Why it matters: A Utah federal court handed down one of the first coverage decisions in the country construing a so-called “cyber” policy. Finding that the insured deliberately withheld data belonging to its client, the court held that the insurer was under no duty to defend its insureds against claims including tortious interference, conversion, and breach of contract. The cyber policy included a technology errors and omissions liability form, which stated that the insured “will pay those sums” that the insured “must pay as ‘damages’ because of loss … caused by an ‘errors and omissions wrongful act’….” The key term “errors and omissions wrongful act” was defined to include “any error, omission or negligent act.” The court found that the underlying suit did not contain any allegations of an error, omission, or negligent act by the insured, but instead alleged that the insured acted with “knowledge, willfulness, and malice” by purposely retaining the data. The court noted that “[t]o trigger [the insurer’s] duty to defend, there must be allegations in the underlying action that sound in negligence.”

Detailed discussion: Federal Recovery Acceptance, Inc. (“FRA”) provides processing, storage, transmission, and other handling of electronic data for its customers. FRA contracted with Global Fitness Holdings, a company that owns and operates fitness centers in multiple states.

Pursuant to the contract, FRA processed member accounts for Global Fitness. For security purposes, the only copy of the members’ billing information—credit card or checking or savings account data—was retained by FRA on behalf of Global Fitness. FRA withdrew or processed memberships fees and then transferred the funds to Global Fitness.

Global Fitness then entered into a purchase agreement with L.A. Fitness. As part of the deal, Global Fitness promised to transfer all of its member accounts data to L.A. Fitness. FRA produced some data but not the billing information for members. Global repeatedly requested the transfer of information in order to complete its sale with L.A. Fitness.

But according to Global Fitness’s complaint, “FRA withheld the Member Accounts Data until Global Fitness satisfied several vague demands for significant compensation.” Global Fitness alleged tortious interference, conversion, and breach of contract against FRA, claiming that the company “willfully interfered with Global Fitness’s property,” decreasing L.A. Fitness’s purchase price “dramatically.”

FRA turned to insurer Travelers Property Casualty Company of America under a cyber liability policy. The policy provided that the insurer would defend and indemnify against any lawsuits alleging a loss caused by an “errors and omissions wrongful act,” defined as “any error, omission or negligent act.” Travelers provided a defense under a reservation of rights and filed a declaratory judgment action that it had no obligation to defend FRA.

Travelers contended that it had no duty to defend FRA because Global Fitness did not allege any error, omission, or negligent act. Instead, the underlying complaint was based on willful actions.

FRA countered that Travelers’ objections were based on an assumption about the policyholder’s intent to injure and ignored the potential that FRA could be found liable for an error, omission, or negligent act because Global Fitness’s claims were broad enough to encompass a covered loss.

But the District Court ruled that FRA’s argument did not withstand scrutiny when the policy language was compared to the allegations in Global Fitness’s complaint.

“While the policy covers errors, omissions, and negligent acts, Global’s claims against [FRA] allege far different justifications for the data to be withheld,” the court ruled. “Global does not allege that [FRA] withheld the data because of an error, omission, or negligence. Global alleges that [FRA] knowingly withheld this information and refused to turn it over until Global met certain demands. [FRA] allegedly did so despite repeated requests from Global to provide the data. Instead of alleging errors, omissions, or negligence, Global alleges knowledge, willfulness, and malice.”

To read the decision in Travelers Property Casualty Co. of America v. Federal Recovery Acceptance, Inc., click here.