As the COVID-19 crisis evolves in Canada and across the globe, every economy and business is facing change, disruption and, in some cases, a complete shutdown. Under the circumstances, directors and officers (D&O), who are the stewards of an organization, face tough decisions as they continue to conduct their operational, financial and contingency planning.

In Canada, D&Os have a common law and statutory duty to exercise reasonable care and diligence. Even before the COVID-19 outbreak, the number of D&O investigations and claims was on the rise.¹ D&O litigation had also become increasingly “event-driven.” An event that adversely impacts a business will often give rise to a D&O claim. Some examples of such events are product recalls, loss of material contracts, major acquisitions gone wrong, cyber leaks and breaches, material environmental events, and sexual misconduct allegations.

The COVID-19 outbreak is a global triggering event in and of itself, but it can also cause a series of cascading events that may further impact business operations, infrastructure, and the value of company shares. Below are three key areas of risk for D&Os, and some practical considerations, to keep in mind when planning and responding to the “new normal” ushered in by COVID-19.

1. Financial risks

Litigation related to securities and shareholder actions is likely to be one of the key areas where we will see an increase in D&O claims. As supply chains are impacted, accounts receivables dry up, new business avenues change, and stock prices plummet, the short-term and long-term financial disclosures by a company become significantly more important. Both the US Securities and Exchange Commission² and the Ontario Securities Commission³ have released guidance on disclosure timelines and risks for businesses.

Two common claims, among others, that can arise against D&Os during these turbulent times are: (i) negligence and breach of fiduciary duty claims: and (ii) secondary market liability claims. D&Os have the duty to supervise the management of the corporation, act in the best interest of the corporation, and exercise care and skill. In addition, Canadian securities legislation creates secondary market exposure and personal liability to D&Os for material misrepresentation in public disclosure documents. For businesses that have experienced a significant decrease in their share prices, there may be increased exposure to a securities class action or derivative shareholder claims. The actions, or inactions, of D&Os in this climate will come under increased scrutiny, as potential claimants may look to attribute blame for losses in the stock market.

One of the first proposed D&O class actions arising out of the COVID-19 situation was filed in US District Court, in the Eastern District of Pennsylvania.⁴ The claim alleges, among other things, that misrepresentations were made by the CEO indicating that the company had developed a vaccine for the coronavirus. The public filings of the company stated that they had had been“able to fully construct [their] vaccine within three hours once [they] had DNA sequence from the virus.” This was later changed to advise that they had merely “designed a vaccine construct.”  Once clarifications were issued, the stock price dropped more than 71 percent in a two-day period. The investors who lost money now seek to recover their damages as against the D&Os.

Practical tips

1. Create response and preparedness committees to assess all material disruptions to your business;
2. If material, disclose both the impact of the pandemic on your business, and your preparedness in your public filings;
3. Seek and rely upon expert advice from your auditors, brokers, financial planners, regulators and lawyers. This is not the time to be, “pennywise and pound foolish”;
4. Ensure that D&Os have Side A Insurance Coverage and Difference in Conditions to protect not only the entity, but also the D&Os personally; and
5. Refrain from trading prior to dissemination of material non-public information.

2. Cyber risks

Cybersecurity attacks and data breaches have become increasingly common problems faced by large corporations. We are currently seeing a massive workforce transition as more and more people are working from home, and relying upon networks and the Internet, both professionally and personally (i.e., banking, grocery shopping, sharing private information, and general social communications). This may cause an increased risk of cybersecurity attacks and data breaches, as a result.

The United States has seen derivative actions for cybersecurity breaches brought prior to the COVID-19 outbreak. While Canada has not seen similar levels of litigation in this area, the increased vulnerability faced by businesses in the current environment could provide a spark for litigation. Businesses should be careful to protect their networks while transitioning their employees into remote working environments. A failure to vet their security measures properly may lead to inadvertent data breaches. For instance, there has been a reported uptick in ransomware attacks and phishing scams.⁵

D&Os face accountability and personal exposure for cyber attacks or data breaches if they fail to meet their requisite duty of care, and ensure proper security and protection for their networks. Additionally, as more businesses rely on electronic communications to generate revenue and communicate with customers, they should not lose sight of their obligations under Canada’s Anti-Spam Legislation (CASL). D&Os can be held personally liable if a corporation fails to comply with CASL.

Practical tips

1. Maintain proper document management systems;
2. Educate employees on the dangers of using personal accounts for sharing sensitive information and phishing;
3. Conduct mock exercises;
4. Ensure all software is up-to-date;
5. Consult security advisors to ensure that your data is being properly stored; and
6. Obtain cyber insurance to help you reduce potential damage to your information systems through theft, alteration or destruction.

3. Environmental risks

Canadian courts have expanded the liability of D&Os, holding them personally responsible for acts affecting the environment, as well as environmental offences committed by a corporation, during their time in office or on the board.

At the time of publishing this article, the Government of Ontario still listed “environmental rehabilitation, management and monitoring, and spill clean up and response,” under its list of services within essential workplaces.⁶

As businesses grapple with potentially harsh financial realties, this is an area where D&Os may open themselves up to liability if they fail to maintain diligent business practices. The CBCA states that statutory liability may arise in situations of environmental negligence. The Canadian Environmental Protection Act (CEPA) states that a director can also be held liable for corporate offences that the director may have “directed, authorized, assented to, acquiesced in or participated in.” D&Os are required to take all reasonable steps to prevent environmental contraventions. Therefore, the key question will be what is considered “reasonable” while operating a business remotely, and adhering to physical / social distancing laws.

Practical tips

1. Do not cut corners. Continue to follow good governance practices;
2. Review your corporate indemnification policy concerning environmental issues;
3. Review your insurance policies and ensure you have sufficient protection. One of the biggest issues that businesses face when dealing with an environmental concern is the lack of limits available to them;
4. Report an environmental concern immediately to your insurer. Unlike other liability policies, environmental policies have built-in triggers that engage the insurer prior to the issuance of a formal claim; and
5. Engage a good environmental consultant and engineer.

As businesses and their leaders continue to operate in these uncertain times, the aforementioned areas represent emerging risks. D&Os should ensure they have adequate coverage for potential claims. Additional risk management is also recommended to reduce personal liability arising directly or indirectly from disruptions caused by COVID-19.

For more information, please contact Deepshikha Dutt, Stevan Manojlovic, or another member of Dentons’ Insurance group.

Read more of our four-part series here.

1. See previous article written by Deepshikha Dutt on Risks and trends 2020: Emerging areas of directors and officers liability north and south of the border and key takeaways, at http://www.canadainsurancelaw.com/risks-and-trends-2020-emerging-areas-of-directors-and-officers-liability-north-and-south-of-the-border-and-key-takeaways/.↩
2. See link to US SEC: https://www.sec.gov/corpfin/coronavirus-covid-19↩
3. See the link to the OSC News Release: https://www.osc.gov.on.ca/en/NewsEvents_nr_20200323_csa-publish-blanket-relief-market-participants-due-covid-19.htm↩
4. Patrick McDermid v Inovio Pharmaceuticals, Inc., et al, 20-cv-1402.↩
5. Most notably, Brno University Hospital in the Czech Republic—a major COVID-19 testing hub—suffered a ransomware attack that disrupted operations and caused surgery postponements. Canadian healthcare organizations have experienced similar attacks. ↩
6. See link to government Ontario website: https://www.ontario.ca/page/list-essential-workplaces. ↩