Why Buy Cyber and Privacy Liability. . .

An industry known for embracing paper and shunning change, the property and casualty insurance market struggles to keep pace with the modern business world, which is full of personally owned mobile and other portable devices, and concepts such as advanced persistent threats (APTs), the Internet of Thingsand the “cloud.” While insurance companies are known for creating bespoke policies to address new risks not initially contemplated within the confines of traditional property and liability policies (see Y2K, environmental legal liability and employment practices liability), insureds are within their right to see how those current programs address 21st-century risks. If only one of Target, Snapchat, Facebook, Google, Twitter, Yahoo! Adobe and so on and so forth had suffered a serious data breach within the last few months, that would be sufficiently troubling. Yet data breaches have become so ubiquitous that a single week (if not days) without one hitting the headlines seems almost strange. By now every organization should appreciate that—no matter how robust and sophisticated its network security is—it remains a vulnerable target for cybersecurity breaches and the host of negative consequences that typically follow, including class action lawsuits (so far, dozens of suits have been filed against Target), substantial breach notification costs, and other “crisis management” expenses, including forensic investigation, credit monitoring, call centers and public relations efforts, as well as potential regulatory investigations, fines and penalties. This article will briefly look at how an organization’s commercial general liability—specifically, the personal and advertising injury coverage—may currently address privacy risks. Although there can be substantial overlap between the concepts of cybersecurity, network security liability and privacy, as they typically are understood in the industry, this article will focus on those risks associated purely with privacy risks, or the “unauthorized access, collection, use or disclosure of personal information.” Therefore, we will not be covering those issues related to cyber liability, or “breach-related expenses, including forensic investigations, outside counsel fees, crisis management services, public relations experts, breach notification and call center costs.” This article will also not be addressing the recent first-party bodily injury, property damage and business interruption coverage associated with the damage attributable to unauthorized access of operational technology (SCADA systems). We will first summarize the current industry standard form key coverage grant, definitions and exclusions. We will then discuss the recent Sony decision and the new 2014 industry form exclusionary endorsements targeted at eliminating coverage for data breaches under standard-form CGL coverage. Current standard-form CGL coverage The Coverage B “Personal and Advertising Injury Liability” coverage section of the current standard-form Insurance Services Office, Inc. (ISO) CGL policy states that the insurer “will pay those sums that the insured becomes legally obligated to pay as damages because of 'personal and advertising injury,' which is caused by an Id. §1.b.offense arising out of [the insured’s] business.” “Personal and advertising injury” is defined in the ISO standard-form policy to include a list of specifically enumerated offenses, which include the “offense” of '[o]ral or written publication, in any manner, of material that violates a person’s right of privacy.'” The policy further states that the insurer “will have the right and duty to defend the insured against any ‘suit.’” The CGL Coverage B can indemnify and provide a defense against a wide variety of claims, including claims alleging violation of privacy rights, such as data breach cases. Coverage disputes have generally focused on whether there has been a “publication” that violates the claimant’s “right of privacy”—both terms are left undefined in standard-form ISO policies. Courts generally (although certainly not universally) have construed the language favorably to insureds and have found coverage for a wide variety of claims alleging breach of privacy laws and regulations, including, for example, in respect of claims alleging violations of the Telephone Consumer Protection Act (TCPA), claims alleging violations of the Fair Credit Reporting Act (FCRA), claims alleging violations of the Fair and Accurate Credit Transactions Act (FACTA), claims alleging violations of the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act, claims alleging violations of the California Confidentiality of Medical Information Act (CMIA), and claims alleging violations of the California Lanterman-Petris-Short Act. Courts have found in favor of coverage in data breach cases, although the recent decision in Zurich American Insurance Co. v. Sony Corp. of America et al. highlights the issues that insureds may face in obtaining coverage for data breaches under CGL policies. Zurich v. Sony Arguably the most visible legal case surrounding the applicability of the CGL personal and advertising injury coverage to claims alleging data breach came about because of Sony’s massive 2011 PlayStation data breach. Zurich American and Mitsui Sumitomo had issued primary CGL policies to Sony. In April 2011, hackers broke into Sony networks and stole personal and financial information of more than 100 million users. Sony was named as a defendant in numerous class actions immediately following the breach. Mitsui denied coverage, and Zurich responded by filing a declaratory relief action seeking a declaration that Zurich had no duty to defend. At issue in the case is whether Sony or the hackers were responsible for the actual “publication” of the personally identifiable information (PII). A New York court recently held that there was no coverage, essentially because it was the perpetrators of the breach who ultimately “published” the private information, rather than Sony itself. Legal experts have argued both in favor of and against the court’s decision, arguing, among other things, that the trigger for the personal and advertising injury coverage must be an affirmative act by Sony or, conversely, that coverage is triggered to the extent Sony has liability. The case is currently under appeal, and its final decision will potentially be an indicator of how insurers and courts will view data breach coverage under the personal and advertising injury coverage. In the meantime, however, the decision underscores the difficulties that insureds can face in pursing data breach coverage under their traditional CGL policies. Although this endorsement appears to have quietly flown in under the radar, it in reality is even more sweeping than the 2014 data breach exclusionary endorsements because it entirely eliminates coverage in the first instance. Conclusion Over the years, the commercial general liability policy has been the proverbial “catch all” for claims subsequently determined to be outside the intent and scope of the underwriters. Past examples have included pollution liability, asbestos, employment practices liability and professional liability. Cyber and privacy liability may well be heading in the same direction. Insurers are stating publicly that this exposure was never contemplated when the policy language was drafted. And, of course, cybersecurity and privacy liability has recently risen to potentially catastrophic levels of potential liability (e.g., Target). Insurers, therefore, are increasingly seeking to separately insure the risk, subject to separate underwriting criteria. In the end, before a cybersecurity or privacy incident, companies should take the opportunity to carefully evaluate and address their risk profile, potential exposure to cyber and privacy risks, their risk tolerance, the sufficiency of their existing insurance coverage and the potential role of specialized cyber risk coverage.