Insurance Law Alert

April 2019

In This Issue
Second Circuit Rules That Property Policies Do Not Cover Crumbling
Concrete Claims
The Second Circuit ruled that a collapse reinstatement provision in Connecticut homeowners’
policies does not make coverage available for claims arising from the cracking of basement
walls that remain standing. Valls v. Allstate Ins. Co., 2019 WL 1442081 (2d Cir. Apr. 2, 2019).
(Click here for full article)

Finding Ambiguity In Collapse Provision, Washington Appellate Court
Reverses And Rules In Insured’s Favor“They substantively
know the area extremely
well and have encyclopedic
knowledge of national laws as

A Washington appellate court ruled that a collapse provision was ambiguous and must be
interpreted in the policyholder’s favor. Feenix Parkside LLC v. Berkley N. Pac., 2019 WL
1514086 (Wash. Ct. App. Apr. 8, 2019). (Click here for full article)

they litigate all over country.”

Insureds Seek Reversal Of No Duty To Defend Ruling In Data Breach Suit

– Chambers USA 2019

A policyholder asked the Eleventh Circuit to reverse a Florida district court decision holdingthat a general liability insurer has no duty to defend data breach claims. Brief of Appellant, St.
Paul Fire & Marine Ins. Co. v. Rosen Hotels & Resorts, Inc., No. 18-14427 (11th Cir. filed Jan.
9, 2019). (Click here for full article)

Pennsylvania Court Rules That Insurer Must Defend Cyberbullying Claims
Arising From Suicide
A Pennsylvania district court ruled that a homeowner’s insurer must defend cyberbullying
claims arising from a teenager’s suicide, finding that a covered “occurrence” was alleged. State
Farm Fire & Cas. Co. v. Motta, 356 F. Supp. 3d 457 (E.D. Pa. 2018). (Click here for full article)

Fifth Circuit Rules That Insurer Owes Defense To Church In Election Law
Violation Suit
The Fifth Circuit ruled that an insurer was obligated to defend a church against claims alleging
Texas Election Code violations. Word of Life Church of El Paso v. State Farm Lloyds, 2019 WL
1324845 (5th Cir. Mar. 22, 2019). (Click here for full article)

Restaurant’s Superstorm Sandy Losses Not Covered Under Civil Authority
Provision, Says New Jersey Appellate Court
A New Jersey appellate court ruled that a restaurant that was closed for several weeks following
Superstorm Sandy was not entitled to coverage under a “civil authority” provision. Maritime
Park, LLC v. Nova Cas. Co., 2019 WL 1422918 (N.J. Super. Ct. App. Div. Mar. 29, 2019).
(Click here for full article)
Simpson Thacher & Bartlett LLP

1

Washington Court Rejects Plan That Commutes Certain Policies While
Enjoining Claims By Non-Settling Insurers
A Washington district court ruled that a federal bankruptcy court erred in approving a planthat commuted certain insurance policies while enjoining non-settling insurers from pursuing
claims against the repurchasing insurers. In re Fraser’s Boiler Serv., Inc., 2019 WL 1099713(W.D. Wash. Mar. 8, 2019). (Click here for full article)

South Carolina Supreme Court Rules That Non-Signatories Are Not Bound
By Arbitration Clause In Insurance Agency Agreement
The South Carolina Supreme Court ruled that non-signatories to an insurance agency
agreement were not required to arbitrate claims against the parties to the agreement. Wilson v.
Willis, 2019 WL 1549924 (S.C. Apr. 10, 2019). (Click here for full article)

Second Circuit Reinstates Rescission Claim Based On Misrepresentations
The Second Circuit ruled that an insurer can pursue a rescission claim based on
misrepresentations in the policy application, notwithstanding that the insurer’s declaratory
judgment claim as to coverage was dismissed as non-justiciable. U.S. Underwriters Ins. Co. v.
Orion Plumbing & Heating Corp., 2019 WL 1253325 (2d Cir. Mar. 18, 2019). (Click here forfull article)

Insurer May Not Depreciate Labor Costs In Calculating Actual Cash Value,
Says Tennessee Supreme Court
The Tennessee Supreme Court ruled that policy language did not permit an insurer todepreciate labor costs in calculating actual cash value under a property policy. Lammert v.
Auto-Owners (Mutual) Ins. Co., 2019 WL 1592687 (Tenn. Apr. 15, 2019). (Click here forfull article)

New York Department Of Financial Services To Begin Enforcement Of
Cybersecurity Regulations
The grace period for implementation of the cybersecurity regulations enacted by the
Department of Financial Services ended on March 1, 2019. (Click here for full article)

2Collapse Alerts:

Second Circuit Rules That Property
Policies Do Not Cover Crumbling
Concrete Claims
The Second Circuit ruled that a collapse
reinstatement provision in Connecticut
homeowners’ policies does not make coverageavailable for claims arising from the cracking
of basement walls that remain standing. Valls
v. Allstate Ins. Co., 2019 WL 1442081 (2d Cir.
Apr. 2, 2019).
The homeowners’ basement walls wereconstructed with allegedly defective
concrete. They sought coverage for crackingof the walls under all-risk policies issued
by Allstate. The policies expressly exclude
coverage for damage arising from a collapse,
but reinstate coverage for a limited classof collapse events, including a “sudden
and accidental direct physical loss causedby . . . hidden decay . . . [or] defective methods
or materials.” The provision also states that“[c]ollapse does not include settling, cracking,shrinking, bulging or expansion.”
Applying Connecticut law, the Second
Circuit ruled that the collapse reinstatement
provision did not provide coverage for thecracking of the basement walls caused by
gradual deterioration of its concrete. The
court reasoned that gradual erosion could not
be deemed “sudden,” and that in any event,the provision expressly exempted settling andcracking from the scope of coverage. Based on
this ruling, the Second Circuit also affirmed
dismissal of cracking concrete coverage claims
in two other cases (Lees v. Allstate Ins. Co.,2019 WL 1466939 (2d Cir. Apr. 2, 2019) andCarlson v. Allstate Ins. Co., 2019 WL 1466935(2d Cir. Apr. 2, 2019)). A few days before theSecond Circuit rulings, a Connecticut federal
district court reached a similar conclusion ina dispute involving the same policy language.
Huschle v. Allstate Ins. Co., 2019 WL 1427143(D. Conn. Mar. 29, 2019).

Finding Ambiguity In Collapse
Provision, Washington Appellate
Court Reverses And Rules In
Insured’s Favor
Last month’s Alert reported on a First Circuit
decision holding that a collapse provision
was ambiguous and must be interpreted
in the policyholder’s favor. Easthampton
Congregational Church v. Church Mut.
Ins. Co., 2019 WL 851191 (1st Cir. Feb. 22,2019). This month, a Washington appellate
court relied on that decision and deemed anearly-identical provision ambiguous. Feenix
Parkside LLC v. Berkley N. Pac., 2019 WL
1514086 (Wash. Ct. App. Apr. 8, 2019).
The operative policy provision covered
collapse caused by “[d]ecay that is hiddenfrom view.” The coverage dispute centeredon whether the undefined term “decay”
was ambiguous. A Washington trial court
ruled that it was not, finding that it could
reasonably be interpreted to include only
“some kind of decomposition.” Based on
this interpretation, the trial court granted
the insurer’s summary judgment motion,
finding that the failure of the building’s
roof system due to defective construction
methods and excessive temperatures did notconstitute “decay.”
The appellate court reversed, deeming theprovision ambiguous. Citing Easthampton
Congregational Church, the appellate court
explained that “decay” could reasonably
be interpreted broadly to include a gradualdecline in soundness or strength. The court
noted that if the insurer had intended to limit“decay” to organic rot, it could have expressly
done so.

3

Cyber Coverage
Alerts:Insureds Seek Reversal Of No
Duty To Defend Ruling In Data
Breach Suit
A policyholder asked the Eleventh Circuit
to reverse a Florida district court decisionholding that a general liability insurer has no
duty to defend data breach claims. Brief ofAppellant, St. Paul Fire & Marine Ins. Co. v.
Rosen Hotels & Resorts, Inc., No. 18-14427(11th Cir. filed Jan. 9, 2019).
The district court ruled that coverage forbreach of privacy allegations arising from adata breach is available where the publicationof personal information was done by thepolicyholder itself and does not extend toacts undertaken by third-parties. St. PaulFire & Marine Ins. Co. v. Rosen Millennium,
Inc., 2018 WL 4732718 (M.D. Fla. Sept. 28,2018) (discussed in our October 2018 Alert).
The district court granted in part St. Paul’ssummary judgment motion, finding thatthe insurer had no duty to defend under thepolicy’s “personal injury” provision, whichapplied to several enumerated offenses,
including “[m]aking known to any person ororganization covered material that violatesa person’s right of privacy.” The court based
this ruling on the fact that the alleged privacy
violation did not result from Millennium’s
conduct, but rather arose from the actionsof third-party hackers. The district court
relied on Innovak Int’l, Inc. v. Hanover Ins.
Co., 280 F. Supp.3d 1340 (M.D. Fla. 2017)(discussed in our December 2017 Alert), in
which the court held that coverage attaches
under a personal injury provision only where
the insured publishes private information. A
New York court reached the same conclusion
in Zurich Am. Ins. Co. v. Sony Corp. of
America, No. 651982/2011 (N.Y. Sup. Ct.
New York Cty. Feb. 21, 2014), holding that asimilar personal injury policy provision did
not encompass hacking claims where thepublication was committed by hackers rather
than the insured itself (discussed in ourMarch 2014 Alert).
On appeal to the Eleventh Circuit, thepolicyholder has argued, among other things,
that the district court incorrectly implieda requirement into the liability policy byrequiring the insured to be the publishingparty in order for coverage to apply. We willkeep you posted on any developments inthis matter.

Pennsylvania Court Rules That
Insurer Must Defend Cyberbullying
Claims Arising From Suicide
A Pennsylvania district court ruled thata homeowner’s insurer must defend
cyberbullying claims arising from a teenager’s
suicide, finding that a covered “occurrence”
was alleged. State Farm Fire & Cas. Co. v.
Motta, 356 F. Supp. 3d 457 (E.D. Pa. 2018).

A high school student died by suicide after
being the target of cyberbullying by a fellow
student. The decedent’s parents sued thealleged bully and his parents, alleging that
he negligently caused their daughter’s
death. State Farm defended the suit under areservation of rights and filed a declaratory
judgment action, seeking a ruling that it had
no duty to defend or indemnify the claims.
State Farm argued that there was no covered“occurrence” (defined as an “accident’)because the alleged bully sent the text
messages intentionally. The court disagreed
and granted a motion for judgment on thepleadings as to State Farm’s duty to defend.
Addressing this matter of first impression
under Pennsylvania law, the court held thatthe underlying suit alleged an occurrence
because suicide was not a foreseeable injury
from the alleged bully’s perspective. The court
distinguished cases involving intentional
physical acts by the insured, noting that thecausal chain in such cases was direct, whereasa “more complex” and “nuanced” chain of
alleged causation existed between the text
messages and the self-inflicted death. The
court also emphasized that although theunderlying complaint used words such as“intentional” and “harassment,” it alleged4negligence rather than intentional torts.
Notably, the court expressed no opinion as towhether it would reach a different outcome if
the decedent’s parents alleged only a claim forintentional infliction of emotional distress.

Coverage Alerts:

Fifth Circuit Rules That Insurer
Owes Defense To Church In
Election Law Violation Suit
The Fifth Circuit ruled that an insurer was
obligated to defend a church against claims
alleging Texas Election Code violations.
Word of Life Church of El Paso v. State Farm
Lloyds, 2019 WL 1324845 (5th Cir. Mar.
22, 2019).
El Paso Mayor John Cook sued the Word ofLife Church, alleging violations of the Texas
Election Code. The suit alleged that Tom
Brown, pastor, president and chairman of
the church, violated state law by circulating
and submitting petitions seeking a recall
election to remove Cook and two other elected
representatives from office. A Texas appellate
court concluded that the church violated
the Election Code and issued injunctive
relief requiring decertification of the recall
petition. Thereafter, the parties entered into a
judgment agreement for $475,000.
The church sought indemnification for the
judgment and $450,000 in attorneys’ feesfrom State Farm under a D&O policy thatprovided coverage for “wrongful acts” defined
as “any negligent acts . . . directly related tothe operations of your church.” When State
Farm denied coverage, the church brought
suit, alleging breach of contract and bad faith.
A Texas district court granted State Farm’s
summary judgment motion, concludingthat it had no duty to defend or indemnify.

The district court reasoned that Brown’s
actions relating to the recall election werenot “directly related to the operations” of thechurch. The Fifth Circuit reversed.
Applying an “eight corners analysis,” the Fifth
Circuit held that the underlying allegationsof Election Code violations gave rise to a duty
to defend. The Fifth Circuit explained thatthe complaint sufficiently alleged a direct
relationship between Brown’s activities andchurch operations because the complaintclaimed that Brown, in his capacity as church
director and pastor, caused the church toviolate state law. In so ruling, the court notedthat the district court erred in focusing onwhether political actions were within therealm of “typical” church operations, rather
than on the particular conduct alleged in thecomplaint. The Fifth Circuit also ruled thata criminal acts exclusion did not negate theduty to defend because the Texas Election
Code does not specify that a violation of its
provisions constitutes a criminal act. As to theduty to indemnify, the court ruled that issuesof fact existed as to whether Brown’s conduct
was directly related to church operations.

Restaurant’s Superstorm Sandy
Losses Not Covered Under
Civil Authority Provision, Says
New Jersey Appellate Court
A New Jersey appellate court ruled thata restaurant that was closed for several
weeks following Superstorm Sandy was notentitled to coverage under a “civil authority”
provision. Maritime Park, LLC v. Nova Cas.
Co., 2019 WL 1422918 (N.J. Super. Ct. App.
Div. Mar. 29, 2019).
Maritime Park, the owner of a restaurant
located in a municipal park on the New Jersey
waterfront, was forced to close operations
for several weeks following Superstorm
Sandy. The New Jersey Department ofEnvironmental Protection issued an orderclosing the park prior to landfall of thestorm. The restaurant remained closed forseveral weeks and thereafter operated on acurtailed schedule. During the relevant timeframe, Maritime Park was insured by Nova
Casualty, which paid approximately $82,000
under a utility services provision based on
the restaurant’s power outage. Maritime
Park sought additional coverage under acivil authority provision, which the insurer
5denied. A New Jersey trial court granted Nova
Casualty’s summary judgment motion, andthe appellate court affirmed.
The civil authority provision states: “Whena Covered Cause of Loss causes damage
to property other than property at thedescribed premises, we will pay for the actual
loss of Business Income you sustain andnecessary Extra Expense caused by actionof civil authority that prohibits access to thedescribed premises.” The appellate court
explained that this language requires theprohibition on access to the property to be
the result of damage caused by a “covered
cause of loss.” The policy expressly excluded
water as a covered cause of loss, including
damage caused by water in combination withwind, storm surge or other perils. The court
therefore held that even if the state agency’s
closure order caused Maritime Park to losebusiness revenue, the civil authority provision
was inapplicable because the circumstances
did not involve a “covered cause of loss.”
In so ruling, the court noted that “[i]t isinconsequential that Maritime’s property
itself was not damaged by flooding. Due tothe anti-concurrent cause provision, the Civil
Authority language affords no coverage where
the restrictions on Park access were produced,
at least in part, by flooding.”

Bankruptcy Alert:
Washington Court Rejects PlanThat Commutes Certain Policies
While Enjoining Claims By NonSettling Insurers

A Washington district court ruled that afederal bankruptcy court erred in approving aplan that commuted certain insurance policies
while enjoining non-settling insurers frompursuing claims against the repurchasing
insurers. In re Fraser’s Boiler Serv., Inc.,
2019 WL 1099713 (W.D. Wash. Mar. 8, 2019).
Fraser’s Boiler Service (“FBS”), a former
manufacturer of asbestos-containing
products, became insolvent. A receiver
took over its assets for the sole purpose ofpaying asbestos claims. FBS was not eligible
for an asbestos trust under § 524(g) of the
Bankruptcy Code because it had no ongoing
business. FBS proposed a reorganization
plan in which FBS would sell back generalliability policies to certain insurers for $11.66
million in exchange for mutual releases. The
settlement was styled as a § 363 sale free andclear of claims related to the repurchased
policies. The plan also enjoined non-settlinginsurers from asserting contribution orindemnity claims against the commuting
insurers. A bankruptcy court approved
the plan over the non-settling insurers’
objections. The district court reversed.

The district court ruled that the bankruptcy
court lacked jurisdiction to issue a final
judgment and that Ninth Circuit precedentprohibited a sale free and clear of thirdparty claims. Although the district court
ruled that the bankruptcy court did nothave “core” jurisdiction to enjoin the nonsettling insurers’ claims, it concluded that thebankruptcy court had “non-core” jurisdiction
over the sale and injunction based on the“undeniable relationship” between the interinsurer claims and FBS’s ability to sell backits policies. The district court also ruled thatthe bankruptcy court did not have authority
to issue an injunction in light of § 524(e)which mandates that “discharge of a debt
of the debtor does not affect the liability of
any other entity on, or the property of any
other entity for, such debt.” In rejecting the
injunction, the court emphasized that Ninth
Circuit precedent unequivocally precludes
bankruptcy courts from discharging theliabilities of non-debtors. The court noted thatsome bankruptcy courts have distinguishedthat precedent and allowed such injunctions
under certain circumstances, but deemed
those decisions erroneous. The court notedthat even if it were to recognize an exception
so as to allow an injunction of inter-insurer
claims, the injunction at issue would still be
impermissible as overly broad.
Finally, the court held that the bankruptcy
court lacked power to approve the sale of6the policies free and clear of the non-settlinginsurers’ claims under § 363. The court
explained that the inter-insurer claims werenot “an interest in [FBS’s] property,” asrequired by § 363(f), and that the sale did
not comply with § 363(f)(1), which requires
non-bankruptcy law to permit the sale of suchproperty free and clear. As to the latter issue,
the court noted that Ninth Circuit precedent
did not permit the sale and that in any event,
the settlement did not adequately protect theinterests of the non-settling insurers.

Arbitration Alert:

South Carolina Supreme Court
Rules That Non-Signatories Are
Not Bound By Arbitration Clause
In Insurance Agency Agreement
The South Carolina Supreme Court ruledthat non-signatories to an insurance agency
agreement were not required to arbitrate
claims against the parties to the agreement.
Wilson v. Willis, 2019 WL 1549924 (S.C. Apr.
10, 2019).
Numerous policyholders and insurance agents
filed lawsuits against an insurance agent, abroker and six insurance companies, alleging
fraud and unfair trade practices, among otherclaims. The suits alleged that the agent andbroker forged documents and engaged in
unfair and illegal tactics to “corner the retailinsurance market” and that the insurers
failed to properly supervise those individuals.
Three insurers moved to compel arbitration
based on an arbitration clause in their Agency
Agreement. The insurers argued that theplaintiffs were third-party beneficiaries to
the Agency Agreement and/or were equitably
estopped from asserting their non-party
status. A trial court denied the motions. An

appellate court reversed, ruling that plaintiffs
were equitably estopped from arguing that
their status as non-signatories to the Agency
Agreement precluded enforcement of thearbitration clause because plaintiffs sought tobenefit from enforcement of other provisions
in that agreement.
The South Carolina Supreme Court
reversed. As a preliminary matter, the courtemphasized that the presumption in favorof arbitration applies to claims that areencompassed by an arbitration agreement,
but not to the identity of the parties whoare bound by such an agreement. With
respect to the equitable estoppel issue, thecourt emphasized that in order for nonsignatories to be precluded from relying on
their non-signatory status, they must seek a“direct benefit” from the contract containing
the arbitration clause. In other words, forequitable estoppel to apply, non-signatories
must “consistently maintain[] that otherprovisions of the same contract should be
enforced to benefit [them].”
The South Carolina Supreme Court concluded
that this standard was not met because theplaintiffs “have not knowingly exploitedand received a direct benefit from the
Agency Agreement.” The court noted thatplaintiffs were not aware of the existence of
the Agency Agreement until they brought
their tort actions against the defendants.
The court acknowledged that while someof the claims (e.g., failure to issue policies,
respondeat superior) would not have arisenin the absence of the Agency Agreement,“direct benefits estoppel is not implicatedsimply because a claim relates to or would nothave arisen ‘but for’ a contract’s existence.”
The court stated: “when the benefits to anonsignatory are merely indirect, arbitration
cannot be compelled.”7

Rescission Alert:
Second Circuit Reinstates
Rescission Claim Based On
Misrepresentations

The Second Circuit ruled that an insurer
can pursue a rescission claim based on apolicyholder’s misrepresentations in thepolicy application, notwithstanding that theinsurer’s declaratory judgment claim as tocoverage was dismissed as non-justiciable.
U.S. Underwriters Ins. Co. v. Orion Plumbing& Heating Corp., 2019 WL 1253325 (2d Cir.
Mar. 18, 2019).
Underwriters cancelled a policy issued
to Orion based on the non-payment ofpremiums. Prior to cancellation, a property
owner named as a defendant in a personal
injury suit filed a third party complaint
against Orion, a construction company.
The claims against the property owner weredismissed.

Underwriters sued Orion seeking adeclaration of no coverage for the underlying
claims and rescission ab initio of thepolicy based on misrepresentations in theapplication relating to the nature of Orion’sconstruction work. A New York district
court ruled that Underwriters failed topresent a case or controversy, finding that“an attenuated chain of contingencies”
would have to occur before Orion could seek
coverage from Underwriters. Underwriters
did not appeal the dismissal of the declaratory
judgment claim, but objected to dismissal of
the rescission claim.
The Second Circuit reversed, finding that
Underwriters alleged a justiciable claim
for rescission, even absent a pending
coverage claim. The Second Circuit reasoned
that Underwriters alleged a “reasonable

likelihood that it will face liability to Orion,
based, at minimum, on its duty to defend
Orion” against any claims by the property
owner or other litigation arising out of
the underlying injury. Further, the court
noted that Underwriters alleged that Orion
misrepresented the nature of its work when
it applied for coverage and that it would
have charged a higher premium, issued adifferent policy, or declined to issue coveragealtogether had it known the true natureof Orion’s construction work. The court
concluded that these collective allegations
were sufficient to establish a case orcontroversy as to rescission.

Property
Insurance Alert:

Insurer May Not Depreciate
Labor Costs In Calculating ActualCash Value, Says Tennessee
Supreme Court
Courts across jurisdictions have reacheddifferent conclusions as to whether laborcosts can be depreciated for the purposesof calculating actual cash value (“ACV”)
under a property policy. (See March 2017
Alert, January and February 2016 Alerts).
This month, the Tennessee Supreme Court
weighed in, ruling that policy language did
not expressly permit an insurer to depreciatelabor costs in determining ACV. Lammert
v. Auto-Owners (Mutual) Ins. Co., 2019 WL
1592687 (Tenn. Apr. 15, 2019).
Two sets of homeowners filed a putative classaction against Auto-Owners, alleging that theinsurer improperly depreciated both laborcosts and materials in calculating the ACV ofdamaged property. One policy defined ACV
as “the cost to replace damaged property withnew property of similar quality and features
reduced by the amount of depreciation
applicable to the damaged property
immediately prior to loss.” The other policy
did not define ACV but stated that it includes
a deduction for depreciation. Neither policy
specifically mentioned labor costs.
The Tennessee Supreme Court ruled thatthe language in both policies is ambiguous.
The court explained that inclusion of the8terms “damaged property” and “prior toloss” suggests that depreciation applies
only to materials because labor is intangible
and labor costs are post-loss expenses.
Additionally, the court noted that the policies’
definition of depreciation as “a decrease invalue because of age, wear, obsolescenceor market value” indicated that it did notinclude labor because labor does not age,wear or become obsolete. Construing theseambiguities in favor of the insureds, the court
concluded that depreciation could be applied
only to the costs of materials.
As discussed in our December 2018 Alert,
the Eighth Circuit affirmed an Arkansas
district court decision certifying a class of
homeowners who alleged that a property
insurer improperly withheld amounts forlabor depreciation when making claim
payments. Stuart v. State Farm Fire &Cas. Co., 2018 WL 6358447 (8th Cir. Dec.
6, 2018).

Regulatory Alert:
New York Department Of Financial
Services To Begin Enforcement Of
Cybersecurity Regulations
As discussed in our May 2018 Alert, theDepartment of Financial Services (“DFS”)
enacted cybersecurity regulations applicable
to entities subject to New York banking,insurance and financial services laws(“Covered Entities”). The regulations impose

certain minimum requirements on Covered
Entities for cybersecurity practices, including
the maintenance of a cybersecurity program
and response plan, the designation of a senior
officer to oversee cybersecurity, routine
risk assessment, notification of a security
incident to the DFS and annual compliancecertification. See N.Y. Comp. R. & Regs. tit.
23 § 500 (2017).
Since the March 2017 enactment of theregulations, a series of transition periods
have provided Covered Entities with time
to implement policies that comply with theregulations. This grace period ended on
March 1, 2019, with all Covered Entities
now obligated to have written cybersecurity
policies and procedures in place. In coming
months, the DFS’s approach to enforcementof its regulations will reveal the extent ofpermissible flexibility in a Covered Entity’s
cybersecurity program. One notable areaof interest to many Covered Entities is themanner and extent to which the DFS will
enforce cybersecurity requirements relating
to information held by third-party vendors,
particularly given the broad scope of “vendor”
under the new regulations. Under the
regulations, Covered Entities are obligated toregularly audit vendors to ensure compliancewith cybersecurity measures. Additionally,
as official enforcement of the regulations gets
underway, the DFS may have the opportunity
to clarify the scope of events that constitutea reportable incident subject to the 72-hour
window for reporting data breaches. We willkeep you informed of developments relating
to the enforcement of these regulations.

9Simpson Thacher has been an international leader in the practice of insurance and reinsurance law for
more than a quarter of a century. Our insurance litigation team practices worldwide.

Mary Beth Forshaw+1-212-455-2846
mforshaw@stblaw.com

Michael D. Kibler+1-310-407-7515
mkibler@stblaw.com

Susannah S. Geltman+1-212-455-2762
sgeltman@stblaw.com

Andrew T. Frankel+1-212-455-3073
afrankel@stblaw.com

Michael J. Garvey+1-212-455-7358
mgarvey@stblaw.com

Elisa Alcabes+1-212-455-3133
ealcabes@stblaw.com

Lynn K. Neuner+1-212-455-2696
lneuner@stblaw.com

Tyler B. Robinson+44-(0)20-7275-6118
trobinson@stblaw.com

Summer Craig+1-212-455-3881
scraig@stblaw.com

Chet A. Kronenberg+1-310-407-7557
ckronenberg@stblaw.com

George S. Wang
+1-212-455-2228
gwang@stblaw.com

Daniel J. Stujenske+1-212-455-2419
dstujenske@stblaw.com

Bryce L. Friedman+1-212-455-2235
bfriedman@stblaw.com

Craig S. Waldman+1-212-455-2881
cwaldman@stblaw.com

This edition of the
Insurance Law Alert was
prepared by Mary Beth Forshaw
mforshaw@stblaw.com /+1-212-4552846 and Bryce L. Friedman
bfriedman@stblaw.com /+1-212-4552235 with contributions
by Karen Cestarikcestari@stblaw.com.

The contents of this publication are for informational purposes only. Neither this publication nor the
lawyers who authored it are rendering legal or other professional advice or opinions on specific facts
or matters, nor does the distribution of this publication to any person constitute the establishment of an
attorney-client relationship. Simpson Thacher & Bartlett LLP assumes no liability in connection withthe use of this publication. Please contact your relationship partner if we can be of assistance regardingthese important developments. The names and office locations of all of our partners, as well as ourrecent memoranda, can be obtained from our website, www.simpsonthacher.com.
Please click here to subscribe to the Insurance Law Alert.
10SimpsonThacherWorldwide

UNITED STATESEUROPE

SOUTH AMERICANew York
425 Lexington Avenue
New York, NY 10017+1-212-455-2000

LondonCityPoint
One Ropemaker Street
London EC2Y 9HUEngland+44-(0)20-7275-6500

São Paulo
Av. Presidente Juscelino
Kubitschek, 1455
São Paulo, SP 04543-011
Brazil+55-11-3546-1000

Houston
600 Travis Street, Suite 5400
Houston, TX 77002+1-713-821-5650
Los Angeles
1999 Avenue of the Stars
Los Angeles, CA 90067+1-310-407-7500
Palo Alto
2475 Hanover Street
Palo Alto, CA 94304+1-650-251-5000
Washington, D.C.
900 G Street, NW
Washington, D.C. 20001+1-202-636-5500

ASIA

Beijing
3901 China World Tower A
1 Jian Guo Men Wai Avenue
Beijing 100004
China+86-10-5965-2999
Hong Kong
ICBC Tower
3 Garden Road, Central
Hong Kong+852-2514-7600
Tokyo
Ark Hills Sengokuyama Mori Tower
9-10, Roppongi 1-Chome
Minato-Ku, Tokyo 106-0032
Japan+81-3-5562-6200

11