SMBs Particularly Exposed to Rise in Privacy Litigation, Report Says

Small- and medium-sized businesses (SMB) are especially at risk of being struck by a new trend: a rise in cyber privacy litigation.

“Privacy risk is no longer just about data breaches,” said Andy Thomas, CEO of KYND.

A new report from the Austin-based cyber risk intelligence company said everyday website tracking and digital wiretapping have spawned an sharp increase in privacy lawsuits. Cases used to total in the hundreds per year. Now the tally has eclipsed 2,000.

“What may seem like a minor compliance issue is becoming a repeatable and scalable source of litigation, particularly across the SMB market,” Thomas added. “We’re seeing a shift toward claims driven by everyday website behavior. For insurers, this creates a new challenge. These risks are scalable, often hidden, and can accumulate across portfolios in ways that are difficult to detect without the right visibility.”

Claims focus on businesses’ collection and sharing of user data activity recorded when visiting a website. According to KYND, this data can be used to identify users without their consent–even without entering personal information. This data collection can be challenged under laws that do not require proof of financial harm, added KYND.

At a cyber conference held by Zywave late last year, panelists said insurers were re-evaluating broad privacy coverage within cyber policies to adjust to a rise in privacy litigation. Traditionally, coverage for privacy losses was triggered by a data breach, but regulatory changes in the U.S. and elsewhere have widened the exposure so much so that a breach doesn’t necessarily need to be the precursor for privacy litigation.

KYND’s research based on about 10,000 North American organizations found about 18% had tracking technologies operating with no visible user consent. The percentage is higher among SMBs, who use common website configurations and third-party tools for analytics and marketing pixel-trackers. KYND said SMBs are also more likely to be affected due to a combination of factors like default website tools and limited technical resources. Meanwhile, there is a growing use of legal frameworks by plaintiffs’ attorneys that allow claims to be brought at scale.

Privacy claims are high-frequency, low-severity occurrences but can accumulate into significant losses across an insurer’s portfolio since the same tracking practices are used by many businesses.

The risks are in plain sight, and using the data for underwriting and portfolio monitoring can identify exposures earlier to “differentiate risk more effectively, and avoid unwanted accumulation,” Thomas said.

Topics Lawsuits