(Article from Insurance Law Alert, December 2017)
For more information, please visit the Insurance Law Alert Resource Center.
Applying South Carolina law, a Florida federal district court ruled that a general liability policy did not cover claims for damages resulting from the release of personal private information caused by a data breach. Innovak Int’l, Inc. v. The Hanover Co., 2017 WL 5632718 (M.D. Fla. Nov. 17, 2017).
Innovak, a developer of payroll software systems, was the victim of a data breach, resulting in the hacker’s appropriation of personal private information stored on Innovak’s database. Following the breach, a putative class action was filed against Innovak, alleging negligence and breach of contract. Hanover refused to defend the suit on several bases, including that the underlying complaint did not allege “personal and advertising injury” because there was no “publication” of the private information. The court agreed and granted Hanover’s summary judgment motion.
The court ruled that Hanover had no duty to defend Innovak because the underlying complaint did not allege that Innovak engaged in the “publication” of private information. The court noted that the complaint failed to allege publication by any party, but even assuming that the breach constitutes a publication, there was still no coverage because the publication was committed by the hackers, not Innovak.
As the court noted, a New York court reached a similar conclusion in
Zurich American Insurance Co. v. Sony Corp. of America, No. 651982/2011 (N.Y. Sup. Ct. New York Cnty. Feb. 21, 2014) (discussed in our
March 2014 Alert). There, the court held that an identical policy provision did not cover hacking claims because the publication was by the hackers rather than the insured, notwithstanding the fact that the policy did not expressly require publication “by the insured.” Citing
Zurich, the
Innovak court held that “the only plausible interpretation” of the personal and advertising injury provision is that “it requires the insured to be the publisher of the PPI [personal private information].”