Recall decision points toward CGL coverage for data breach

On January 14, on the heels of the Target breach, a Connecticut appellate court issued an insurance coverage opinion, which tends to support an argument in favor of coverage under so-called “traditional” commercial general liability (CGL) policies for a company involved in a data breach incident.

Although the decision on Recall Total Information Management, Inc. v. Federal Insurance Co., negated coverage under the specific facts at issue in the case, the Recall case addresses potential coverage for data breach under the “personal injury” coverage section found in most CGL policies.

The current standard industry form (ISO Form CG 00 01 04 13 (2012)) states that the insurer “will pay those sums that the insured becomes legally obligated to pay as damages because of ‘personal and advertising injury,’” which is defined to include the “offense” of “[o]ral or written publication, in any manner, of material that violates a person’s right of privacy.”

The lead plaintiff in Recall had an agreement in place to transport and store various electronic media for International Business Machines (IBM). It subcontracted with Executive Logistics, Inc. (Ex Log) to provide the transportation services.

During an Ex Log transport of computer tapes from an IBM facility in New York to another location, a cart fell out of the transport van and approximately 130 tapes—containing social security numbers, birthdates, and contact information for some 500,000 past and present IBM employees—were removed from the roadside by an unknown person and never recovered.

IBM took typical ‘crisis management’ steps to address the incident, including notification to potentially affected employees, the establishment of a call center to answer inquiries regarding the lost data, and a year of credit monitoring to protect against identity theft.

IBM claimed over $6 million for these costs from Recall, which paid the entire amount of the loss and sought indemnification from Ex Log.

Ex Log tendered the claim under its CGL policies, which, similar to many other CGL policies, stated that the insurer would “pay damages that the insured becomes legally obligated to pay by reason of liability” for “personal injury,” which was defined as “injury … caused by an offense of … electronic, oral, written or other publication of material that … violates a person’s right to privacy.”

The insurers denied coverage on the basis that there had been no “publication” of the data contained on the tapes.

Importantly, the court did not summarily hold that there was no coverage for “crisis management” costs, such as IBM’s notification, call centers, and credit monitoring efforts. Rather, the court appears to accept that these costs would be covered – presumably in addition to any damage awards, settlements and defense costs in connection with any underlying litigation brought by the impacted employees—provided there was a “publication” of the data.

The court ultimately determined that the “publication” requirement was not satisfied because the plaintiffs “failed to provide a factual basis that the information on the tapes was ever accessed by anyone”. The court noted that there was nothing in the record to suggest that “the unknown party even recognized that the tapes contained personal information.”

The court also cited to a letter to IBM employees stating that there was “no indication that the personal information on the missing tapes, which are not the type that can be read by a personal computer, has been accessed or has been used for any improper purpose.”

The court concluded that “because the parties stipulated that none of the IBM employees have suffered injury as a result of the tapes being lost,” the court was “unable to infer that there has been a publication.”

The plaintiffs argued that the triggering of statutes requiring IBM to notify its affected employees of the data loss gave rise to “presumptive invasions of privacy”, finding that “merely triggering a notification statute is not a substitute for a personal injury.” These arguments were also rejected.

Although the insureds in the Recall case did not hit the coverage bulls-eye, in contrast to the facts in that case, there is no doubt that there has been a “publication” of the data of those individuals impacted by the Target data breach. Under Recall, therefore, and numerous other cases, the “personal injury” coverage presumably would be triggered by the facts in connection with the Target breach.

Where there has been a “publication” (an undefined term in CGL policies that courts have construed broadly in favor of coverage), numerous courts have upheld coverage for data breaches and other privacy related claims.

In addition to invasion of privacy, the plaintiffs in the class action litigation brought against Target specifically allege harm arising from breach of state data breach notification statutes.

For example, one of the first class action suits filed against Target (the day the breach was confirmed) alleges that Target breached California’s data breach notification law by “fail[ing] to disclose … without unreasonable delay, and in the most expedient time possible, the breach of security” after Target “knew or reasonably believed such information had been compromised” and that, as a result, “Plaintiff and other Class Members incurred economic damages, including expenses associated with necessary credit monitoring.”

Based on the allegations of the Target putative class plaintiffs (and putting aside the merits of their allegations), Target is not a case, as opposed to Recall, where there was a “mere triggering” of notification statutes.

While there may be valuable coverage under an organization’s CGL and other “traditional” insurance policies, however, the insurance industry has made it abundantly clear that it does not want to cover “cyber” exposures under “traditional” policies, and insureds should be aware that they are likely to face costly insurance litigation to secure coverage for cyber-related incidents — even where there is a good argument in favor of coverage.

Before becoming the next Target, organizations may wish to vigorously assess their potential coverage for data breach and other cybersecurity risks under their current insurance policies, and to secure cyber insurance as necessary.