We are subject to numerous U.S. federal and state laws and non-U.S. laws and regulations governing the protection of personal and confidential information of our clients and employees, including in relation to medical records, credit card data and financial information. These laws and regulations are increasing in complexity and number, change frequently, sometimes conflict, and could expose Chubb to significant monetary damages, regulatory enforcement actions, fines, litigation or claims, and criminal prosecution in one or more jurisdictions.
For example, we are subject to the New York Department of Financial Services’ Cybersecurity Regulation (the NYDFS Cybersecurity Regulation) which mandates detailed cybersecurity standards and other obligations for all institutions, including insurance entities, authorized by the NYDFS to operate in New York. The NYDFS Cybersecurity Regulation has increased our compliance costs and could increase the risk of noncompliance and subject us to regulatory enforcement actions and penalties, as well as reputation risk.
Additionally, the National Association of Insurance Commissioners (NAIC) adopted an Insurance Data Security Model Law, which requires licensed insurance entities to comply with detailed information security requirements. A number of states have enacted it into law, and it is not yet known whether or not, and to what extent, additional states will enact it. Such enactments, especially if inconsistent between states or with existing laws and regulations, could raise compliance costs or increase the risk of noncompliance, with the attendant risk of being subject to regulatory enforcement actions and penalties, as well as reputational harm.
The EU General Data Protection Regulation (the GDPR) is a comprehensive regulation applying across all EU member states. All our business units (regardless of whether they are located in the EU) may be subject to the GDPR when personal data is processed in relation to the offer of goods and services to individuals within the EU. Our failure to comply with GDPR and other countries’ privacy or data security-related laws, rules or regulations could result in significant penalties imposed by regulators, which could have an adverse effect on our business, financial condition, and results of operations.
Significant other comprehensive privacy laws have been enacted by other jurisdictions, most notably the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and Brazil’s Lei Geral de Protecao de Dados (LGPD), which may affect our use of data and could affect our operations and subject us to fines and actions for noncompliance. In the U.S., several other states are considering similar legislation, and there are ongoing discussions regarding a U.S. National Privacy Law. New laws similar to the GDPR and the CCPA are expected to be enacted in coming years in various countries and jurisdictions in which we operate.
Regulatory standards relating to the use of artificial intelligence (AI) are evolving in the countries where we do business, and may increase risks associated with bias, unfair discrimination, transparency, and information security. State insurance regulators in the U.S. have issued and will continue to consider regulations or guidelines on the use of external data, algorithms, and AI in insurance practices. The European Parliament and European Council have also promulgated the European Union Artificial Intelligence Act, which will regulate the use of AI within the European Union. The application of existing law and introduction of new or revised laws and regulations may require changes in our operations, increase compliance costs and reduce benefits from our adoption of artificial intelligence technologies.