Lloyd's of London urges the Government to remove some uncertainties from the NZ insurance market by getting on with the EQC Act review and making data breach reporting mandatory

Lloyd's of London is urging the New Zealand Government to bring some certainty to an otherwise "extremely" uncertain global insurance market.

The insurance giant's chief executive, Inga Beale, wants the Government to up the ante with its reviews of the Privacy Act 1993 and Earthquake Commission Act 1993, so it can get a better idea of how much risk it will be exposed to in the future. 

Lloyd's is a specialist insurance market that provides insurance cover for the likes of Air New Zealand, the kiwifruit industry, education system, museums and the Tall Blacks, through 27 coverholders or brokers in New Zealand.

Mandatory reporting key to cyber insurance

Speaking to interest.co.nz at the Insurance Council of New Zealand's annual conference, Beale says it's essential the Government introduces mandatory reporting through the revamped Privacy Act.

Cabinet in 2014 agreed it would do so by making it a legal requirement for public and private agencies to report material data breaches to the Privacy Commissioner, and in serious cases, the individuals affected by the breach. 

However a reform Bill is yet to be introduced to Parliament. Justice Minister Amy Adams in April told interest.co.nz draft legislation would be introduced before the end of the year, but then in May pushed the date out to 2017.

The problem with the hold up for insurers, is that they need more information on data breaches to be more effective in insuring businesses and individuals against cyber attacks. 

Cyber insurance is the area with the biggest growth potential for insurers. Yet without there being a database of all the attacks that have taken place, insurers don't have a comprehensive picture of the risks.

It's more difficult for them to pick up on trends, in the same way they can with the data they have on burglaries for example, so it's more difficult for them to price premiums accordingly.

Beale says: "I would urge the government to introduce mandatory reporting.

"It was introduced in the US. It drove the issue of cyber attacks onto the boardroom agenda and out of just being with the IT guys. It's going to happen in Europe... And again it will raise the level of awareness of the issue which is really one of the vastly increasing threats."

Asked whether she has any concerns about mandatory reporting causing problems through people rushing to withdraw their money from their bank for example, if it was revealed its systems had been seriously hacked, she says: "It [the breach] doesn't necessarily have to be made public.

"But the idea that you are monitoring it, you're having to report it, just raises the level of awareness. I think directors of boards would be amazed if they started to uncover the extent of cyber attacks."

While mandatory reporting is yet to be introduced, the Government in May announced it would spend $22.2 million over four years to set up a Computer Emergency Response Team (CERT), to collect information around cyber security breaches that agencies voluntarily report. 

The CERT, which will open its doors early next year, will also be equipped with the resources to provide advice and resources to deal with the aftermath of a breach and help prevent it from happening again.

EQC Act review: 'It's things just going on and on and on that nobody likes'

Beale is also calling for the Government to push on with its review of the EQC Act, which was meant to be completed in 2013. 

The Act essentially outlines what both private insurers and the Government are responsible for in the event of a natural disaster.

"It is better to get the review done quicker rather than slower," Beale says.

"I would urge them to complete it. If you're going to make big changes, it always take courage. Courage with caution is the best approach. We are happy to continue to work on this with them. We can bring risk expertise from all around the world. That could bring benefit. 

"But it's the uncertainty. It's things just going on and on and on that nobody likes."

Asked whether she believes insurers are paying their reinsurers a premium for all the uncertainty caused by the legislation being up in the air, Beale to some extent echoes the comments Swiss Re made on the topic last week.

She says it's hard to tell as the low interest rate environment is seeing an abundance of capital around the world keep margins low.

"With the competitive environment at the moment, it's quite difficult to know whether anyone's getting the right price and the right reward for the risk anyone's taking on," she says.

Interest rates and Brexit cause broader uncertainties 

Beale notes the insurance sector has attracted a number of yield-seeking investors, particularly pension funds.

"That in part then is diminishing the returns of the insurance sector because it's putting downward pressure on pricing, which means our returns are reducing and therefore you've got this whole circular impact, which means it could keep spiralling down and down. 

"While there might be benefit for the policyholders in the beginning that the insurance premium might go down, ultimately it's [premium pricing] got to be sustainable." 

Adding to this uncertainty for the industry, is Brexit. 

Beale says Lloyd's has been lobbying the British Government to enable the financial sector to keep having trading rights with the European Union. 

With 11% of the premiums it writes coming from the EU, Beale says Brexit will directly affect 4% of its revenues. 

Asked how New Zealand is implicated, Beale says uncertainty can prevent investment and thus economic growth for New Zealand firms - particularly those interested in European markets. 

Furthermore, Lloyd's plays a key role in New Zealand's specialist insurance market, contributing $5.6 billion towards paying for the 2010/11 Canterbury earthquakes.

*This article was first published in our email for paying subscribers. See here for more details and how to subscribe.