As reported on the Hunton Insurance Recovery Blog, data breach claims involving customer data can present an ever-increasing risk for many retailers and other companies. A recent case further supports efforts to recover the costs associated with such claims. Specifically, a panel of the Fourth Circuit confirmed that general liability policies can afford coverage for cyber-related liabilities, and ruled that an insurer had to pay attorneys’ fees to defend the policyholder in class action litigation in Travelers Indemnity Company v. Portal Healthcare Solutions, No. 14-1944. Syed Ahmad, a partner in the Hunton & Williams LLP insurance practice, was quoted in a Law360 article concerning the importance of this decision.
In the Portal case, the specific issue was whether the mere online availability of sensitive information constitutes “publication” for purposes of triggering an insurance policy’s personal or advertising injury coverage and its corresponding duty to defend. The appellate court ruled it does and adopted the district court’s reasoning that “[p]ublication occurs when information is ‘placed before the public,’ not when a member of the public reads the information placed before it.” That the information may not have actually been accessed does not factor into whether the information was “published” for purposes of triggering coverage. Rather, the immediate accessibility to information and the broad reach of that material is itself sufficient to amount to the requisite publication.
The ruling can have broad implications for retailers and companies across many industries that work with electronically stored information because it can support efforts to secure additional insurance coverage for data breach claims.