Why it matters: In a recent decision the Connecticut Supreme Court unanimously affirmed a lower court ruling that there was no coverage under a CGL policy for costs incurred in connection with the loss of computer tapes containing IBM employees’ personally identifiable information. During transport the tapes fell out of a van and were retrieved by an unknown individual, but there was no evidence that the individual, or anyone else, had actually accessed the information on the tapes. Nevertheless, IBM spent more than $6 million in expenses for mitigation measures. The insured alleged that the loss of the computer tapes constituted covered “personal injury, defined to include any injury “caused by an offense ... or other publication of material that ... violates a person’s right to privacy.” The court found that because there had been no publication of the information that resulted in a violation of a person’s right to privacy, the loss of the computer tapes did not constitute a personal injury as defined in the policy. In contrast to the limitations inherent in a CGL policy, Cyber insurance policies are typically broader and tailored to this type of event. Among other things, Cyber insurance policies generally cover the cost for computer and data loss restoration, notification costs, credit monitoring, and liability to third parties from the failure to handle, manage, store, and control personally identifiable information belonging to others.
Detailed discussion: Recall Total Information Management Inc. entered into a vital records storage agreement with IBM. Recall agreed to transport and store various electronic media belonging to IBM. Recall subcontracted the transportation services to Executive Logistics (“Ex Log”), with a requirement that the subcontractor maintain a $2 million commercial general liability policy and a $5 million umbrella liability policy. Both policies—issued by Federal Insurance Company and Scottsdale Insurance Company, respectively—named Recall as an additional insured.
During the transport of computer tapes, a cart containing 130 tapes fell out of the back of the truck. The tapes contained employment-related data for about 500,000 IBM employees, including social security numbers, birthdates, and contact information. The tapes were removed from the roadside by an unknown person and never recovered.
IBM took steps to prevent harm from the dissemination of the personal information, claiming more than $6 million in expenses. IBM reached out to Recall and Ex Log, which then sought coverage from their insurers. Both parties’ insurers declined to participate in the negotiations and denied coverage.
Following negotiations, Recall and Ex Log entered into an agreement to reimburse IBM. Ex Log signed a promissory note in favor of Recall for $6.4 million and assigned all of its rights under both policies to Recall.
Recall then filed a declaratory action against the insurers in Connecticut state court.
ExLog’s CGL policy at issue states in relevant part that the insurer “will pay damages that the insured becomes legally obligated to pay ... for ... personal injury.” The policy defines the key term “personal injury” to include “injury ... caused by an offense of ... electronic, oral, written or other publication of material that ... violates a person’s right to privacy.”
Turning to whether the data loss constituted a “personal injury” under the policy, the appellate court in a decision adopted by the Connecticut Supreme Court first looked to the definition, which, in terms of a loss related to privacy, required the “electronic, oral, written or other publication of material ...” (emphasis in original). In construing this definition, the court relied heavily on the fact that there was no evidence that any of the personal information on the 130 tapes was ever accessed or used for an improper purpose.
The Connecticut Supreme Court revealed little of its legal rationale in its per curium decision. “Our examination of the record and briefs and our consideration of the arguments of the parties persuade us that the judgment of the Appellate Court should be affirmed.” “Because the Appellate Court’s well-reasoned opinion fully addresses the certified issue, it would serve no purpose for us to repeat the discussion contained therein. We therefore adopt the Appellate Court’s opinion as the proper statement of the issue and the applicable law concerning that issue.”
To read the appellate court opinion in Recall Total Information Management, Inc. v. Federal Insurance Co., click here.
To read the Connecticut Supreme Court’s opinion, click here.