Invasion of Privacy, Hacking & IP Claims: Are You Covered?

1. Edward M. Joyce Partner Jones Day Invasion of Privacy, Hacking & IP Claims:Are You Covered?

2. The views expressed by the speakers are not those of the speaker’s employer, firm, clients, or any other organization.  The opinions expressed do not constitute legal or risk management advice.  The views discussed are for educational purposes only, and provided only for use during this session.

3. A Public Relations Nightmare • Data breaches become public • Target & Neiman Marcus (Dec 2013/Jan 2014) • Barnes & Noble (Oct 2012) • Global Payments (Mar 2012) - $84 Million • Zappos (Jan 2012) • Sony’s Playstation Network (Apr 2012) • State attorneys general publicize breaches online • Privacy advocates track and publicize breaches • Litigation

4. Coverage for Responding to a Data Breach • Property Insurance • Crime Insurance/Fidelity Bond • Cyber Liability/Data Breach Policies

5. The Lawsuits that (Inevitably?) Follow Data Breach/Invasion of Privacy • Invasion of privacy • Negligence and other tort claims • Breach of contract • Enforcement actions by federal regulators • Actions by State Attorneys General Can result in (1) substantial defense costs; and (2) possible damages/settlements.

6. Coverage for the Follow-on Lawsuits re Data Breach/Invasion of Privacy • Commercial General Liability (CGL) • Errors and Omissions (E&O) Liability • Directors and Officers (D&O) Liability • Cyber Liability/Data Breach Policies

7. Insurance Policy Conditions Traps to Avoid “Notice is not like wine, it does not get better with age!”

8. Traps to AvoidFirst Party Property Policies • Notice of loss • Proof of loss • When and how? At the Company’s request? • Partial Proof/interim payment • Suit limitation clause • Tolling agreement/waiver

9. Traps to Avoid - Liability Policies • Notice • Give notice as soon as practicable v. immediately; but give notice of what? • Notice of claim/notice of circumstances to lock in a specific policy period (typically claims made policies) • Cooperation Clause/Claims Management • What should you be sending the insurer? • Insurance Company Consent/Approval • For expenses, defense costs and settlements • Is it in writing?

10. What Triggers the First Party Property Policies for Data Breaches? • First Party Property Policies • Direct physical loss of or damage to property • Exclusions: computer data -- in or out? • Date of discovery -- Crime Insurance/Fidelity Bond • Recent 6th Circuit decision in DSW Inc. (Aug 2012)

11. What Triggers the Liability Policies for Data Breach/Invasion of Privacy Claims? • CGL Policies • Bodily Injury and Property Damage • Personal and Advertising Injury • “Oral or written publication, in any manner, of material that violates a person's right of privacy” • Covered Offense • Invasion of Privacy • During the Policy Period • Publication

12. What Triggers the Liability Policies for Data Breach/Invasion of Privacy Claims? • Claims-Made Policies • D&O, E&O/Professional Liability • Breadth of your D&O entity coverage • Private company v. public company: what are the differences?

13. What Triggers the Liability Policies for Data Breach/Invasion of Privacy Claims? • Claims-Made Policies (cont.) • Breadth of "Claim" definition - What is included? FTC action/proceeding? What kind? Subpoena? Investigations? • "Wrongful Act" definition -- error, omission and/or act; does it need to be negligent? • "Loss" Definition -- does the definition list specific ins and outs?

14. What Triggers the Liability Policies for Data Breach/Invasion of Privacy Claims? • Claims-Made Policies (cont.) • Breadth of exclusions -- willful, malicious and/or criminal acts? Whose willful, malicious and/or criminal acts? • Interrelated claims/interrelated wrongful acts -- Where does this claim go? Whose policy is up? • Tension between interrelated claims/wrongful acts, “Claim” definition, exclusions and notice

15. Questions?

16. Edward M. Joyce Partner Jones Day Invasion of Privacy, Hacking & IP Claims:Are You Covered?