Data and content protection as part of Film and Media insurance

When it comes to data, from an insurance perspective, there needs to be clarity around whose data it is in the first place, and there are two areas where this may be laid out – your Terms of Business and the Contract for the job.  In the absence of these, then the legal process would determine whose data it is.

There are a multitude of reasons why you may or may not wish to retain the rights to the data/content.  You may want to advise your client that the content you capture is yours until you are paid, or you may want the client to take responsibility for the content immediately it is shot, so that if anything goes wrong thereafter it is their responsibility.

Right, you have captured the content.  What now?  Before you do anything to the data – MAKE A COPY!  This can be locally at this point (for speed), but once you have done this, then verify the copy to make sure it is a working copy and to check for completeness.

Once you have worked on the data, then the mantra should be:

BACK UP! 

BACK UP! 

BACK UP!  

Offsite is better.  To three or more locations is better still (and always verify the backup).

“Why do I need insurance if I am backing up all over the place anyway?”  Good question!

The answer is that all Policyholders are responsible for “mitigating” (i.e. “keeping to a minimum” or “preventing”) a potential loss.  If you are on location, then something could happen to the content before you have had a chance to back up, but following a procedure to prevent the loss in the first place will put you in the best position to protect your work – after all, insurance should be the safety net, rather than the first defence.

So, you’ve shot your content and then something happens to it – a hard drive is dropped, or flash card stolen…there are insurance protections available to you, that could mean that you are not left out of pocket.

Producers Indemnity Insurance (Multimedia)

Usually, the Production Company would insure the content that you produce for them, but not always.  If not, and there is a cost to yourself for producing the content, then this section of a policy covers various audio/visual content on many media formats (such as film negative, flash cards, tape, hard drives, etc), prints, computer images and software used to generate images, artwork, storyboards, including those stored digitally or electronically.

In short, the policy:

• Indemnifies the policyholder for the cost expended should the production be abandoned as a result of the loss or damage
  or
• Indemnifies the policyholder for the additional costs which are necessary to complete the production should loss or damage occur

For those of you who undertake work on Third Party content (such as data wrangling or editing), then you can insure damage to the Third Party’s content under:

Post-Production Indemnity Insurance 

Again, the Production Company would usually insure their content whilst you are working on it, but we know from experience that not all do, and then this could place you in a difficult position.

• If you damage your client’s content, or it is stolen from you, then you could end up with more than a red face.  Post-production Indemnity:
• Indemnifies the policyholder in respect of the additional costs which are necessary for their client to complete the production (contract).

This is usually up to a set limit, and there is no abandonment cover.  Also, if the Production Company has insured their content, then the claim will rightly fall under the Production Company’s insurance policy, so do check this with them before you start work.

Many insurance policies offer overlapping solutions to the same or similar issues.  Professional Indemnity Insurance may be sought where you handle client’s data or intellectual property and usually provides “Loss of Documents” cover, which can include both physical documents, and data, for example.

More people are turning to cloud storage to upload and store their own and/or their client’s data, but there are some important considerations to be made here too.

• Confidentiality?  Will the data you upload be seen by anyone else?
• Security? Are there robust security protocols in place to guard against unauthorised access?
• Reliability? Can you be sure that the data you have in the Cloud is the same as the data you sent there?
• Availability? Can you access the data 24/7/365 and from other countries?
• Data deletion procedures?  Will the provider securely delete the data?  Will they automatically delete data if you go over your storage limit, or if your subscription ends?

The Data Protection Act also stipulates that any personal data (names, addresses, credit card details, for example) may only be handled within the European Economic Area (EU plus Iceland Liechtenstein and Norway) and places great responsibility on you to ensure that where you pass others’ data outside of this area, that you check that there are sufficient safeguards in relation to Data Protection.  This could result in prosecution if you fail to do so.

In the US, there is a “Safe Harbor” scheme in operation, but not all storage providers sign up to this, so check before you do anything.  This could also be a consideration for those of you who have a “shopping cart” attached to your website – check where the data is sent before you activate this function, as your client will believe that they are entrusting their data to you and your website, rather than a third party, so could hold you responsible.

Cyber Liability and Hacking Insurance

There are variants of this cover available as an insurance solution, but there are two component parts of the policy that I will cover here:

First Party Cover (this would be you, as the Policyholder)

This provides cover for the costs incurred in connection with the loss of, or inability to access, data, or the corruption of data, as a result of:

• Network security breach/ Hacker/ Denial of Service attack
• Computer virus
• Accidental damage or destruction of data media
• Malfunction of peripherals and data transmission lines.

The cover includes the costs of restoration of any such data (including re-shooting costs), crisis management (like having your own PR team to ensure that you don’t suffer bad press as a result of the incident) and notification costs (letting your affected clients know that there has been an issue).

Third Party Cover (other people):

Provides cover for the liability of the Policyholder in relation to storing or using data, or trading electronically, such as:

• Disparagement (criticism of others)
• Plagiarism and infringement (“borrowing” others; work or ideas)
• Rights to privacy or breach of confidence (making public others’ personal information, for example)
• Transmission of virus and denial of service

It could be that you post something on your Social Media account that is inappropriate, or infringes someone else’s intellectual property.  Even email chains have found their way out of organisations and into the wider world where someone suffers a detriment as a result.

With any use of technology, there should be a consistent review process to ensure that your website, cloud storage, email and social media accounts remain robust, protected and fit for purpose.

Backing up your own internal procedures with an insurance safety net will help ensure that you can focus on delivering your content to your client and that you don’t end up out of pocket, should the unthinkable happen.