Commercial General Liability Policies

Insurance Purchasers Beware: Florida Court Finds No Duty to Defend Data Breach Claim Under CGL Personal & Advertising Injury CoverageOn November 17, 2017, a U.S. district court in Florida narrowly construed personal and advertising injury coverage for data-breach claims under a commercial general liability policy. In Innovak International, Inc., v. The Hanover Insurance Company, the court held that The Hanover Insurance Company (the insurer) has no duty to defend Innovak International, Inc. (the insured), against a putative class action arising from a data breach that compromised users’ personal private information (“PPI”).

The court narrowly construed the policy’s definition of “personal and advertising injury” that included “[o]ral or written publication in any manner of material that violates a person’s right of privacy.” Despite the absence of a requirement that the insured publish that material, the court held that the policy only extended coverage to publication by the insured.

The court held that “[t]he act that violates the claimants’ right of privacy is the publication of their PPI, and the Underlying Claimants have not alleged that Innovak directly or indirectly committed that act.” The court rejected Innovak’s arguments that the phrase “in any manner” includes both “direct publication of PPI and negligent failure to prevent third parties from obtaining the PPI.” Following a New York state court decision (Zurich American Insurance v. Sony Corporation of America), the Florida court construed the phrase “in any manner” to refer to the medium rather that the sender of the information.

The court also rejected Innovak’s argument that the putative class action complaint alleged that Innovak indirectly published the PPI. The court held that the complaint clearly alleged that Innovak failed to protect the users’ PPI by failing to implement sufficient data security measures – which is not an allegation of publication at all. The court distinguished a California case, Hartford Casualty Insurance Co. v. Corcino & Associates, et al., because that complaint alleged that the insured posted private information on a public website, and the court did not address the same legal issues.

Finally, the court made short shrift of Innovak’s argument that Hanover waived its defense by omitting it from its denial letter, because the particular defense was included within the letter.

This case serves as a reminder that organizations should not assume that their commercial general liability policies will cover losses from data breaches – even if the organization purchases a data breach enhancement, as Innovak did. The policy’s Data Breach Form provided only data breach services and paid only data breach expenses and expressly excluded “fees, costs, settlements, judgments or liability of any kind” arising out of a data breach. The lack of coverage under the Data Breach Form left Innovak with only the personal and advertising injury coverage, which, in this instance, did not extend to the putative class action against Innovak.

As often mentioned on this blog, prudent insureds should purchase dedicated cyber insurance coverage if at all possible. Smaller organizations may rely on coverage enhancements to their existing insurance programs but should recognize the risk of this strategy. Under either a traditional or specialized cyber insurance program, all insureds should scrutinize policy language to understand the scope of coverage and –more importantly – the limitations of that coverage for data breach and other cyber-related exposures.

The Professional Services Exclusion: You May Not Have the Coverage You ThinkCould you be providing “professional services” that might lead to liability excluded by your commercial general liability policy? The answer may be different than you think.

A recent unpublished Eleventh Circuit opinion provides a reminder that it is important to review your CGL policy and understand whether you are covered. The facts upon which the court relied in Witkin Design Group, Inc. v. Travelers Property Casualty Co. of America appear simple enough. An intersection traffic accident resulted in the death of a young boy. The resulting lawsuit included a negligence claim against the landscape architect who designed and constructed the intersection. The landscape company called on its CGL insurer to defend and indemnify it from the claim. You can imagine the company doing so with the thought that a liability claim had been brought and its general liability policy would provide coverage for that claim.

Like most CGL policies, however, this CGL policy contained a professional services exclusion that excluded coverage for claims “arising out of the rendering of or failure to render any ‘professional service’.” Professional services were defined by the policy as “any service requiring specialized skill or training.” The CGL policy said that professional services included:

a. Preparation, approval, provision of or failure to prepare, approve, or provide any map, shop drawing, opinion, report, survey, field order, change order, design, drawing, specification, recommendation, warning, permit application, payment request, manual or inspection;

b. Supervision, inspection, quality control, architectural, engineering or surveying activity or service, job site safety, construction contracting, construction administration, construction management, computer consulting or design, software development or programming service, or a selection of a contractor or subcontractor; or

c. Monitoring, testing, or sampling service necessary to perform any of the services included in a. or b. above.

But, these are merely non-exhaustive examples. The Eleventh Circuit was clear: “the professional service exclusion applies to any service requiring specialized skill or training.” Because the claim for which the landscape company sought coverage arose out of its design and construction of the intersection, which required specialized skill or training, the court found the professional liability exclusion applied, resulting in no coverage under the CGL policy.

The Eleventh Circuit’s opinion is not ground-breaking. Whether an insured’s conduct constitutes excluded “professional services” is a frequently litigated coverage question, which turns on policy language, the insured’s specific conduct, and applicable state law’s definition of professional services. Other recent examples of cases in which courts have found no coverage because of professional services exclusions include a claim against a home inspector alleging failure to discover insect and water damage; a claim against a real estate broker who failed to disclose an adverse property condition; a claim against a property manager for failing to properly supervise construction; and a claim against an insurance company for misrepresenting insurance policies.

Simply because a professional services claim is excluded by the CGL policy, however, does not always mean that the insured is left holding the bag without insurance coverage. Many companies purchase professional liability policies, which are errors and omissions policies intended to provide coverage for claims arising from the specific professional services in which the insured is engaged. It is critical to understand, however, that these policies may define “professional services” differently than the insured’s CGL policy, and care should be taken to ensure that your professional liability policy covers what your CGL policy may exclude.

So, while the Eleventh Circuit’s recent decision is not ground-breaking, it does provide a useful reminder to think about whether you have the liability coverage that you think you have.  We suggest that you consider the following questions, and discuss them with your broker or attorney if necessary:

  • Does my CGL policy have a “professional services” exclusion?
  • Am I engaged in conduct that could expose me to liability claims and that could be construed as a “professional service” as defined and excluded by the policy?
  • Do I need to purchase a professional liability policy to protect from those claims, and does that professional liability policy cover what the CGL policy excludes?

It is better to know the answers to these questions now, rather than find out after a claim has been filed that you don’t have the coverage you thought. After all, It Pays to be Covered.™