Read the Fine Print

Insurers are adding new restrictions to their cyber liability coverage, even as industry executives incorrectly assume that their standard insurance policies provide them with protection. “While limited coverage for some privacy, media or data breach exposures may be included in 'traditional' insurance programs comprised of commercial general liability, umbrella liability, fidelity/crime, and kidnap, ransom and extortion policies, there will inevitably be substantial gaps and plenty of room for coverage disputes,” wrote Taffae and Manguson. “Most underwriters of traditional types of insurance contend that it is not the intent of these policies to pick up cyber exposures. Changes have been made, and are continuing to be made, to these forms to clarify the intent not to cover cyber exposures.”

The authors cite numerous significant limitations that have been added to the standard Insurance Services Office, Inc. (ISO) CGL policy in the past decade, such as:

• An exclusion for damage arising from damage to or the loss of electronic data;
• A clarification that electronic data is not tangible property (thus, damage to electronic data is not covered property damage);
• An exclusion for liability arising from violation of statutes, regulations or ordinances related to sending, distributing or transmitting information;
• An exclusion for personal or advertising liability arising from chat rooms or bulletin boards owned, managed or controlled by the insured; and
• Limits on standard CGL policies to cover copyright infringement only if the infringement is in an “advertisement,” which is strictly defined and narrowly construed.

Third-Party Cyber Liability Coverage