Court rules for insurers in case of data that fell off truck

A Connecticut Supreme Court ruling holding that insurers are not obligated to defend or indemnify the loss of data under general liability and umbrella insurance could increase interest in cyber insurance.

The case involves a Chicago-based recall information management firm that had contracted with Armonk, New York-based IBM Corp. to transport and store computer tapes, according to the May 18 ruling in Recall Total Information Management Inc. et al. v. Federal Insurance Co. et al. Recall Total subcontracted the work to another firm.

Recall Total and the subcontractor had coverage under a commercial general liability policy issued by Federal Insurance, a Warren, N.J.-based unit of Chubb Corp., and an umbrella liability policy issued by Scottsdale, Arizona-based Scottsdale Insurance Co., a unit of Nationwide Mutual Insurance Co.

The problem began when 130 computer tapes containing information on 500,000 current and former IBM employees fell out of truck in February 2007. An unknown individual retrieved the information, but the data apparently never were accessed.

A settlement for notification and other costs was eventually reached with IBM, and the firms then sought $6.4 million in coverage under their policies, which the insurers denied.

The Connecticut Supreme Court agreed with an appellate court that the loss of the computer tapes did not constitute a personal injury as defined by the policies, because there had been no publication of the information that violated privacy rights.

Joseph F. Bermudez, a Denver-based partner at Wilson, Elser, Moskowitz, Edelman & Dicker L.L.P., said the ruling “just confirms (general liability) polices were not intended to, and do not, cover data breach crisis events.”

But separate cyber coverage is available.

As a result of this ruling, “you're going to see a lot of people understand the need for cyber overage a little bit more,” said Todd M. Rowe, a partner at Tressler L.L.P. in Chicago.