FRANCE Law and Practice Contributed by: Emmanuèle Lutfalla and Louis Fer, Signature Litigation AARPI
turnover. These fines are generally not insurable under French law, as the ACPR considers them contrary to public policy, though this position remains untested by the courts. Defence costs associated with CNIL investigations and civil claims following a data breach are, however, frequently covered under cyber or D&O policies. From an underwriting perspective, insurers are increasingly requiring evidence of GDPR compliance as a condition of providing cyber coverage, includ- ing the existence of data protection officers, breach notification procedures, and incident response plans aligned with the ANSSI’s ReCyF framework. The demands-and-needs test applicable to insurers also requires them to verify that policyholders have suffi- cient security measures in place before coverage can be written. The growing frequency and sophistication of cyber- attacks, including ransomware, has led to a harden- ing of the cyber-insurance market, with higher premi- ums, increased retentions, and more restrictive terms. Underwriting now systematically assesses cyberse- curity governance, such as multi-factor authentica- tion, immutable back-ups, and documented response plans, as material criteria. In terms of litigation strategy, data breaches often trigger parallel proceedings, namely a CNIL investi- gation, civil claims from affected data subjects, and a coverage dispute with the insurer. Managing these parallel tracks requires careful coordination, as infor- mation disclosed in one proceeding can materially affect the outcome of another. The French Insurance Code further complicates claims handling by requiring policyholders to notify judicial or police authorities of any automated data system breach within 72 hours of becoming aware of it, failing which coverage may be forfeited. 8.4 Data Centres The rapid expansion of data centre infrastructure in France is creating new and concentrated risk expo- sures that the insurance market is still learning to assess. Data centres present a unique combination of property, business interruption, environmental and liability risks. The physical assets are high-value and
highly sensitive to operational conditions, and even a brief outage can cause substantial downstream losses for the businesses that depend on them. From an underwriting perspective, the key concerns are the density of electrical equipment, the vulner- ability of cooling systems, energy supply resilience, and the concentration of risk in a small number of large facilities. Business interruption coverage for data centre operators raises specific questions about the quantification of losses, particularly where the opera- tor’s clients suffer intangible harm that is difficult to measure. Traditional business interruption policies, built around stand-alone manufacturing facilities, do not map cleanly onto interconnected data centre operations. Insurers are responding by developing bespoke under- writing criteria, including requirements for redundancy in critical systems, fire suppression standards, and business continuity planning. Some insurers have launched specialised facilities offering significant capacity for both construction and operational risks, while parametric solutions are emerging for natural perils. Risk assessment is becoming more engineer- ing-led, with insurers deploying dedicated teams to conduct on-site evaluations. Claims experience in this sector remains limited in France, but as the industry grows, so will the volume and complexity of disputes. Layered insurance pro- grammes across multiple policies complicate claims handling, and disputes frequently arise over the scope of contingent business interruption coverage, particu- larly where a loss originates from third-party power or cooling failures. 8.5 Social Media Risk Social media addiction and its mental health conse- quences are beginning to register as a risk category in France, though the insurance market is at a very early stage in terms of claims activity. The main exposure lies in product liability and D&O. Social media plat- forms could face claims alleging that their products are defective by design, in that they are intentionally engineered to be addictive, particularly for minors, creating what some have described as mental health traps for vulnerable users. Directors of platform com-
115 I NSURANCE L I T IGATI O N 2026
CHAMBERS.COM
Powered by FlippingBook