Insurance Act: Let's pretend

A year ahead of the implementation of the Insurance Act 2015, a mock trial has been staged to explore how the new legislation will play out. The British Insurance Law Association used a fictitious case about cyber to demonstrate some of the most significant changes that will be introduced in August 2016: fair presentation of risk (Part 2 of the Act) and warranties and terms not relevant to the actual loss (Part 3).

The Right Honourable Lord Mance presided as judge at the mock trial, assisted by myself. Two silks – Derrick Dale QC of Fountain Court Chambers and Alistair Schaff QC of 7KBW Chambers –  and two junior barristers – Ben Lynch of Devereux Chambers and Harry Wright of 7KBW Chambers – acted as counsel.

The case focused on ‘Discrete’, a wealth manager who took out a policy with ‘Trusted’, an underwriter, through ‘Mrs Brau-Kerr’, a broker, to cover losses arising from the hacking of Discrete’s IT system. At the time the policy was taken out, Mrs Boss of Discrete had told Mrs Brau-Kerr and Mr Ryter of Trusted that firewalls for her client database were fully operational and intrusion monitoring was in force.

Mrs Boss had also agreed to a warranty that Discrete would perform monthly searches of the IT system for malware and viruses. Unknown to Mrs Boss, Mrs Brau-Kerr and Mr Ryter, the former IT manager of Discrete, Mr Male, had discovered that the system was contaminated by a virus called Smashware. He had told Mr Brayne, an independent consultant engaged by Discrete with knowledge of its system, about this. Expert witnesses were cross-examined by counsel in the course of the trial, as well as the representatives of the insured, the insurer and the broker.

On fair presentation of risk, the question of ‘reasonable search’ was key. What enquiries should Mrs Boss have made? To use the words of the Act, what “should reasonably” have been revealed? It was held that, while it might not be reasonable to quiz ex-employees of a company, the fact of the recent departure of Mr Male should have alerted Mrs Boss to the need to speak to someone else who would have knowledge of the system – the Act requires the reasonable search to include the insured’s organisation or any other person. In this case, Mrs Boss should have spoken to Mr Brayne.

Principal attribution
Lord Mance raised the question of how these provisions will work with existing law on the knowledge of agents being attributed to their principals. Mrs Boss’s did not give a correct representation when asked about operational firewall, as Smashware had already invaded the system.

The question of remedies was one on which witness and expert witness evidence was crucial: what would Mr Ryter have done had he known of the Smashware infection? What did the experts think an underwriter would have done? Here, it seemed Mr Ryter would still have entered into the policy, but on different terms, with a higher premium. A remedy was awarded accordingly.

Section 11 of the Act – terms not relevant to actual loss – will likely prove the most contentious and litigated of the provisions. Indeed, this was raised by Lord Mance. In this case, it was held that although there was clearly a breach of warranty, Discrete could demonstrate that it was not relevant to the actual loss. The words of the section require the insured to demonstrate that the breach of warranty “could not have increased the risk of the loss which actually occurred in the circumstances in which it occurred”.

Here Lord Mance was persuaded by Discrete’s analogy of a burglary to a house. If a warranty says that all doors must be locked, but they were not, then cover cannot be refused if burglars entered a house through its windows. In this case, the hackers were the burglars, the house was the client database, and the route to entry was through hacking itself, not through a virus (such as Smashware).

What the trial clearly demonstrated is that while the new Act offers far greater clarity, there is still plenty of room for debate.

Ishaani Shrivastava
Barrister, Devereux Chambers