Incoming EU rules governing how companies handle personal data have triggered a game of contractual pass-the-parcel involving insurers, coverholders and third-party administrators (TPAs), as companies seek to protect themselves from regulatory fines and lawsuits.