Electronic Data Liability Coverage Form
ISO Claims-Made Form
September 28, 2015
Summary: The standard CGL form specifically notes that electronic data is not tangible property, and specifically excludes coverage for damages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data. Therefore, in order to provide some coverage for this type of exposure, a separate coverage form has been developed by the Insurance Services Office (ISO). The coverage form is CG 00 65 04 13; this is a claims-made policy. The policy was updated in 2013. Those revisions are highlighted in this article.
Topics covered:
Insuring agreement
Exclusions
Supplementary payments
Who is an insured
Limits of insurance
Electronic data liability conditions
Extended reporting period
Definitions
Insuring Agreement
1.We will pay those sums that the insured becomes legally obligated to pay as damages because of “loss of electronic data” to which this insurance applies. We will have the right and duty to defend the insured against any “suit” seeking those damages. However, we will have no duty to defend the insured against any “suit” seeking damages to which this insurance does not apply. We may, at our discretion, investigate any “electronic data incident” and settle any claim or “suit” that may result. But:
a.The amount we will pay for damages is limited as described in Section III—Limit of Insurance; and
b.Our right and duty to defend ends when we have used up the applicable limit of insurance in the payment of judgments or settlements.
No other obligation or liability to pay sums or perform acts or services is covered unless explicitly provided for under Supplementary Payments.
2.This insurance applies to “loss of electronic data” only if:
a.The “loss of electronic data”:
(1)Is caused by an “electronic data incident”;
(2)Takes place in the “coverage territory”; and
(3)Did not occur before the Retroactive Date, if any, shown in the Declarations or after the end of the policy period; and
b.A claim for damages because of the “loss of electronic data” is first made against any insured, in accordance with Paragraph c. below, during the policy period or any Extended Reporting Period we provide under Section V—Extended Reporting Period.
Analysis
This insuring agreement binds the insurer to pay the sums that the insured becomes legally obligated to pay as damages because of loss of electronic data. Loss of electronic data is a phrase that is defined in the definitions section of the policy and will be discussed later in this article; but suffice it to say that the insuring agreement applies to damages the insured causes to electronic data such as information or programs stored in computers, tapes, CD-ROMS, and other media used with electronically controlled equipment. With more and more cyber breaches occurring on an almost daily basis, this coverage is particularly important. The cause of loss must be due to an electronic data incident. An electronic data incident is an accident or negligent act, error or omission, or series of causally related accidents, negligent acts, errors or omissions that result is a “loss of electronic data” (defined term). For example; an employee is working remotely from a coffee shop, and leaves his laptop signed on and unattended while using the restroom. Another patron mistakes the laptop for his own and proceeds to delete data and inadvertently corrupt the laptop before realizing he is not on his own machine. The loss of and corruption of data would be covered.
The insurer also agrees to defend the insured against any lawsuit seeking damages because of that loss of electronic data. This is important due to all the instances of hacked customer information and medical information from various stores and medical providers. The insurer reserves to itself the right to settle any claim or lawsuit and the insured has no say in this matter. This happens frequently, as it may be less expensive to settle a suit than to defend the insured. The amount the insurer will pay on behalf of the insured is limited, based on the limitations as set forth in the limits of insurance section of the policy. And, the insurer points out that the duty to defend ends when the applicable limit of insurance is used up only in the payment of judgments or settlements; that is, the duty to defend cannot be ended simply by the insurer tendering the policy limits and then trying to abandon the defense of the insured, and it cannot be ended by the insurer paying defense costs that may equal or surpass the declared limits of insurance.
This insuring agreement does have its limitations. The insurance applies only if the loss of electronic data is caused by an electronic data incident (a defined term) that takes place in the coverage territory (a defined term). The loss has to occur during the policy period and, in keeping with the claims-made nature of the policy, the claim for damages has to be first made against any insured during the policy period, or any extended reporting period that is provided to the insured (extended reporting periods are discussed later in this article).
1.A claim by a person or organization seeking damages will be deemed to have been made at the earlier of the following times:
a.When notice of such claim is received and recorded by any insured or by us, whichever comes first; or
b.When we make a settlement in accordance with Paragraph 1. above.
All claims for damages because of “loss of electronic data” arising out of an “electronic data incident” shall be deemed to have been made at the time the first of those claims is made against any insured.
A claim received and recorded by the insured within 30 days after the end of the policy period will be considered to have been received within the policy period. However, this 30 day period does not apply to claims that are covered under any subsequent insurance you purchase, or that would be covered but for the exhaustion of the amount of insurance applicable to such claims.
Analysis
Coverage for a claim under a claims-made policy depends on the claim being first made against the insured during the policy period. Since this is crucial to the coverage, it is helpful to the insured to know when a claim is deemed to have been made. When the insured or the insurer receives and records the notice of a claim, or when the insurer makes a settlement in accordance with the agreement to pay clause, that is the time when the policy notes that the claim is made.
It is interesting to note that the notice of a claim can be received and recorded by either the insured or by the insurer. Questions may then arise: if the insured receives and records the notice of claim but does not inform the insurer, have the requirements of the claims-made insuring agreement been met? If the insurer is not informed of the claim within the policy period, can it deny coverage even though the claim has been first made during the policy period? To answer these questions, one has to look at the duties of the insured in the event of an electronic incident. If a claim is received by any insured, the named insured must immediately record the specifics of the claim, the date received, and must notify the insurer in writing as soon as practicable. So, if this duty is breached by the insured, it may very well be that the insurer could use that breach of contract as a reason to invalidate the policy coverage. To avoid such a dispute, the insured should always notify the insurer of any electronic data incident and always notify the insurer of a claim as soon as the insured becomes aware of such actions.
All claims for damages arising out of an electronic data incident are deemed to have been made at the time the first of those claims is made against any insured. An example of how this provision might apply is as follows: A person injured by a loss of electronic data due to the insured's negligence on December 30, 2009 makes a claim during the policy period September 1, 2009 to September 1, 2010. This claim is covered and the damages are paid by the insurer. If, in a later policy period, such as October 30, 2010, the claimant discovers more damage due to that loss of electronic data that occurred during the 2009 – 2010 policy period, and a subsequent claim is made during the 2010 – 2011 policy period, that claim will be deemed to have been made at the time the first claim was made. So, the second claim will be payable under the policy in effect at the time the first claim was made and is subject to the applicable limits of liability of the previous policy.
CG 00 65 provides an automatic thirty day extended reporting period. This is in contrast to the claims-made CGL form, CG 00 02 04 13, that provides an automatic basic extended reporting period of five years (in most circumstances). This thirty day reporting period does not extend the policy period or change the scope of coverage provided or affect any remaining limits of insurance. It simply means that the insured has thirty days after the end of the policy period to have a claim considered as first made in accordance with the requirements of this claims-made policy. For example, the insured's electronic data liability coverage form expires September 10, 2009. If the insured receives and records a claim on September 20, 2009, that claim is considered to be first made under the policy. If the insured receives and records a claim on October 11, 2009, the reporting period has passed. In such circumstances, the extended reporting period of three years, offered by CG 00 65 for a charge, would be good to have; this reporting period is discussed later in this article.
a.Expected or Intended Loss. This insurance does not apply to “loss of electronic data” expected or intended from the standpoint of the insured.
b.Contractual Liability. This insurance does not apply to “loss of electronic data” for which the insured is obligated to pay damages by reason of the assumption of liability in a contract or agreement. This exclusion does not apply to liability for damages that the insured would have in the absence of the contract or agreement.
c.Computer Products or Services Exclusion. This insurance does not apply to “loss of electronic data” arising out of a negligent act, error or omission, by or for you, or anyone acting on your behalf in providing “computer products or services”.
d.Bodily Injury, Property Damage, or Personal And Advertising Injury. This insurance does not apply to damages that are “bodily injury”, “property damage”, or “personal and advertising injury”.
e.Damage to Your Data. This insurance does not apply to “loss of electronic data” that is owned by you; that was developed by or for you; or that is “your work” or “your product”.
Analysis
The first exclusion is an obvious one for a liability policy. If the insured expects or intends to damage or corrupt electronic data, that is not a choice meant to be covered by an insurance policy. To cover such intentional damage would be to offer every hacker insurance coverage for his illegal and unethical actions.
The contractual assumption of liability is another area of liability that standard liability policies do not cover. The commercial general liability (CGL) coverage form does apply to liability assumed under insured contracts, but CG 00 65 does not offer this exception to the exclusion. However, CG 00 65 does apply to liability for damages that the insured would have anyway, in the absence of a contract or agreement.
Computer products or services is a defined term that will be discussed later in this article. Suffice it to say that the term basically describes a professional computer service, one that manufactures, designs, develops, programs, and maintains computers or electronic goods. This is a professional type exposure and CG 00 65 is not the coverage form for this exposure. CG 00 65 is meant for the non-computer professional entity that accidentally destroys information or programs that are on computers and software. Professional programmers and designers may do this also, but they have to accept this as a business risk that is covered, if at all, by a specialty type policy. This particular exclusion can be seen as something of a combination of a damage to your work exclusion and a professional service liability exclusion.
Bodily injury, property damage, personal and advertising injury are all damages to be covered under a CGL form, not an electronic data liability coverage form. This fourth exclusion makes that point.
The fifth exclusion is simply stating that CG 00 65 is a liability policy. Electronic data owned by the named insured or developed by or for the named insured is the property of the named insured. An entity cannot be liable to himself for damaging his own property.
a.Performance of a Contract. This insurance does not apply to “loss of electronic data” arising out of a delay or failure by you or anyone acting on your behalf to perform a contract or agreement in accordance with its terms.
b.Infringement of Intellectual Property Rights. This insurance does not apply to “loss of electronic data” arising out of or resulting from the actual or alleged infringement of trademark, copyright, patent, trade secret or other intellectual property rights.
c.Unauthorized Use of Electronic Data. This insurance does not apply to “loss of electronic data” arising out of theft or unauthorized viewing, copying, use, corruption, manipulation or deletion of “electronic data” by any named insured, past or present “employee”, “temporary worker”, or “volunteer worker” of the named insured.
d.Violation of an Antitrust Law. This insurance does not apply to any claim for damages arising out of the violation of an antitrust law.
e.Criminal or Fraudulent Acts. This insurance does not apply to “Loss of electronic data” arising out of a criminal or fraudulent act committed by or at the direction of the insured.
Analysis
Exclusion f. is comparable to the failure to perform exclusion that was found on general liability policies. That exclusion prevented a liability policy from guaranteeing that an insured would live up to its contractual responsibilities, or in other words, not breach a contract. Just as CG 00 65 does not apply to liability assumed by the insured in a contract, it also does not apply to any loss of electronic data that results from the insured not fulfilling its contractual obligations. As an example, the insured has contracted with a company to install up to date electrical outlets throughout a building that the company has just purchased. The insured has guaranteed in the job contract that the outlets will be installed and operating by September 15, but for some reason, that date is not met. Due to the delay, the company cannot access its computer software programs. If the company were to then make a claim for damages against the insured based on the insured's failure to perform, CG 00 65 would not provide liability coverage for the claim.
The final four exclusions on CG 00 65 pertain to criminal, unethical, and unauthorized intentional acts by the insured. Insurance coverage is not meant to be extended to violations of laws, and these four exclusions prevent coverage for infringement of intellectual property rights, unauthorized use of electronic data, violating antitrust laws, and criminal acts. The exclusion for infringement of intellectual property rights has been changed in the 2013 version of the policy; the exception that gave back coverage for the use of another's advertising idea in your advertisement has been removed. Therefore coverage is restricted, and any infringement of intellectual property rights is excluded. So if the Cow Czar uses the same idea that Big Bob's Burgers is known for, there is no coverage when Big Bog sues for the theft of his advertising idea. It is interesting to note that the exclusion of loss due to unauthorized use of electronic data extends to acts of past and present employees, temporary workers, and volunteers. So, if an employee who has been fired decides to get back at his former company by corrupting the computer information of a customer, a claim made against the insured company by that customer based on the acts of the former employee will not be covered by CG 00 65. Likewise, if an employee corrupted data before leaving the company and that corruption was not discovered until after the employee had already left, there is no coverage. Or if a temporary worker at the insured's office makes an unauthorized copy of a customer's computer software data, any subsequent claim by the customer against the insured will not be covered by CG 00 65. Such vicarious liability claims are not covered.
We will pay, with respect to any claim we investigate or settle, or any “suit” against an insured we defend:
1.All expenses we incur.
2.The cost of bonds to release attachments, but only for bond amounts within the applicable limit of insurance. We do not have to furnish these bonds.
3.All reasonable expenses incurred by the insured at our request to assist us in the investigation or defense of the claim or “suit”, including actual loss of earnings up to $250 a day because of time off from work.
4.All costs taxed against the insured in the “suit”. However, these payments do not include attorneys' fees or attorneys' expenses taxed against the insured.
5.Prejudgment interest awarded against the insured on that part of the judgment we pay. If we make an offer to pay the applicable limit of insurance, we will not pay any prejudgment interest based on that period of time after the offer.
6.All interest on the full amount of any judgment that accrues after entry of the judgment and before we have paid, offered to pay, or deposited in court the part of the judgment that is within the applicable limit of insurance.
These payments will not reduce the limit of insurance.
Analysis
These are the usual supplementary payments that are offered by the insurer under a liability policy; for example, the CGL form offers the same payments. And as with the CGL form, note that the supplementary payments do not reduce the limit of insurance; these payments are in addition to the policy limits.
1.If you are designated in the Declarations as:
a.An individual, you and your spouse are insureds, but only with respect to the conduct of a business of which you are the sole owner.
b.A partnership or joint venture, you are an insured. Your members, your partners, and their spouses are also insureds, but only with respect to the conduct of your business.
c.A limited liability company, you are an insured. Your members are also insureds, but only with respect to the conduct of your business. Your managers are insureds, but only with respect to their duties as your managers.
d.An organization other than a partnership, joint venture, or limited liability company, you are an insured. Your “executive officers” and directors are insureds, but only with respect to their duties as your officers or directors. Your stockholders are also insureds, but only with respect to their liability as stockholders.
e.A trust, you are an insured. Your trustees are also insureds, but only with respect to their duties as trustees.
2.Each of the following is also an insured:
a.Your “volunteer workers” only while performing duties related to the conduct of your business, or your “employees”, other than either your “executive officers” (if you are an organization other than a partnership, joint venture, or limited liability company) or your managers (if you are a limited liability company), but only for acts within the scope of their employment by you or while performing duties related to the conduct of your business.
b.Any person (other than your “employee” or “volunteer worker”), or any organization while acting as your real estate manager.
c.Any person or organization having proper temporary custody of your property if you die, but only until your legal representative has been appointed.
d.Your legal representative if you die, but only with respect to duties as such. That representative will have all your rights and duties under this Coverage Part.
3.Any organization you newly acquire or form, other than a partnership, joint venture or limited liability company, and over which you maintain ownership or majority interest, will qualify as a Named Insured if there is no other similar insurance available to that organization. However:
a.Coverage under this provision is afforded only until the 90th day after you acquire or form the organization or the end of the policy period, whichever is earlier;
b.Coverage does not apply to “loss of electronic data” that occurred before you acquired or formed the organization.
No person or organization is an insured with respect to the conduct of any current or past partnership, joint venture or limited liability company that is not shown as a Named Insured in the Declarations.
Analysis
This part of the policy describes who is considered an insured, that is, an entity that is entitled to coverage under the terms of this policy. The clauses here apply to an entity that is an individual, a partnership, joint venture, a limited liability company, a trust, or an organization such as a corporation. Thus, just about any type of business organization is described and can qualify as an insured.
Note that under certain circumstances other entities can be included as insureds. Spouses of individuals and partners can be insureds. Members and managers of limited liability companies can be insureds. Executive officers, directors, and stockholders of a corporation can be insureds. The key requirement is that the entities have to be somehow engaged in the conduct of the named insured's business; a mere blood relationship or just a friendly relationship will not be enough.
Employees and volunteer workers (both defined terms) are insureds under the named insured's policy, but they too have to be acting within the scope of employment or performing duties related to the named insured's business in order for the insured status to be granted to them.
Newly acquired or newly formed organizations qualify as named insureds under CG 00 65; but this is only if there is no other similar insurance available to the organization, and the coverage as insureds is only for ninety days after the acquisition or formation of the organization. If no steps are taken within the ninety day period to formally list the new organization as an insured, the coverage will cease for that organization. And of course, there is no coverage for loss of electronic data that occurred before the acquisition or formation of the new organization; no successor liability will be covered by CG 00 65.
The final point to note here is that no person or organization is an insured with respect to the conduct of any current or past partnership, joint venture, or limited liability company that is not shown as a named insured on the declarations page of the policy. If the insured wants such entities to be considered as insureds, they have to be listed on the declarations page.
1.The limits of Insurance shown in the Declarations and the rules below fix the most we will pay regardless of the number of:
a.Insureds;
b.Claims made or “suits” brought; or
c.Persons or organizations making claims or bringing “suits”.
2.The Aggregate Limit is the most we will pay for the sum of all damages because of “loss of electronic data”.
3.Subject to 2. above, the Each Electronic Data Incident Limit is the most we will pay for the sum of all damages because of the “loss of electronic data” arising out of any one “electronic data incident”.
The Limits of Insurance of this Coverage Part apply separately to each consecutive annual period and to any remaining period of less than 12 months, starting with the beginning of the policy period shown in the Declarations, unless the policy period is extended after issuance for an additional period of less than 12 months. In that case, the additional period will be deemed part of the last preceding period for purposes of determining the Limits of Insurance.
Analysis
This section of CG 00 65 sets out the limits of insurance, the most that the insurer will pay due to claims against this coverage. Regardless of the number of insureds, claims brought, or organizations making the claims, the stated limits are the most that the insurer will pay. As an example, if there are two named insureds and five other insureds and the policy limits are $1,000,000, that is the most the insurer will pay out; each insured may be treated as a separate entity, but the policy will not pay out $7,000,000.
CG 00 65 has a stated aggregate limit and that is the most the insurer will pay for the sum of all damages because of a loss of electronic data. So, if the applicable aggregate limit is used up in the payment of judgments against the insured during the first three months of the policy period, then the insured has no more limits of insurance to pay off any claims that might occur during the last nine months of the policy.
CG 00 65 also has an each electronic data incident limit that applies to a loss due to any one electronic data incident. This means, for example, that if one electronic data incident results in a claim for $2,000,000 and the each electronic data incident limit is only $500,000, the insurer will pay out the smaller figure.
It is up to the insured to establish the proper amounts of insurance for each incident and as an aggregate so that each claim and the total number of claims that may arise during the policy period are adequately funded.
Electronic Data Liability Conditions
1.Bankruptcy. Bankruptcy or insolvency of the insured or of the insured's estate will not relieve us of our obligations under this Coverage Part.
2.Duties in the Event of an Electronic Data Incident.
a.You must see to it that we are notified as soon as practicable once you, or any insured listed under Paragraph 1. of Section II—Who Is An Insured, know or suspect that an “electronic data incident” has occurred, which may result in a claim. To the extent possible, notice should include:
(1)How, when and where the known or suspected “electronic data incident” took place;
(2)The name and address of any person or organization whose “electronic data” was lost or damaged; and
(3)The nature and location of any damage arising out of the known or suspected “electronic data incident”.
Notice of a known or suspected “electronic data incident” is not notice of a claim.
b.If a claim is received by any insured, you must:
(1)Immediately record the specifics of the claim and the date received; and
(2)Notify us as soon as practicable.
You must see to it that we receive written notice of the claim as soon as practicable.
c.You and any other involved insured must:
(1)Immediately send us copies of any demands, notices, summonses, or legal papers received in connection with the claim or “suit”;
(2)Authorize us to obtain records and other information;
(3)Cooperate with us in the investigation or settlement of the claim or defense against the “suit”; and
(4)Assist us, upon our request, in the enforcement of any right against any person or organization which may be liable to the insured because of injury or damage to which this insurance may also apply.
d.No insured will, except at that insured's own cost, voluntarily make a payment, assume any obligation, or incur any expense.
3.Legal Action Against Us. No person or organization has a right under this Coverage Part:
a.To join us as a party or otherwise bring us into a “suit” asking for damages from an insured; or
b.To sue us on this Coverage Part unless all of its terms have been fully complied with.
A person or organization may sue us to recover on an agreed settlement or on a final judgment against an insured; but we will not be liable for damages that are not payable under the terms of this Coverage Part or that are in excess of the applicable limit of insurance. An agreed settlement means a settlement and release of liability signed by us, the insured and the claimant or the claimant's legal representative.
4.Other Insurance.
If any other valid and collectible insurance is available to the insured for a loss we cover under this Coverage Part, this insurance is excess over such other insurance, unless that other insurance was bought specifically to apply in excess of the Limit of Insurance shown in the Declarations of this Coverage Part.
When this insurance is excess, we will have no duty to defend the insured against any “suit” if any other insurer has a duty to defend the insured against that “suit”. If no other insurer defends, we will undertake to do so, but we will be entitled to the insured's rights against all those other insurers.
When this insurance is excess over other insurance, we will pay only our share of the amount of the loss, if any, that exceeds the sum of:
(1)The total amount that all such other insurance would pay for the loss in the absence of this insurance; and
(2)The total of all deductible and self-insured amounts under all that other insurance.
We will share the remaining loss, if any, with any other insurance.
Analysis
These conditions are not out of the ordinary conditions for a liability policy.
The duties in the event of an incident clause makes the point that the insured has to notify the insurer as soon as practicable of an incident and a claim. The insurer needs to know the specifics of an incident and a claim so that it can properly prepare a case file and, if need be, a defense. Besides this, there are two important notices in this clause that any insured should know: notice of a known or suspected incident is not notice of a claim; and no insured will make any voluntary payments or assume any obligations or incur any expense except at his own cost. CG 00 65 is a claims-made policy and coverage relies on a claim being first made during the policy period. So, the insured is now told that telling the insurer about an incident is not the same as telling the insurer of a claim; the two things are separate items and the insured must give notice of both the incident and the subsequent claim to the insurer. As for the no assuming any costs or obligations phrase, the insurer is telling the insured that assuming liability and costs is contrary to the intent of a liability insurance policy. The insurer will pay those sums that the insured is legally obligated to pay, but this legal obligation has to be proved; if the insured goes ahead and admits and assumes responsibility, the requirement to prove his liability vanishes and the insurer is put in a compromised position. So if the insured acts in this manner, he is contractually bound by this insurance contract to assume the costs himself.
Under the other insurance clause, CG 00 65 makes itself excess insurance over any other valid and collectible insurance. Note that the other insurance has to be valid and collectible. If the insurance provided by CG 00 65 is excess, the insurer assumes no duty to defend; if no other insurer defends the insured, the insurer will undertake that mission. And, when the insurance provided by this policy is excess, the insurer will not pay until all the primary coverage is paid, and that includes deductibles and self-insurance amounts. The insurer then states that it will share the remaining loss (after all primary coverage is paid) with any other insurance on a pro-rata basis.
5.Premium Audit
a.We will compute all premiums for this Coverage Part in accordance with our rules and rates.
b.Premium shown in this Coverage Part as advance premium is a deposit premium only. At the close of each audit period, we will compute the earned premium for that period and send notice to the first Named Insured. The due date for audit and retrospective premiums is the date shown as the due date on the bill. If the sum of the advance and audit premiums paid for the policy period is greater than the earned premium, we will return the excess to the first Named Insured.
c.The first Named Insured must keep records of the information we need for premium computation, and send us copies at such times as we may request.
6.Representations. By accepting this policy, you agree:
a.The statements in the Declarations are accurate and complete;
b.Those statements are based upon representations you made to us; and
c.We have issued this policy in reliance upon your representations.
7.Separation of Insureds. Except with respect to the limit of Insurance, and any rights or duties specifically assigned to the first Named Insured, this insurance applies:
a.As if each Named Insured were the only Named Insured; and
b.Separately to each insured against whom claim is made or “suit” is brought.
8.Transfer of Rights of Recovery Against Others to Us.
If the insured has rights to recover all or part of any payment we have made under this Coverage Part, those rights are transferred to us. The insured must do nothing after loss to impair them. At our request, the insured will bring “suit” or transfer those rights to us and help us enforce them.
9.When We do not Renew.
If we decide not to renew this Coverage Part, we will mail or deliver to the first Named Insured shown in the Declarations written notice of the nonrenewal not less than 30 days before the expiration date. If notice is mailed, proof of mailing will be sufficient proof of notice.
Analysis
These are the rest of the electronic data liability conditions.
The audit clause notes that the premium paid by the insured up front is merely a deposit premium. The insurer will audit the risk at the close of the audit period and then come up with the earned premium, the actual premium due based on the actual risk exposures faced by the insured. The first named insured gets the notice of the results of the audit and either must pay the amount due, or receive the excess premium that was charged.
The representations clause binds the insured to the statements he made in the application for insurance coverage. The clause does not explicitly say that misrepresentations will void coverage, but if they exist, the insurer can certainly use this clause to petition a court that it wrote the coverage based on the misrepresentations and that the insurance contract should be voided.
The separation of insureds clause is the severability of interests clause. Each insured is considered a separate entity and is entitled to be treated as such by the insurer when it comes to coverage and defense.
The transfer of rights clause is the subrogation clause. If the insured has not waived its rights of recovery against another party prior to a loss, this clause enables the insurer to assume those rights and seek recompense from that other party.
1.You will have the right to purchase an Extended Reporting Period from us if:
a.This Coverage Part is cancelled or not renewed for any reason; or
b.We renew or replace this Coverage Part with insurance that:
(1)Has a Retroactive Date later than the date shown in the Declarations of this Coverage Part; or
(2)Does not apply to “loss of electronic data” on a claims-made basis.
2.An Extended Reporting Period, as specified in Paragraph 1. above, lasts three years and is available only by endorsement and for an additional charge. You must give us a written request for the Extended Reporting Period Endorsement within thirty (30) days after the end of the policy period. The Extended Reporting Period will not go into effect unless you pay the additional premium promptly when due and any premium or deductible you owe us for coverage provided under this policy. Once in effect, the Extended Reporting Period may not be cancelled. We will determine the additional premium in accordance with our rules and rates. In doing so, we may take into account the following:
a.The exposures insured;
b.Previous types and amounts of insurance;
c.Limit of Insurance available under this policy for future payment of damages; and
d. related factors.
The additional premium will not exceed 100% of the annual premium for this policy.
3.The Extended Reporting Period starts with the end of the policy period and does not extend the policy period or change the scope of coverage provided. It applies only to claims to which the following applies:
a.The claim is first made during the Extended Reporting Period;
b.The “loss of electronic data” occurs before the end of the policy period; and
c.The “loss of electronic data” did not commence before the Retroactive Date, if any.
4.The Extended Reporting Period endorsement applicable to this coverage shall set forth the terms, not inconsistent with this Section, applicable to the Extended Reporting Period, including a provision to the effect that the insurance afforded for claims first received during such period is excess over any other valid and collectible insurance available under policies in force after the Extended Reporting Period starts.
5.The Extended Reporting Period does not reinstate or increase the Limits of Insurance.
Analysis
Since CG 00 65 is a claims-made policy, it has an extended reporting period clause. The insured may purchase an extended reporting period endorsement under the conditions outlined in the clause. The endorsement is CG 31 73 12 04 and is available upon written request from the named insured for an additional premium charge; this charge will not exceed 100 percent of the annual premium for CG 00 65.
CG 31 73 12 04 declares that a claim first made within three years after the end of the policy period will be deemed to have been made on the last day of the policy period; that is, provided that the claim is for damages because of loss of electronic data that occurred before the end of the policy period. The endorsement also states that the insurance is excess over any of the other insurance whose policy period begins or continues after the extended reporting period endorsement takes effect. This endorsement does not reinstate or increase the limits of insurance; it does not extend the policy period; and it does not change the scope of the coverage provided by CG 00 65. The endorsement merely gives the insured an additional amount of time in which to report a claim made against him.
CG 00 65 has seventeen definitions, some of them being similar to the ones found on the commercial general liability coverage forms, and some being particular to this type of coverage form.
1.”Advertisement” means a notice that is broadcast or published to the general public or specific market segments about your goods, products or services for the purpose of attracting customers or supporters. For the purposes of this definition:
a.Notices that are published include material placed on the Internet or on similar electronic means of communication; and
b.Regarding web-sites, only that part of a website that is about your goods, products or services for the purposes of attracting customers or supporters is considered an advertisement.
2.”Bodily injury” means bodily injury, sickness or disease sustained by a person, including death resulting from any of these at any time.
3.”Coverage territory” means all parts of the world provided the insured's responsibility to pay damage is determined in a “suit” on the merits, in the United States of America (including its territories and possessions), Puerto Rico or Canada, or in a settlement we agree to.
4.”Computer products or services” means:
a.Manufacturing, developing, designing, creating, selling, handling, marketing, distributing, licensing, or disposing of computer or electronic goods, by you or on your behalf. Computer or electronic goods includes, but is not limited to:
(1)Computer software or computer programming;
(2)Electronic or computer equipment, components or peripherals;
(3)Communications or broadcasting equipment; or
(4)Industrial or robotic equipment;
and any containers (other than vehicles), materials, parts or equipment furnished in connection with such computer or electronic goods, by you or on your behalf; or
b.Computer related services performed by you or on your behalf, including but not limited to:
(1)Installation, testing, service, maintenance, technical support, repair, integration, networking, consulting or analysis of or training for:
(a)Computer software or computer programming;
(b)Electronic or computer equipment, components or peripherals;
(c)Communications or broadcasting equipment;
(d)Industrial or robotic equipment;
(2)Processing, storage, transmission or other handling of “electronic data” for others; or
(3)Provision of broadcasting or communication services for others, or consulting, evaluating or advising on such services, including but not limited to broadcasts or communications via television, cable satellite, radio, Internet, wireless transmissions or cellular transmissions.
5.”Electronic data” means information, facts or programs stored as or on, created or used on, or transmitted to or from computer software (including systems and applications software), hard or floppy disks, CD-ROMS, tapes, drives, cells, data processing devices or any other media which are used with electronically controlled equipment.
6.”Electronic data incident” means an accident, or a negligent act, error or omission, or a series of causally related accidents, negligent acts, or errors or omissions, which results in “loss of electronic data”.
7.”Employee” includes a “leased worker”. “Employee” does not include a “temporary worker”.
8.”Executive officer” means a person holding any of the officer positions created by your charter, constitution, by-laws or any other similar governing document.
9.”Leased worker” means a person leased to you by a labor leasing firm under an agreement between you and the labor leasing firm, to perform duties related to the conduct of your business. “Leased worker” does not include a “temporary worker”.
Analysis
The definition of “advertisement” need only be discussed here as part of the definition of personal and advertising injury. This latter term describes advertising injury as being based on the named insured's advertisement. CG 00 65 excludes coverage for personal and advertising injury damages, and so, to better understand the exclusion, the insured should know what an advertisement is. Note that CG 00 65 includes references to Internet communications and web-sites in the definition of advertisement so as to acknowledge the fact that many companies today advertise via electronic media.
The coverage territory of CG 00 65 is world-wide, as long as the insured's responsibility to pay damages is determined in a lawsuit filed in the United States, Puerto Rico, or Canada.
The definition of computer products or services is extensive. This is because the policy has an exclusion pertaining to computer products or services. It is not the intent of CG 00 65 to apply to damages arising out of the insured manufacturing or developing or designing computer or electronic goods. If the insured is in the business of programming or installing or designing computer products, that risk exposure is a specialty type risk. CG 00 65 is meant to apply to loss of electronic data caused by the negligence of the insured, and that type of coverage is meant to be kept separate from the type of coverage needed if the insured is engaged in computer products activities or services. So if the insured accidently puts customer data on the web page for all to see, that would be covered. If the insured creates bad software that should be covered on a different type of policy, and is not covered here. This definition helps the insured understand what type of electronic data related activities are not covered under this policy.
Electronic data is defined since it is the loss of such an item that is the focus of coverage under CG 00 65. The definition basically means information stored on or used in computers and other electronically controlled equipment. Customer names, addresses, credit card numbers, employee information, purchase records, are all electronic data.
An electronic data incident is the accident or negligent act or omission that causes the loss of the information stored on or used in computers. For coverage under CG 00 65 to apply, the loss has to be caused by an electronic data incident.
The definitions of employee, executive officer, and leased worker are present in order to help the insured understand the provisions of the who is an insured section of the policy. Note that leased workers are considered employees, temporary workers are not, and executive officers are considered as separate entities from employees.
2.”Loss of electronic data” means damage to, loss of, loss of use of, corruption of, inability to access, or inability to properly manipulate “electronic data”.
3.”Personal and advertising injury” means injury, including consequential “bodily injury”, arising out of one or more of the following offenses:
a.False arrest, detention or imprisonment;
b.Malicious prosecution;
c.The wrongful eviction from, wrongful entry into, or invasion of the right of private occupancy of a room, dwelling or premises that a person occupies, committed by or on behalf of its owner, landlord, or lessor;
d.Oral or written publication, in any manner, of material that slanders or libels a person or organization or disparages a person's or organization's goods, products or services;
e.Oral or written publication, in any manner, of material that violates a person's right of privacy;
f.The use of another's advertising idea in your “advertisement”; or
g.Infringing upon another's copyright, trade dress or slogan in your “advertisement”.
4.”Property damages means:
a.Physical injury to tangible property, including all resulting loss of use of that property. All such loss of use shall be deemed to occur at the time of the physical injury that caused it; or
b.Loss of use of tangible property that is not physically injured. All such loss of use shall be deemed to occur at the time of the “damage to electronic data incident” that caused it.
For the purposes of this insurance, “electronic data” is not tangible property.
5.”Suit” means a civil proceeding in which damages because of “loss of electronic data” to which this insurance applies are alleged. “Suit” includes:
a.An arbitration proceeding in which such damages are claimed and to which the insured must submit or does submit with our consent; or
b.Any other alternative dispute resolution proceeding in which such damages are claimed and to which the insured submits with our consent.
6.”Temporary worker” means a person who is furnished to you to substitute for a permanent “employee” on leave or to meet seasonal or short-term workload conditions.
7.”Volunteer worker” means a person who is not your “employee”, and who donates his or her work and acts at the direction of and within the scope of duties determined by you, and is not paid a fee, salary or other compensation by you or anyone else for their work performed for you.
8.”Your product”:
a.Means:
(1)Any goods or products, other than real property, manufactured, sold, handled, distributed or disposed of by:
(a)You;
(b)Others trading under your name; or
(c)A person or organization whose business or assets you have acquired; and
(2)Containers (other than vehicles), materials, parts or equipment furnished in connection with such goods or products.
b.Includes:
(1)Warranties or representations made at any time with respect to the fitness, quality, durability, performance or use of “your product”; and
(2)The providing of or failure to provide warnings or instructions.
c.Does not include vending machines or other property rented to or located for the use of others but not sold.
9.”Your work”:
a.Means:
(1)Work or operations performed by you or on your behalf; and
(2)Materials, parts or equipment furnished in connection with such work or operations.
b.Includes:
(1)Warranties or representations made at any time with respect to the fitness, quality, durability, performance or use of “your work” and
(2)The providing of or failure to provide warnings or instructions.
Analysis
The coverage under the electronic data liability form is for damages due to loss of electronic data. The definition of such a loss attempts to describe any manner of loss that electronic data might suffer. Loss of, loss of use of, corruption of, inability to access—all ways to damage the information or programs stored on a computer are described in this definition. Of course, due to the growing issues in cybersecurity, it can be expected that this particular definition, as well as the definitions of electronic data and electronic data incident, will be subject to many courtroom battles.
Several courtroom battles have already been fought over whether electronic data is tangible property. The final verdict is not yet in, but CG 00 65 (as well as the CGL forms) tries to settle the issue by declaring flatly that electronic data is not tangible property. This means that a claim for property damage cannot include damage to electronic data since tangible property is essential to the definition of property damage in liability coverage. Intangible property is particularly difficult to value; what is the value of data? The loss of data can result in a multitude of consequences, including identity theft of customers and reputational damage to the company that lost the data, none of which is tangible but could be very expensive to handle.
Temporary workers are already noted not to be employees of the named insured, so the definition here tries to describe just what a temporary worker is. Volunteers are not employees either but since they are considered as insureds under the terms of CG 00 65, they are described in the definitions section. The key points here are that volunteers are donating their work, are not compensated in anyway by the named insured, and are working at the direction of the named insured.