Cyber insurance policies are often considered the “last line of defense” against cybersecurity incidents, but companies should keep in mind that their traditional commercial general liability (“CGL”) insurance policies are a potentially valuable, yet often overlooked, insurance asset in the event of a data security breach. In a recent decision in Travelers Indemnity Company of America v. Portal Healthcare Solutions, L.L.C.,[1] the U.S. Court of Appeals for the Fourth Circuit affirmed a district court's ruling that a class action lawsuit arising out of a data security breach triggered an insurer's duty to defend under a CGL policy's “Advertising Injury” coverage section. While CGL policies are no substitute for certain of the coverages included in cyber policies for notification costs, crisis management losses, and forensic investigations, the Fourth Circuit's ruling confirms that traditional CGL policies may cover defense costs, settlements, and judgments arising out of data privacy lawsuits.
Travelers Indemnity Company of America v. Portal Healthcare Solutions, L.L.C. Reminds Insureds and Insurers that CGL Policies Provide Coverage in the Aftermath of a Data Security Breach
Portal was sued in a putative class action that alleged that Portal and others “engaged in conduct that resulted in the plaintiffs' private medical records being on the internet for more than four months.”[2] A hospital had contracted with Portal for electronic storage and maintenance of the hospital's patients' confidential medical records, and a third-party was hired to host those records on an electronic server.[3] Two patients of the hospital discovered the publication of the confidential medical records when they conducted a “Google” search of their names, and the first link that appeared in the search results was a direct link to their medical records at the hospital.[4] The complaint alleged that the hospital's patients' “confidential medical records were accessible, viewable, copyable, printable, and downloadable from the internet by unauthorized persons without security restriction from November 1, 2012 to March 14, 2013.[5] During the time period of the alleged wrongful conduct, Portal was insured under two CGL policies issued by Travelers.[6] After Portal requested coverage for the class action, Travelers filed a declaratory judgment against Portal seeking a declaration that it was not obligated to defend Portal against the class action complaint.[7]
Like most CGL policies, Portal's CGL policies contained an “Advertising Injury” coverage section. The insuring agreements in Portal's policies obligated Travelers to pay sums Portal became legally to pay as damages because of injury arising from the “electronic publication of material that . . . gives unreasonable publicity to a person's private life” (“2012 Policy”) or “electronic publication of material that . . . discloses information about a person's private life” (“2013 Policy”).[8]
Even though the class action against Portal alleged injuries arising out of the posting of private information on the internet, Travelers argued that it had no duty to defend Portal in the underlying class action lawsuit “because the class-action complaint fail[ed] to allege a covered publication by Portal.”[9] In support of this position, Travelers made two primary arguments. First, Travelers argued that there was no “publication” because the purpose of the service Portal provided was simply to keep the medical records confidential, and Portal had no intention to disclose, or “publish,” the confidential medical records.[10] Second, Travelers argued that no “publication” occurred because the class action did not allege that any third parties ever saw the private information that was posted on the internet.[11] The district court rejected both of these arguments, holding that “exposing material to the online searching of a patient's name does constitute a 'publication' of electronic material” within the meaning of Portal's policies[12] The court dismissed the argument that there is no “publication” until a third-party accesses the information, and explained that “[p]ublication occurs when information is 'placed before the public,' not when a member of the public reads the information placed before it.”[13] Similarly, the court rejected the argument that “publication” depends on the intent of the insured, and clarified that “an unintentional publication is still a publication.”[14] As the court reasoned, the posting of private medical information on the internet gave unreasonable publicity to and disclosed information about a person's private life because any member of the public had the ability to view, download, or copy the records, so as to satisfy the insuring agreements of the policies.[15]
On appeal, the Fourth Circuit accepted the district court's reasoning and affirmed the underlying decision, explaining that “[u]nder Virginia law, an insurer's duty to defend an insured is broader than its obligation to pay or indemnify an insured, and that the insurer must use language clear enough to avoid . . . ambiguity if there are particular types of coverage that it does not want to provide.”[16] In short, because the CGL policy did not contain a specific data privacy exclusion, the Fourth Circuit “affirmed the judgment on the reasoning of the district court.”[17] In doing so, the court rejected arguments made by the insurance industry that if Portal wanted coverage for the class action, it should have purchased a separate cyber policy.[18] The Fourth Circuit's decision confirms that companies should always carefully review their CGL policies following data security breaches to assess the potential for coverage.
Sony's Settlement Also Demonstrates Value under CGL Policies for Data Security Breaches
The arguments Travelers made in Portal echo arguments that Zurich made in an earlier case in New York arising out the Sony PlayStation breach. In that case a New York trial court held that CGL coverage was unavailable for certain consumer class actions arising out of a hacking of Sony's PlayStation gaming system's online services.[19] The trial court reasoned that Zurich owed Sony no coverage, because Sony did not “publish” the material that violated a person's right to privacy, and therefore “publication” by the third party hackers did not trigger coverage.[20] The trial court held that Sony, as the policyholder, must have published the material to trigger coverage; publication by the “hackers” was not sufficient to trigger coverage.[21] Sony appealed on the grounds that under the plain language of the policy, publication “in any manner” included publication by a party other than Sony, such as the “hacker.” After the parties exchanged their briefs, the case was settled.
Conclusion
Every cyber incident is different. Directors and officers, errors and omissions, and crime policies also may respond after a data security breach, depending on the nature of the breach and the types of claims alleged. Companies should work closely with coverage counsel and data security and privacy lawyers in the event of a breach to maximize their potential insurance recovery.
Notes
[1] — F. App'x —-, 2016 WL 1399517 (4th Cir. 2016).
[2] Id. at *1.
[3] Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, LLC, 35 F. Supp. 3d 765, 768 (E.D. Va. 2014).
[4] Id.
[5] Id.
[6] Id.
[7] Id.
[8] Id. at 767.
[9] 2016 WL 1399517, at *1.
[10] 35 F. Supp. 3d at 770.
[11] Id. at 770-71.
[12] Id. at 770.
[13] Id. at 771.
[14] Id. at 770.
[15] Id. at 772.
[16] 2016 WL 1399517, at *2 (internal quotation marks and citations omitted).
[17] Id. at *3.
[18] Travelers Indem. Co. v. Portal Healthcare Solutions, Doc. 30, Amicus Curiae Brief of American Insurance Association and Complex Insurance Claims Litigation Association No. 14-1944 (4th Cir.).
[19] Index No. 651982/2011 (N.Y. Sup. Ct. Feb. 21, 2014).
[20] Zurich Am. Ins. Co. v. Sony Corp. of Am. et al., Index No.: 651982/2011, Transcript of Proceedings, Feb. 21, 2014 e.g. at 77-78 and passim.
[21] Id.
About the Authors
Meghan H. Magruder is a partner at King & Spalding and a member of the Business Litigation Practice Group. Ms. Magruder may be reached at [email protected].
Anthony P. Tatum is a partner at King & Spalding and a member of the Business Litigation Practice Group. Mr. Tatum may be reached at [email protected].
Shelby S. Guilbert, Jr., is a partner at King & Spalding and a member of the Business Litigation Practice Group. Mr. Guilbert may be reached at [email protected].
Nicholas G. Hill is an associate at King & Spalding and a member of the Business Litigation Practice Group. Mr. Hill may be reached at [email protected].