For many people, insurance coverage issues trigger instant narcolepsy. Insurance policies are long and dull and extraordinarily confusing. For those and other reasons, businesses don’t often think about their coverage and what types of perils are excluded from their insurance policies until something bad happens. At that point, it is too late and you are stuck with whatever coverage (or lack of coverage) your insurance provides.
We recently blogged about the arrest of dozens of waiters who allegedly skimmed customer credit cards numbers as part of a $1 million profit identity theft ring, how businesses can be held liable to customers for such damages, and the growing trend in the law to allow recovery for foreseeable risk stemming from credit card theft--even if no actual out of pocket loss has occurred. The possible exposure of franchisees to these types of data breach claims should have franchisors reviewing the insurance requirement provisions in their franchise agreements and operations manuals, and franchisees discussing proper coverages with their brokers.
Most franchise agreements require a franchisor to maintain at least a few million dollars of “general liability insurance.” General liability insurance covers such perils as property damage, personal injury, advertising injury, and products liability. It is considered the general business insurance that covers most risks. A franchisor will also likely require separate automobile policies, worker's compensation, and an umbrella or excess policy. One of the most important things about an insurance policy, moreover, is that it also pays for the services of a lawyer, which is an important consideration as even getting an unworthy case dismissed can be expensive.
None of these policies however, typically cover data breaches without an endorsement specifically covering the risk. “Cyber liability” is a form of coverage that has developed over the past decade to protect against identity theft and data breaches. Unfortunately as technology advances, criminals continue to create new ways to steal identities and information. Cyber liability coverage can protect both losses suffered by franchisees as well as losses suffered by customers or other third parties. Without proper--and adequate--coverage the costs to remedy a serious data breach, including notifying all possible affected customers under state law [PDF], hiring consultants to determine the extent of a breach, and possible damage claims could put a franchisee out of business.
Franchisors and franchisees alike should consider contacting an insurance broker to discuss cyber liability coverage and whether it is advisable for the franchisor to require such coverage of its franchisees. Given the growing risk of cyber theft, the cost to franchisees of the annual premium for such coverage is likely well worth it.
