considered punitive, triggering a punitive damages exclusion.

Frequently asked questions