Recent Data Breach Insurance Coverage Decision: Court Holds Insurer Not Obligated to Cover Damages from Lost Tapes Containing Personal Information When No Evidence Tapes Were Read
The Connecticut Supreme Court recently issued an opinion confirming that a Commercial General Liability (CGL) policy’s personal or advertising injury coverage did not provide coverage for damages resulting from lost data storage tapes where the tapes contained personal identifying information, but the party seeking coverage could not show that the tapes had been accessed. Recall Total Information Management, Inc. v. Federal Insurance Co., No. 19291, 2015 WL 2371957 (Conn. May 26, 2015).
The plaintiff in the case was a vendor to IBM that handled transportation and storage of business media belonging to the company. The plaintiff subcontracted its transportation responsibilities, and its subcontractor was required to carry CGL and umbrella coverage. The subcontractor’s insurance policies were issued by the defendant insurance companies and named the plaintiff as an additional insured. While the subcontractor was transporting computer tapes, a cart containing some tapes fell out of the back of the van. Nearly 130 tapes were removed and never recovered. Those lost tapes contained personal identifying information on IBM employees, including Social Security Numbers, birthdates, and contact information. However, no identity theft incidents were traced to the loss of the tapes.
The plaintiff settled with IBM for the full cost of the mitigation measures entered into by IBM, including notification of employees, credit monitoring, and credit restoration. The plaintiff sought indemnification from its subcontractor and the defendants. The defendants denied coverage. The plaintiff then filed suit. In the trial court, the defendants filed motions for summary judgment, which were granted. The appellate court affirmed.
On appeal, the Connecticut Appellate Court considered two issues: (1) whether the defendants had waived their coverage defenses, and (2) whether the personal injury provision in the policy covered the cost of notifying the employees affected by the data breach.
As to the first issue, the policy provided that the insurer had “the right and duty to defend the insured against a suit,” which was defined as “a civil proceeding,” including arbitration or dispute resolution. The court concluded that the terms “suit” and “other dispute resolution proceeding” could not have been “meant to encompass the mere negotiations that took place in this case.” It noted that construing the word “suit” to include “mere negotiations following a demand” would “obliterate the distinction” between a suit and a claim. It therefore concluded that, because the plaintiff’s negotiations with IBM and with the subcontractor did not amount to suits or dispute resolution proceedings, the duty to defend had not been triggered.
As to the second issue, the policy provided coverage for liability for advertising injury or personal injury, with personal injury defined as injury “caused by an offense of . . . electronic, oral, written or other publication of material that . . . violates a person’s right to privacy.” The appellate court concluded that the key issue was whether the information on the lost data tapes had been “published.” The court rejected the plaintiff’s contention that the loss of the tapes by itself constituted a publication to the thief. Rather, the court concluded that “access is a necessary prerequisite to the communication or disclosure of personal information,” and there was “nothing in the record suggesting that the information on the tapes was ever accessed by anyone.” The court was also unable to infer publication because the parties stipulated that no IBM employees had suffered injury from the tapes being lost. The court therefore affirmed the trial court’s ruling that the settlement between the plaintiff and IBM was not covered by the personal injury coverage of the policy.
In a short per curiam opinion, the Connecticut Supreme Court affirmed the Appellate Court’s decision on these two issues. The Supreme Court held, “Because the Appellate Court’s well reasoned opinion fully addresses the certified issue, it would serve no purpose for us to repeat the discussion contained therein. We therefore adopt the Appellate Court’s opinion as the proper statement of the issue and the applicable law concerning that issue.”
