(Article from Insurance Law Alert, April 2019)
For more information, please visit the Insurance Law Alert Resource Center.
A policyholder asked the Eleventh Circuit to reverse a Florida district court decision holding that a general liability insurer has no duty to defend data breach claims. Brief of Appellant, St. Paul Fire & Marine Ins. Co. v. Rosen Hotels & Resorts, Inc., No. 18-14427 (11th Cir. filed Jan. 9, 2019).
The district court ruled that coverage for breach of privacy allegations arising from a data breach is available where the publication of personal information was done by the policyholder itself and does not extend to acts undertaken by third-parties. St. Paul Fire & Marine Ins. Co. v. Rosen Millennium, Inc., 2018 WL 4732718 (M.D. Fla. Sept. 28, 2018) (discussed in our October 2018 Alert). The district court granted in part St. Paul’s summary judgment motion, finding that the insurer had no duty to defend under the policy’s “personal injury” provision, which applied to several enumerated offenses, including “[m]aking known to any person or organization covered material that violates a person’s right of privacy.” The court based this ruling on the fact that the alleged privacy violation did not result from Millennium’s conduct, but rather arose from the actions of third-party hackers. The district court relied on Innovak Int’l, Inc. v. Hanover Ins. Co., 280 F. Supp.3d 1340 (M.D. Fla. 2017) (discussed in our December 2017 Alert), in which the court held that coverage attaches under a personal injury provision only where the insured publishes private information. A New York court reached the same conclusion in Zurich Am. Ins. Co. v. Sony Corp. of America, No. 651982/2011 (N.Y. Sup. Ct. New York Cty. Feb. 21, 2014), holding that a similar personal injury policy provision did not encompass hacking claims where the publication was committed by hackers rather than the insured itself (discussed in our March 2014 Alert).
On appeal to the Eleventh Circuit, the policyholder has argued, among other things, that the district court incorrectly implied a requirement into the liability policy by requiring the insured to be the publishing party in order for coverage to apply. We will keep you posted on any developments in this matter.