Insurance Coverage in Consumer Class Actions

The business world is an increasingly difficult environment to navigate, particularly for companies providing goods and services to consumers. With each new year, federal and state legislators and regulators establish additional well-intentioned but labyrinthine statutes and regulations regarding consumer protection, including in the areas of privacy, data security, and credit reporting. The requirements placed on corporate America as a result of these laws have created significant new potential liabilities, often in the form of statutorily mandated damages, that even conscientious companies can find themselves inadvertently facing. Simultaneously, those laws have created potential opportunities for plaintiffs' attorneys to exploit.

For example, a number of retail stores employing a nationally integrated credit card processing system found themselves facing significant potential liability when California, four years ahead of the federal government, enacted a law prohibiting the printing of electronic receipts with the full 16 digits of a customer's credit card. While their actions may have been inadvertent, these companies became subjects of class action lawsuits with significant potential liabilities.

The Need for Insurance

As the proliferation of consumer protection statutes continues, more companies will become the target of class action lawsuits seeking multiple millions of dollars in damages. One often overlooked, yet potentially valuable, asset available to assist companies in defending such lawsuits is insurance. While consumer class actions raise a number of unique hurdles to recovery, a careful policyholder, particularly one that is proactive in its insurance placement, may be entitled to recover significant insurance proceeds both to defend the lawsuit and potentially to reimburse any resulting judgment or settlement.

Types of Policies

While specialized insurance policies exist for consumer liabilities ' i.e., privacy and data security (“Privacy”) policies, professional liability or errors and omission (“E&O”) policies ' companies that have not purchased such coverage should not automatically assume that they are uninsured for such liabilities. Many consumer class actions contain allegations and causes of action that trigger coverage under a standard commercial general liability (“CGL”) policy. For example, allegations that a company breached the putative class members' privacy often are covered under the standard CGL policy's “personal” and/or “advertising” injury coverages. Violation of credit reporting laws similarly may be covered under a CGL policy's coverage for slander and libel.

Therefore, while companies that reasonably can anticipate being named in a consumer class action should consider purchasing specialized policies providing the appropriate type and amount of coverage, companies that have not done so should still consider whether notice should be provided under their existing insurance programs. Indeed, policyholders are often best served by tendering notice to their CGL insurers even if they have purchased and noticed their Privacy and E&O insurers. Many policyholders have found that exclusions in their Privacy and E&O policies that restrict or eliminate coverage for specific types of claims are not contained in the more generalized coverage provided by their CGL policies. As a result, providing notice of claims to any and all potentially applicable insurers is often advisable, especially in the class action context where potential damages and legal costs can be substantial.

Providing Notice

The question of whether to provide notice of a particular claim to one's insurers is often a difficult decision. In considering this issue, policyholders should weigh the following four factors: 1) potential cost of defending the initial claim, as well as any subsequent related claims, and paying any potential judgments or settlements; 2) the potential increase in premium for future insurance policies; 3) the potential impact of providing notice on the company's ability to defend the underlying claims; and 4) potential risk of the insurer filing a declaratory judgment action seeking a no coverage ruling. Generally speaking, most policyholders underestimate the first factor and overestimate the second, third, and fourth. Insurance is specifically purchased to help offset the costs of litigation and unforeseen liabilities. Therefore, unless faced with a countervailing concern, a policyholder is typically best served by noticing its claims and seeking to collect the protections for which it paid significant premiums.

However, there are circumstances when a policyholder could find it reasonable not to tender notice, for example, when the likelihood of coverage is so remote that the potential impact on future premiums outweighs the unlikely benefits of coverage. On the other hand, insurance companies are adept at monitoring litigation trends and evaluating market risks. Therefore, whether or not a company notices its insurer of a particular lawsuit may have only a minimal impact on that insurer's assessment of the relative risks of insuring a company in a particular industry. Moreover, many insurance applications, especially those for more specialized types of coverage, require policyholders to divulge all pending litigation. As a result, a policyholder may be required to notify its carrier of a lawsuit during the placement or renewal process even if it decided not to originally provide notice.

Another question regarding the tendering of notice is how quickly a policyholder should notify its insurers. While providing notice to insurers is usually not the first thing that comes to mind when a company is sued in a consumer class action, its insurers still are likely to argue that any costs and expenses incurred prior to them being notified of the claim are not recoverable. Moreover, while New York has recently passed a statute softening its draconian late notice rule, there remain jurisdictions where late notice, with or without a showing of prejudice, is a complete defense to coverage. Therefore, in order to deprive insurers of a potential “late notice” coverage defense, policyholders should typically provide notice as soon as reasonably possible.

The Duty to Defend

In most jurisdictions, courts have determined that the duty to defend is broader than the duty to indemnify. As a result, a policyholder is entitled to a complete defense of a lawsuit if its complaint contains even one allegation or cause of action that, if proven true, would be covered by the insurer's policy, regardless of what else the complaint also alleges. This analysis is unaffected by whether the case is brought by a single plaintiff for his or her own damages or as a class action.

An area in which the defense of consumer class actions may differ significantly from a more conventional lawsuit is in the selection of defense counsel. Primary insurers with a duty to defend often have the right to select the counsel that will defend a particular claim. As a result, an insurer may select a defense counsel with whom the policyholder is either unfamiliar or in which the policyholder lacks confidence. Therefore, many companies involved in a complex class action have requested the right to use counsel of their own choice even if that counsel charges a higher billing rate than the insurer is typically willing to pay. Insurers often will accommodate such requests, provided that the policyholder is willing to pay the percentage of the ensuing defense costs in excess of its approved billing rates. Realizing the potential consequences of being penny-wise but pound-foolish, many policyholders accept such arrangements.

Potential Defenses or Limitations to Coverage

Consumer class actions raise a number of coverage issues not presented by a more conventional lawsuit.

The first such issue is whether a class action lawsuit amounts to a single “occurrence” under the policy, or whether each potential class member's claim constitutes a separate and distinct “occurrence.” In the insurance industry, this is known as the “number of occurrences” issue, and a policyholder's preferred answer will depend on the amount of both a policy's aggregate limit of liability and its deductible or self-insured retention (“SIR”). For example, if the policy does not include an aggregate limit of liability, then a policyholder may wish to consider each class member's claim a separate occurrence in order to receive multiple “per-occurrence” limits of liability. However, if the amount of the policy's deductible or SIR is more than the value of each class member's claim, then the policyholder will necessarily need to argue that the claims are a single occurrence in order to access any coverage. Given the relatively small individual injuries underlying most consumer class actions, a single occurrence interpretation is likely to be most policyholders' preference. Meanwhile, their insurers are likely to advocate the opposite position.

A second issue presented by a consumer class action is whether the liabilities sought against the policyholder defendant constitute “damages” covered by the policy. The liabilities underlying consumer class actions are often established by statute or regulation. For example, privacy protection statutes often obligate violators to pay specified dollar amounts in damages (i.e., $1,000 per occurrence). Insurers have argued that such liabilities constitute fines or penalties, which are typically expressly excluded by their policies. In response, policyholders have argued that regardless of the label, if the predetermined liabilities are paid to the victim, as opposed to the government, they are damages compensating an injury and therefore are covered by the policy.

A third coverage issue that arises in the class-action context is the “publication” requirement of most CGL policies' “personal” and/or “advertising” injury coverage clauses. Many insurers have sought to use the requirement that a claimant's injury results from the “oral or written publication” of material to argue that data security claims and other privacy related liabilities are not covered by their policies. In effect, this interpretation creates a de facto data security claims exclusion based on a narrow reading of the word “publication.” In response, policyholders have argued that “publication” is analogous to “dissemination” and any unauthorized and allegedly injurious access to a plaintiff's private information is sufficient to satisfy the “publication” requirement.

Finally, as consumer class actions have proliferated, insurers have begun adding to policies exclusions specifically tailored to eliminate coverage for such liabilities. For example, many CGL policies contain an exclusion that bars coverage for claims arising from the “distribution of material in violation of statutes.” Other insurers have been more direct by expressly excluding coverage for claims seeking damages under specific consumer protections statutes such as CAN-SPAM, FACTA, and FCRA. While arguments may exist to limit the applicability of such exclusions, policyholders who reasonably anticipate facing potential liability under such statutes should attempt to have such exclusions removed from the policy during the underwriting process.

Structuring Settlements to Maximize Coverage

Perhaps the most critical time for a company to consider its insurance for consumer class actions is when it is negotiating and documenting a settlement agreement. This is true even for those policyholders who have successfully secured coverage for their defense costs. As noted above, the duty to indemnify a judgment or settlement is narrower than the duty to defend, and a careless, and often avoidable, word choice in a settlement could adversely impact coverage. To prevent such a result, the following is a list of practical tips to consider when settling a consumer class action:

• Avoid characterizing the causes of action being settled. However, if necessary, describe the settled claims as torts, and not breaches of contracts or warranties, because many policies contain contractual liability exclusions.
• Characterize the plaintiffs' demands as a “claim” and memorialize any written requests for damages. Avoid describing the dispute as informal because insurers might use such statements to describe the settlement as a business decision or voluntary payment.
• Aggregate any monetary settlement payment in order to undercut the possibility that the insurer will argue that each class member's share results from a separate occurrence.
• Do not use the terms “penalty” or “fine” in describing a monetary settlement payment.
• To the extent practicable, limit the use of non-cash settlements that insurers could argue are not “damages” compensable under their policies.

Conclusion

As both federal and state legislatures enact new consumer protection statutes, the traps for the unwary will inevitably increase, as will the number of consequent consumer class actions. While it is important to mitigate this risk through routine audits of company practices affecting consumers to ensure compliance with both company policies and all current federal and state laws and regulations, it is equally important to explore potential insurance coverage.

Justin F. Lavella is an attorney in the Washington, DC, office of Dickstein Shapiro LLP. John W. McGuinness is an attorney in the Washington, DC, office of BuckleySandler LLP. They can be reached at [email protected] and [email protected], respectively.

The business world is an increasingly difficult environment to navigate, particularly for companies providing goods and services to consumers. With each new year, federal and state legislators and regulators establish additional well-intentioned but labyrinthine statutes and regulations regarding consumer protection, including in the areas of privacy, data security, and credit reporting. The requirements placed on corporate America as a result of these laws have created significant new potential liabilities, often in the form of statutorily mandated damages, that even conscientious companies can find themselves inadvertently facing. Simultaneously, those laws have created potential opportunities for plaintiffs' attorneys to exploit.

For example, a number of retail stores employing a nationally integrated credit card processing system found themselves facing significant potential liability when California, four years ahead of the federal government, enacted a law prohibiting the printing of electronic receipts with the full 16 digits of a customer's credit card. While their actions may have been inadvertent, these companies became subjects of class action lawsuits with significant potential liabilities.

The Need for Insurance

As the proliferation of consumer protection statutes continues, more companies will become the target of class action lawsuits seeking multiple millions of dollars in damages. One often overlooked, yet potentially valuable, asset available to assist companies in defending such lawsuits is insurance. While consumer class actions raise a number of unique hurdles to recovery, a careful policyholder, particularly one that is proactive in its insurance placement, may be entitled to recover significant insurance proceeds both to defend the lawsuit and potentially to reimburse any resulting judgment or settlement.

Types of Policies

While specialized insurance policies exist for consumer liabilities ' i.e., privacy and data security (“Privacy”) policies, professional liability or errors and omission (“E&O”) policies ' companies that have not purchased such coverage should not automatically assume that they are uninsured for such liabilities. Many consumer class actions contain allegations and causes of action that trigger coverage under a standard commercial general liability (“CGL”) policy. For example, allegations that a company breached the putative class members' privacy often are covered under the standard CGL policy's “personal” and/or “advertising” injury coverages. Violation of credit reporting laws similarly may be covered under a CGL policy's coverage for slander and libel.

Therefore, while companies that reasonably can anticipate being named in a consumer class action should consider purchasing specialized policies providing the appropriate type and amount of coverage, companies that have not done so should still consider whether notice should be provided under their existing insurance programs. Indeed, policyholders are often best served by tendering notice to their CGL insurers even if they have purchased and noticed their Privacy and E&O insurers. Many policyholders have found that exclusions in their Privacy and E&O policies that restrict or eliminate coverage for specific types of claims are not contained in the more generalized coverage provided by their CGL policies. As a result, providing notice of claims to any and all potentially applicable insurers is often advisable, especially in the class action context where potential damages and legal costs can be substantial.

Providing Notice

The question of whether to provide notice of a particular claim to one's insurers is often a difficult decision. In considering this issue, policyholders should weigh the following four factors: 1) potential cost of defending the initial claim, as well as any subsequent related claims, and paying any potential judgments or settlements; 2) the potential increase in premium for future insurance policies; 3) the potential impact of providing notice on the company's ability to defend the underlying claims; and 4) potential risk of the insurer filing a declaratory judgment action seeking a no coverage ruling. Generally speaking, most policyholders underestimate the first factor and overestimate the second, third, and fourth. Insurance is specifically purchased to help offset the costs of litigation and unforeseen liabilities. Therefore, unless faced with a countervailing concern, a policyholder is typically best served by noticing its claims and seeking to collect the protections for which it paid significant premiums.

However, there are circumstances when a policyholder could find it reasonable not to tender notice, for example, when the likelihood of coverage is so remote that the potential impact on future premiums outweighs the unlikely benefits of coverage. On the other hand, insurance companies are adept at monitoring litigation trends and evaluating market risks. Therefore, whether or not a company notices its insurer of a particular lawsuit may have only a minimal impact on that insurer's assessment of the relative risks of insuring a company in a particular industry. Moreover, many insurance applications, especially those for more specialized types of coverage, require policyholders to divulge all pending litigation. As a result, a policyholder may be required to notify its carrier of a lawsuit during the placement or renewal process even if it decided not to originally provide notice.

Another question regarding the tendering of notice is how quickly a policyholder should notify its insurers. While providing notice to insurers is usually not the first thing that comes to mind when a company is sued in a consumer class action, its insurers still are likely to argue that any costs and expenses incurred prior to them being notified of the claim are not recoverable. Moreover, while New York has recently passed a statute softening its draconian late notice rule, there remain jurisdictions where late notice, with or without a showing of prejudice, is a complete defense to coverage. Therefore, in order to deprive insurers of a potential “late notice” coverage defense, policyholders should typically provide notice as soon as reasonably possible.

The Duty to Defend

In most jurisdictions, courts have determined that the duty to defend is broader than the duty to indemnify. As a result, a policyholder is entitled to a complete defense of a lawsuit if its complaint contains even one allegation or cause of action that, if proven true, would be covered by the insurer's policy, regardless of what else the complaint also alleges. This analysis is unaffected by whether the case is brought by a single plaintiff for his or her own damages or as a class action.

An area in which the defense of consumer class actions may differ significantly from a more conventional lawsuit is in the selection of defense counsel. Primary insurers with a duty to defend often have the right to select the counsel that will defend a particular claim. As a result, an insurer may select a defense counsel with whom the policyholder is either unfamiliar or in which the policyholder lacks confidence. Therefore, many companies involved in a complex class action have requested the right to use counsel of their own choice even if that counsel charges a higher billing rate than the insurer is typically willing to pay. Insurers often will accommodate such requests, provided that the policyholder is willing to pay the percentage of the ensuing defense costs in excess of its approved billing rates. Realizing the potential consequences of being penny-wise but pound-foolish, many policyholders accept such arrangements.

Potential Defenses or Limitations to Coverage

Consumer class actions raise a number of coverage issues not presented by a more conventional lawsuit.

The first such issue is whether a class action lawsuit amounts to a single “occurrence” under the policy, or whether each potential class member's claim constitutes a separate and distinct “occurrence.” In the insurance industry, this is known as the “number of occurrences” issue, and a policyholder's preferred answer will depend on the amount of both a policy's aggregate limit of liability and its deductible or self-insured retention (“SIR”). For example, if the policy does not include an aggregate limit of liability, then a policyholder may wish to consider each class member's claim a separate occurrence in order to receive multiple “per-occurrence” limits of liability. However, if the amount of the policy's deductible or SIR is more than the value of each class member's claim, then the policyholder will necessarily need to argue that the claims are a single occurrence in order to access any coverage. Given the relatively small individual injuries underlying most consumer class actions, a single occurrence interpretation is likely to be most policyholders' preference. Meanwhile, their insurers are likely to advocate the opposite position.

A second issue presented by a consumer class action is whether the liabilities sought against the policyholder defendant constitute “damages” covered by the policy. The liabilities underlying consumer class actions are often established by statute or regulation. For example, privacy protection statutes often obligate violators to pay specified dollar amounts in damages (i.e., $1,000 per occurrence). Insurers have argued that such liabilities constitute fines or penalties, which are typically expressly excluded by their policies. In response, policyholders have argued that regardless of the label, if the predetermined liabilities are paid to the victim, as opposed to the government, they are damages compensating an injury and therefore are covered by the policy.

A third coverage issue that arises in the class-action context is the “publication” requirement of most CGL policies' “personal” and/or “advertising” injury coverage clauses. Many insurers have sought to use the requirement that a claimant's injury results from the “oral or written publication” of material to argue that data security claims and other privacy related liabilities are not covered by their policies. In effect, this interpretation creates a de facto data security claims exclusion based on a narrow reading of the word “publication.” In response, policyholders have argued that “publication” is analogous to “dissemination” and any unauthorized and allegedly injurious access to a plaintiff's private information is sufficient to satisfy the “publication” requirement.

Finally, as consumer class actions have proliferated, insurers have begun adding to policies exclusions specifically tailored to eliminate coverage for such liabilities. For example, many CGL policies contain an exclusion that bars coverage for claims arising from the “distribution of material in violation of statutes.” Other insurers have been more direct by expressly excluding coverage for claims seeking damages under specific consumer protections statutes such as CAN-SPAM, FACTA, and FCRA. While arguments may exist to limit the applicability of such exclusions, policyholders who reasonably anticipate facing potential liability under such statutes should attempt to have such exclusions removed from the policy during the underwriting process.

Structuring Settlements to Maximize Coverage

Perhaps the most critical time for a company to consider its insurance for consumer class actions is when it is negotiating and documenting a settlement agreement. This is true even for those policyholders who have successfully secured coverage for their defense costs. As noted above, the duty to indemnify a judgment or settlement is narrower than the duty to defend, and a careless, and often avoidable, word choice in a settlement could adversely impact coverage. To prevent such a result, the following is a list of practical tips to consider when settling a consumer class action:

• Avoid characterizing the causes of action being settled. However, if necessary, describe the settled claims as torts, and not breaches of contracts or warranties, because many policies contain contractual liability exclusions.
• Characterize the plaintiffs' demands as a “claim” and memorialize any written requests for damages. Avoid describing the dispute as informal because insurers might use such statements to describe the settlement as a business decision or voluntary payment.
• Aggregate any monetary settlement payment in order to undercut the possibility that the insurer will argue that each class member's share results from a separate occurrence.
• Do not use the terms “penalty” or “fine” in describing a monetary settlement payment.
• To the extent practicable, limit the use of non-cash settlements that insurers could argue are not “damages” compensable under their policies.

Conclusion

As both federal and state legislatures enact new consumer protection statutes, the traps for the unwary will inevitably increase, as will the number of consequent consumer class actions. While it is important to mitigate this risk through routine audits of company practices affecting consumers to ensure compliance with both company policies and all current federal and state laws and regulations, it is equally important to explore potential insurance coverage.

Justin F. Lavella is an attorney in the Washington, DC, office of Dickstein Shapiro LLP. John W. McGuinness is an attorney in the Washington, DC, office of BuckleySandler LLP. They can be reached at [email protected] and [email protected], respectively.