Case Briefs

Policyholder efforts to shoehorn coverage for data breach liability into the personal and advertising liability coverage of Commercial General Liability (CGL) policies have suffered a setback. A New York trial court has held that the theft of information by third-party hackers breaking into a computer system does not qualify as “oral or written publication in any manner of material that violates a person's right of privacy” for purposes of personal and advertising injury coverage (Coverage B) in a CGL policy. Zurich Am. Ins. Co. v. Sony Corp. of Am., 651982/2011 (N.Y. Sup. Ct., N.Y. Cnty. Feb. 21, 2014). Describing the case before it as the only “data breach case of this magnitude” involving CGL policies, the court agreed with insurer arguments concerning the scope and intent of coverage for “oral or written publication in any manner of material that violates a person's right to privacy.” This provision, the court concluded, requires “an act by or some kind of act or conduct by the policyholder in order for coverage to be present.”

Sony's PlayStation Network, which allows users to play video games against each other over the Internet, was hacked in April 2011. The hackers stole personally identifiable information belonging to over 77 million users, which was one of the largest data breaches in history. After the breach, Sony tendered suits brought by its customers to its CGL carriers, arguing that the hackers' theft of personal information fell within the enumerated offense of “oral or written publication in any manner of material that violates a person's right or privacy” under Coverage B. The carriers sought a declaratory judgment that the data breach claims did not fall within the policy's coverage.