Does Your CGL Policy Include Cybersecurity Coverage?

As implied by the name, the commercial general liability (CGL) insurance policy provides businesses with coverage for a wide array of claims by third parties, including claims for damage to “tangible property” and claims arising out of a “publication … of material that violates a person’s right of privacy.” CGL coverage, however, is limited by a number of standard exclusion provisions that eliminate coverage for certain types of claims, such as some contract-based claims and damages caused by pollution.

Now, companies can expect that claims based on data breach incidents uniformly will be denied under the new standard forms for CGL policies. This is because new forms for CGL policies issued by ISO—the Insurance Services Office, Inc. (an insurance industry organization that develops standard policy forms that are adopted by many insurance companies and often are approved by state insurance agencies)—expressly exclude coverage for these incidents.

Data breach incidents, like the one suffered by Target at the end of 2013, have received much publicity in recent news and for good reason. Data breaches can involve tens of thousands, and sometimes millions, of affected records and people. The costs for such incidents are significant. A 2014 study reported that the average cost of a data breach to a company was $3.5 million.[1] Target has reported approximately $236 million in total costs thus far for its breach-related costs.

Companies that have turned to their CGL policies for coverage of their data breach claims usually are met with resistance by their insurers. Because many CGL policies were written before “cybersecurity” became common parlance, insurers argue that CGL policies were not intended to cover such claims. Disputes arise, for example, over whether electronic data is “tangible property” or whether there must be actual use or disclosure of stolen data to constitute a “publication” of material that violates privacy rights. Court decisions on these issues are not uniform and vary based on the specific facts and policies at issue. In some cases, companies have prevailed against their CGL insurers in coverage disputes arising out of data breaches.

Companies are unlikely to find similar success, however, under the new ISO forms for CGL policies. Depending on the specific ISO form used, companies should expect that future CGL policies will include provisions that exclude coverage, in whole or in part, for damages arising out of any “access to or disclosure of any person’s or organization’s confidential information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information.” Coverage also may be excluded for damages arising out of the “loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data.”[2] 

Although courts have not yet had the opportunity to interpret these provisions, insurers certainly will be much better positioned under these new forms to deny data breach claims.

Companies that have assumed that their CGL policies will insure against data breach incidents were already on shaky ground before the new ISO forms became effective. That assumption is even more tenuous under newer CGL policies. Thus, businesses should consider carefully whether an insurance policy designed specifically for data breach liabilities is needed to complete their risk management strategies. These specialty policies are rapidly developing as a niche market in response to denials of coverage under CGL policies, and the expansion of this specialty market should accelerate with the new ISO form CGL exclusions.

For questions about this alert, please contact Alicia Gilleskie, Christopher Smith, Jackson Moore, or John Jo. 

[1] See Ponemon Institute Releases 2014 Cost of Data Breach.

[2] See ISO forms CG 21 06 05 14, CG 21 07 05 14, and CG 21 08 05 14.