Insurance for Information Stolen in Data Breaches

http://ow.ly/786tb

An article by Joseph D. Jean and Rachel M. Wrightson published by the New York Law Journal and posted on law.com on the LTN webpage.

This article discusses insurance policies for data breaches and cyber hacking incidents.  The authors state, "A recent, high-profile legal dispute between Sony Corporation of America (and some of Sony's affiliated companies) and Zurich American Insurance Company over data breach liability claims highlights the challenges companies confront to secure coverage for expenses related to cyber-risks. See Zurich American Insurance Company v. Sony Corporation of America, No. 651982/2011 (N.Y. Sup. July 20, 2011)."  The article provides a link to information about the referenced case.  In addition, the article states, "Zurich's complaint seeks to absolve Zurich of any responsibility to defend or indemnify Sony for the claims asserted in the class action complaints and "miscellaneous claims" arising from the data breaches."

The article also discusses the fact that there is often a "publication" requirement associated with the data breach insurance policies.  This is said to mean that the data must have been disclosed to a third-party.  The authors state, ""Publication" should not be an issue in these cases in any event. Indeed, the crux of the claim by an individual whose personal information has been compromised by a hacker is that their privacy has been invaded."

In addition, there are other issues involved with damage calculations, as oftentimes the party whose privacy might have been violated receives non-monetary benefits (such as coupons for service).  This fact makes it harder to calculate the damage amount that the insurer must pay.

The authors provide certain advice,  "As hacker attacks and data and security breaches proliferate and take new shape, so too do the accompanying risks. When a company becomes aware that it has been subject to a data breach, it should immediately place its general liability insurer on notice and investigate coverage under that policy."