The introduction of the General Data Protection Regulation (EU)
2016/679 ("GDPR") has raised data
protection to a board level issue, as companies are faced with
potentially vast fines in the event of an infringement of the
GDPR. This level of focus has also led to an increase in the
take up of cyber insurance policies. As the first fines are
imposed across Europe, a question will now be asked of insurance
companies: are GDPR fines actually insurable?
In January 2019, a fine of €50 million (the most
significant fine to be imposed under the GDPR regime to date) was
imposed by the French data protection authority (the CNIL) on
Google LLC. More recently on 8 July 2019, the UK Information
Commissioner's Office announced its intention to fine British
Airways £183.39 million (which will be the largest fine to
date under the GDPR regime if imposed) for infringements of GDPR
relating to a cyber-security incident which occurred in September
2018 and the following day (in
