1. The protections against liability apply to both the Customer and the Data Owner.
With this option, both parties will be protected from liability. We do this by:
- Cap on liability for ordinary claims: The contract sets a maximum dollar limit on each party’s liability.
- Higher cap on liability for serious mistakes and breaches: The contract sets a higher maximum dollar limit on each party’s liability for serious issues, like data breaches and cybersecurity incidents, misuse of confidential information, intellectual property violations, and other major claims.
- Indirect liability: The contract says that neither party is responsible for ripple effect losses, like missed opportunities or lost revenue.
2. Both the Data Owner's and the Customer’s liability is capped at a dollar value you choose.
A cap on liability limits the amount of money a party can be held responsible for if something goes wrong. This cap sets a maximum amount that would have to be paid in case of damages, losses, or other liabilities that happen because of the work the Customer and the Data Owner do together. With a balanced approach, the cap on liability applies to both the Data Owner and the Customer equally.
The Data Owner
For the Data Owner, the main purpose of a cap on liability is to protect them from potentially unlimited financial responsibility; often, uncapped liability doesn’t make sense for the amount of fees the Data Owner will be charging. The risk is just too high, so the cap on liability makes it easier for the Data Owner to manage risks.
The Customer
For the Customer, the risk is that the instructions and any Customer materials could pose a risk to the Data Owner. The main purpose of a cap on liability is to protect the Customer from potentially unlimited financial responsibility, which may discourage the Customer from getting help from a Data Owner.
For both parties
Most of the risk is on the Data Owner, so a cap on liability does benefit the Data Owner more. For both parties though there is a benefit to knowing there is a limit on their financial exposure for risk of liability.
How It Works
The cap on liability is usually a fixed dollar amount. For example, the agreement might say liability is capped at $50,000. If a party’s actions result in damages or losses that are higher than the cap, the party is only responsible for paying up to the capped amount, and no more.
You can also make the cap on liability a multiple of the Data Owner's fees. For example, the maximum liability of either party is equal to 1x or maybe 2x the fees charged to the Customer. The benefit here is that the risk (the liability cap) goes up or down depending on the gain (how much is charged in fees).
3. Introducing “Super Caps” and how they balance each party’s risk.
A super cap in a limitations of liability clause is a higher limit on the amount of liability of a party for more serious types of breaches or incidents. This is often used in contracts between Data Owners and Customers to address particular risks that may require greater financial protection than the general liability cap.
Example
For example, let’s say the general cap on liability is $50,000. So, for most claims, that’s the maximum exposure for both parties. But in the field of information technology, data breaches and cybersecurity incidents could lead to losses that are much higher than $50,000 and could perhaps cost hundreds of thousands or even a million dollars. So, the Customer may not be willing to sign the agreement knowing that they could only recover the smaller amount. But the Data Owner may not be willing to have unlimited financial responsibility; after all, accidents happen and the Data Owner does not want all the risk.
A super cap is a great way to solve this problem.
In our data breach or cybersecurity incident example, the super cap would say that the Data Owner’s liability is, for example, $1,000,000. This means the maximum liability for this type of loss is up to $1 million, but not higher even if the losses are in fact more than that.
Insurance can help
When negotiating a super cap, both parties need to think through the risk and the potential costs for serious claims. It's also crucial for the party agreeing to the super cap to ensure that their insurance coverage is sufficient to handle claims up to the super cap amount. Often, setting the super cap amount to be the same as their insurance coverage is a good way to go and helps balance each party’s risk.
What's included in the super cap?
With a balanced approach, the super cap covers:
- Data breaches and cybersecurity incidents
- Confidentiality breaches
- Third party claims
- Intellectual property claims
- Regulatory fines
4. The Data Owner is not liable for unexpected or indirect losses.
Indirect losses, also known as "consequential" losses, refer to damages or losses that do not result directly from a party but happen as a consequence of the party's actions. Think of these as the ripple effect losses.
Secondary (Indirect or "Consequential) Losses
- Lost profits
- Additional Expenses
- Loss of Business Opportunities
- Reputational Damage
Indirect losses can be hard to predict and the dollar amount of damage can be even harder to know ahead of time. If the Data Owner takes on too much potential liability, they may need to raise their fees or just not take on the work. That's why we often see contracts say that the Data Owner will not be liable for indirect losses.
Okay great, but how do we make this balanced?
We make the exclusion of liability for these sorts of losses balanced in two ways:
- Applies equally to both the Customer and the Data Owner: Both parties will be benefit from being protected from these sorts of hard to predict losses.
- Breaches of confidentiality: Both parties are still liable for indirect, ripple effect losses if they breach the confidentiality of the other party.
- Third party claims: Sometimes the Customer or the Data Owner may be sued by a third party over the use of the data. For example, if either the Customer or the Data Owner breached intellectual property rights. This could happen if the Data Owner provided the Customer with data that belonged to someone else. It could also happen if the Data Owner used someone else’s property when creating the data. If the third party sues either of them, the party that caused the harm is still liable for these kinds of ripple effect losses.
5. There are some liabilities that cannot be excluded.
There are some types of liability that cannot be excluded or limited:
- Willful bad acts, like fraud or intentional harm.
- Gross negligence, which is a severe lack of care that is reckless and disregards the safety or reasonable treatment of others, going beyond ordinary lack of care.
