Source: https://www.jdsupra.com/legalnews/isos-newly-filed-data-breach-exclusions-90953/
Timestamp: 2019-04-20 07:12:26+00:00

Document:
Here a breach, there a breach, everywhere a data breach. Verizon’s most recent 2013 Data Breach Investigations Report remarks that “[p]erhaps more so than any other year, the large scale and diverse nature of data breaches and other network attacks took center stage” this year.  And no organization is immune from a breach. The last two years have seen some of the world’s most sophisticated corporate giants fall victim to some of the largest data breaches in history. It is clear that cyber attacks -- including data breaches -- are on the rise with unprecedented frequency, sophistication and scale. They are pervasive across industries and geographical boundaries. And they represent “an ever-increasing threat.”  The problem of cyber risks is exacerbated, not only by increasingly sophisticated cyber criminals and evolving malware, but also by the trend in outsourcing of data handling, processing and/or storage to third-party vendors, including “cloud” providers, and by the simple reality of the modern business world, which is full of portable devices such as cell phones, laptops, iPads, USB drives, jump drives, media cards, tablets and other devices that may facilitate the loss of sensitive information.
While data breaches and other types of cyber risks are increasing, laws and regulations governing data security and privacy are proliferating. In its most recent 2013 Cost of Data Breach Study, the Ponemon Institute reports that U.S. organizations spend on average $565,020 on post-breach notification alone.  Companies may also face lawsuits seeking damages for invasion of privacy, as well as governmental and regulatory investigations, fines and penalties, damage to brand and reputation, and other negative repercussions from a data breach, including those resulting from breaches of Payment Card Industry Data Security Standards. The Ponemon Institute’s recent study reports that the average organizational cost of a data breach in 2012 was $188 per record for U.S. organizations ($277 in the case of malicious attacks) and the average number of breached records was 28,765, for a total of $5,407,820.00.  The study does not “include organizations that had data breaches in excess of 100,000” records,  although large-scale breaches clearly are on the rise. In the face of these daunting facts and figures, it is abundantly clear that network security alone cannot entirely address the issue; no firewall is unbreachable, no security system impenetrable.
(2) The loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data.
“Personal and advertising injury” arising out of any access to or disclosure of any person’s or organization's confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of non public information.
ISO states that “when this endorsement is attached, it will result in a reduction of coverage due to the deletion of an exception with respect to damages because of bodily injury arising out of loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data” and that “[t]o the extent that any access or disclosure of confidential or personal information results in an oral or written publication that violates a person's right of privacy, this revision may be considered a reduction in personal and advertising injury coverage.”  While acknowledging that coverage for data breaches is currently available under its standard forms, ISO explains that “[a]t the time the ISO CGL and [umbrella] policies were developed, certain hacking activities or data breaches were not prevalent and, therefore, coverages related to the access to or disclosure of personal or confidential information and associated with such events were not necessarily contemplated under the policy.”  The scope of this exclusion ultimately will be determined by judicial review.
Although it may take some time for the new (or similar) exclusions to make their way into general liability policies, and the full reach of the exclusions remains unclear, they provide another reason for companies to carefully consider specialty “cyber” insurance products. Even where insurance policies do not contain the newer limitations or exclusions, insurers may argue that cyber risks are not covered under traditional policies. The brewing legal dispute between Sony and its insurers concerning the PlayStation Network data breach highlights the challenges that companies can face in getting insurance companies to cover losses arising from cyber risks under CGL policies. In its recent motion for partial summary judgment, Sony argues that there is data breach coverage because “[t]he MDL Amended Complaint… alleges that plaintiffs suffered the ‘loss of privacy’ as the result of the improper disclosure of their ‘Personal Information’ [which] has been held to constitute ‘material that violates a person’s right of privacy’.”  However, the insurers seek a declaration that there is no coverage under the CGL policies at issue, among other reasons, on the basis that the underlying lawsuits “do not assert claims for… ‘personal and advertising injury’.”  The Sony coverage suit does not represent the first time that insurers have refused to voluntarily pay claims resulting from a network security breach or other cyber-related liability under CGL policies. Nor will it be the last. Even where there is a good claim for coverage, insurers can be expected to continue to argue that cyber risks are not covered under CGL or other “traditional” policies.
legal services to determine an insured’s indemnification rights where a third party’s error or omission has caused the problem.
Cyber insurance policies offer other types coverages as well, including media liability coverage (for claims for alleging, for example, infringement of copyright and other intellectual property rights and misappropriation of ideas or media content), first party property and network interruption coverage, and cyber extortion coverage. The cyber policies can be extremely valuable. But selecting and negotiating the right cyber insurance product presents a real and significant challenge. There is a dizzying array of cyber products on the marketplace, each with their own insurer-drafted terms and conditions, which vary dramatically from insurer to insurer—even from policy to policy underwritten by the same insurer. Because of the nature of the product and the risks that it is intended to cover, successful placement requires the involvement and input, not only of a capable risk management department and a knowledgeable insurance broker, but also of in-house legal counsel and IT professionals, resources and compliance personnel—and experienced insurance coverage counsel.
 Verizon, 2013 Data Breach Investigations Report, at 1 (2013).
 PwC State of Cybercrime Survey, at 1 (June 2013).
 2013 Cost of Data Breach Study: Global Analysis, Ponemon Institute LLC, at 16 (May 2013).
 SEC Division of Corporation Finance, CF Disclosure Guidance: Topic No. 2, Cybersecurity (Oct. 13, 2011).
 ISO is an insurance industry organization whose role is to develop standard insurance policy forms and to have those forms approved by state insurance commissioners.
 ISO Form CG 00 01 04 13 (2012), Section I, Coverage B, §1.a.
 See, e.g., Park Univ. Enters., Inc. v. American Cas. Co. Of Reading, PA, 442 F.3d 1239, 1251 (10th Cir. 2006) (Kansas law) (upholding coverage for alleged violations of the TCPA and rejecting the insurer’s attempt to ascribe narrow meaning to the undefined terms “privacy” and “publication”); Zurich American Ins. Co. v. Fieldstone Mortgage Co., 2007 WL 3268460, at *5 (D.Md. Oct. 26, 2007) (Maryland law) (upholding coverage for FCRA claims and noting that “[o]f the circuits to examine ‘publication’ in the context of an ‘advertising injury’ provision, the majority have found that the publication need not be to a third party”); Pietras v. Sentry Ins. Co., 2007 WL 715759, at *2-3 (N.D.Ill. Mar. 6, 2007) (upholding coverage for alleged violations of the FCRA, noting that “‘publication’ in a policy providing coverage for ‘advertising injury’ includes communication to as few as one person, thereby resulting in coverage for violations of a statute invoking privacy interests, such as the FPCA”) (following Valley Forge Ins. Co. v. Swiderski Elec., Inc., 860 N.E.2d 307 (Ill. 2006)); Columbia Cas. Co. v. HIAR Holding, L.L.C., --- S.W.3d ----, 2013 WL 4080770, at *9 (Mo. Aug. 13, 2013). (upholding coverage alleging violations of the TCPA, concluding that “a reasonable interpretation of [the] policy can include that coverage is available for the privacy rights claims of the class”); Penzer v. Transportation Ins. Co., 29 So.3d 1000, 1008 (Fla. 2010) (holding that “an advertising injury provision in a commercial liability policy that provides coverage for an ‘oral or written publication of material that violates a person’s right of privacy’ provides coverage for blast-faxing in violation of the TCPA”). See also Netscape Commc’ns Corp. v. Federal Ins. Co., 343 Fed.Appx. 271 (9th Cir. 2009), aff’g 2007 WL 1288192 (N.D. Cal. Apr. 27, 2007) (upholding coverage for claims alleging that the insured’s “SmartDownload” software violated the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act by, among other things, “collecting, storing, and disclosing… claimants’ Internet usage,” which was “used… to create opportunities for targeted advertising”).
 ISO Form CG 00 01 04 13 (2012), Section I, Coverage A, §§1.a., 1.b.(2).
 ISO Form CG 00 01 04 13 (2012), Section I, Coverage B, §2.p.
 See, e.g., Nationwide Mutual Fire Ins. Co. v. First Citizens Bank and Trust Co. Inc., et al., No. 4:13cv598 (D.S.C.), Complaint ¶¶23, 55 (filed Mar. 6, 2013); Hartford Fire Ins. Co. v. Euromarket Designs, Inc., No. 1:11-cv-03008 (N.D. Ill.), Complaint ¶¶9, 35 (filed May 5, 2011).
 See CG 24 13 04 13 (2012) (“With respect to Coverage B Personal And Advertising Injury Liability, Paragraph 14.e. of the Definitions section does not apply”).
 CG 21 07 05 14 (2013). “Electronic data” is defined as “information, facts or programs stored as or on, created or used on, or transmitted to or from computer software, including systems and applications software, hard or floppy disks, CD-ROMS, tapes, drives, cells, data processing devices or any other media which are used with electronically controlled equipment.” Id.
 ISO Commercial Lines Forms Filing CL-2013-0DBFR, at p. 8.
 Memorandum of Law in Support of the Motion of Sony Corporation of America and Sony Computer Entertainment America LLC for Partial Summary Judgment Declaring That Zurich and Mitshui Have a Duty to Defend, at p. 14, filed May 10, 2013 in Zurich American Insurance Co., et al. vs. Sony Corp. of America, et al., No. 651982/2011 (N.Y. Sup. Ct. New York Cty.).
 See AIG Specialty Risk Protector® Specimen Policy Form 101014 (11/09), Security and Privacy Coverage Section.
 Id. Section 2.(d). “Security Breach Notice Law” includes “any statute or regulation that requires an entity storing Confidential Information on its Computer System, or any entity that has provided Confidential Information to an Information Holder, to provide notice of any actual or potential unauthorized access by others to Confidential Information stored on such Computer System, including but not limited to, the statute known as California SB 1386 (§1798.82, et. al. of the California Civil Code).” Id. Section 2.(m).

References: §1
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 §2
 v. 
 v.