No Coverage for “Data Breach” Claim under CGL Policy

A Florida federal district court, applying South Carolina law, has held that a claim arising out of a data breach alleging that an insured failed to safeguard personal information did not trigger personal and advertising injury coverage under a commercial general liability policy.  Innovak Int’l, Inc. v. The Hanover Ins. Co., No. 8:16-cv-2453-MSS-JSS (M.D. Fla. Nov. 17, 2017).

The insured, a software developer, suffered a data breach.  As part of that incident, hackers gained access to social security numbers, addresses, telephone numbers, dates of birth, and other personal information of a large number of individuals.  Later, the insured was sued in a putative class action.  It sought coverage under its CGL policy, which afforded coverage for “personal and advertising injury,” defined in relevant part to include “injury … arising out of … [o]ral or written publication, in any manner, of material that violates a person’s right of privacy.”  The insurer denied coverage, and the policyholder brought suit.

In the coverage action, the court granted summary judgment in favor of the insurer.  The court ruled that “the only plausible interpretation” of the personal and advertising injury coverage was that “it requires the insured to be the publisher” of the sensitive material.  Here, the insured was alleged to have been passively negligent in failing to safeguard information.  The court also ruled that even if “indirect publication” by the insured would be sufficient to trigger coverage, there had been no publication at all, and the mere fact that hackers obtained information was not a proxy for finding “publication.”

Wiley Executive Summary

Sign up for updates

Wiley Rein LLP Cookie Preference Center

Your Privacy

When you visit our website, we use cookies on your browser to collect information. The information collected might relate to you, your preferences, or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. For more information about how we use Cookies, please see our Privacy Policy.

Strictly Necessary Cookies

Always Active

Necessary cookies enable core functionality such as security, network management, and accessibility. These cookies may only be disabled by changing your browser settings, but this may affect how the website functions.

Functional Cookies

Always Active

Some functions of the site require remembering user choices, for example your cookie preference, or keyword search highlighting. These do not store any personal information.

Form Submissions

Always Active

When submitting your data, for example on a contact form or event registration, a cookie might be used to monitor the state of your submission across pages.

Performance Cookies

Performance cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.

Powered by Firmseek