Elsa Jordaan from Norton Rose Fulbright.
If insurers don’t want to cover cyber liability under a general liability policy they’d better check their wordings and introduce exclusions if necessary.
Whether or not cyber breaches are covered under the “personal and advertising injury” section of commercial general liability policies depends on the circumstances of each case. We discuss two cases which illustrate this point.
In the US, Recall Total contracted with IBM to transport and store various electronic records to Ex Log. During transport, some of the computer tapes, which contained personal information of past and present employees of IBM, fell from the back of the transport vehicle. Some of the tapes were removed from the scene but there was no evidence that the tapes were accessed by a third party or that the loss of the tapes resulted in injuries being suffered by employees of IBM. But IBM took steps to mitigate potential harm flowing from this data breach and claimed the costs incurred in doing so from Recall Total.
Recall Total demanded indemnification from Ex Log and both Recall Total and Ex Log sought cover under Ex Log’s commercial general insurance policy and coverage was denied by the insurers. The Connecticut Supreme Court considered whether the personal and advertising injury section of the policy was triggered. Because the wording of that particular section of the policy says that “personal injury” includes any injury which is “caused by an offense … or other publication of material that … violates a person’s right to privacy”, the court found that the issue was not the loss of the personal information, but its publication. There was no evidence that the information had been accessed and, therefore, no evidence of it being published. The data breach failed to trigger the policy but that loss would have been covered if publication had been proved.
In another case in the US, medical records of patients became accessible online due to an alleged failure of Portal Healthcare (Portal) to secure a server. Two of Portal’s liability policies reportedly provided cover for the electronic publication of materials. In April 2016, the Court of Appeals for the Fourth Circuit ruled that the “personal and advertising injury” section of the policy is triggered by the data breach because there was evidence of publication.
What the cases illustrate is that, depending on the facts, claims emanating from cyber breaches may be covered under general liability insurance policies even though, traditionally, it may not have been the intention for such claims to fall within the ambit of this sometime inexpensive insurance cover.
First published by Financial Institutions Legal Snapshot.
Get the latest issue of FAnews