Source: https://www.zelle.com/news-publications-236.html
Timestamp: 2019-04-26 00:52:19+00:00

Document:
Although specific cyber risk insurance policies are becoming increasingly common, claims related to data breaches continue to be submitted under commercial general liability policies. Some recent decisions addressing these claims provide helpful guidance for practitioners in this area.
It is well known that over the last few years, there has been a significant increase of data breaches, that is, incidents compromising the security of data stored electronically by an organization. This has been accompanied by the development and growth of specialty cyber insurance products specifically designed to address these, and other, cyber-related risks confronting businesses today.
Notwithstanding the expansion of cyber risk insurance, policyholders continue to submit claims arising out of data breaches under their traditional CGL policies. This is due to a variety of reasons, including that the agreed-upon limits of liability under the insured’s cyber risk policy turn out to be insufficient to cover the losses resulting from the data breach; an exclusion or other provision precludes or limits coverage for the particular claim; or the company simply did not purchase cyber liability coverage.
Therefore, CGL policies continue to play a significant role in ascertaining the scope of coverage available for third-party claims arising out of data breaches. Indeed, some recent, high-profile coverage disputes in this area have involved claims brought by large corporate policyholders seeking coverage under the “personal and advertising injury” provisions of their CGL policies for the class action and other claims brought against them after computer hackers stole their customers’ personal information.
In analyzing the legal issues involved in these types of claims, several recent court decisions involving claims brought under a CGL policy for the insured’s alleged liability for the loss or misappropriation of the claimant’s electronic data may be relevant to practitioners as this is often the basis of at least some of the claims asserted against companies affected by a data breach.
However, in contrast, another court held that where the loss alleged in the underlying lawsuit involves the medium on which data was stored (in that case, a CD-ROM containing third parties’ personal information), there is a potentially covered claim for “property damage” under a CGL policy.
It should be noted that even if the coverage for “property damage” is potentially triggered, other provisions in the policy may apply to limit or preclude coverage. Indeed, in this same case, the Seventh Circuit affirmed summary judgment for the insurer on the ground that the exclusion for property “in care of” the insured applied to the insured’s loss of the CD-ROM, thus barring any recovery under the insured’s CGL policy.
Coverage for such claims may depend on the interpretation given to the term “publication” in the relevant jurisdiction. As recent decisions show, in some states, a “publication” requires dissemination of the personal information to the general public, and in others, there must be a communication to a third party.
Other courts, however, have taken a more expansive view of the term “publication.” The choice-of-law issue may thus be outcome-determinative in these types of claims.
Case law involving liability insurance coverage for claims arising out of electronic data breaches continues to develop. The decisions mentioned in this article signal some important issues and trends, which practitioners in this area need to consider when analyzing these types of claims.
 See Liberty Corporate Capital Ltd. v. Security Safe Outlet Inc. (E.D. Ky. Mar. 27, 2013); Recall Total Info. Mgmt., Inc. v. Federal Ins. Co. (Conn. Super. Ct. Jan. 17, 2012); Carlon Co. v. Delaget, LLC (W.D. Wis. May 21, 2012).
 Nationwide Ins. Co. v. Hentz (S.D. Ill. Mar. 6, 2012).
 Nationwide Ins. Co. v. Central Laborers’ Pension Fund, 704 F.3d 522, 525-26 (7th Cir. 2013).
 Creative Hospitality Ventures, Inc. v. U.S. Liab. Ins. Co., 444 Fed.Appx. 370, 375-76 (11th Cir. 2011) (applying Florida law).
 Recall Total, 2012 WL 469988 at *6-7.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v.