An Ironshore Cyber Policy--Part IV--Ins Ag I.C

TechDefender

Tech E&O, Network Security, Internet Media and MPL Insurance Policy 

Insuring Agreement I.C--Privacy Liability Coverage
__________________________________________________
 

Remember: This Blog is organized around insuring agreements, definitions and exclusions. Conditions, etc., may be remarked upon briefly, but they often resemble not only each other but those found in currently existing policies.

 

This is Part IV of a series of blogs about the above named policy.  Part I was an introduction and a discussion of Insuring Agreement insofar as it closely resembled "physical-world" policies, as opposed to "cyber-world" policies.  The topic pertained to D & O insurance.  Part II was a discussion of the substantive content of the Insuring agreement Ins Ag I.B, again regarding a type of D & O liability insurance.  I.A. pertained to network security and privacy wrongful acts, both of which are extensively discussed in society.  Ins. Ag. I.B concerns the same range of problems and is a broader D & O liability policy.   As already set forth in Part I, what is written here is nothing more than a sketch and the observations are not guaranteed.



I.C. Privacy Liability Coverage

This Insuring Agreement sets forth liability insurance for Damages the Insured is legally obligated to pay for losses directly resulting from any covered claim alleging a Privacy Wrongful Act  against the Insured. (The last term includes not only the Company, plus directors and officers, but a variety of others, e.g.,  employees of various sorts, among others.)  [This passage is a bit confusing.  It  might apply to a duty to defend, or something like it, but it well not apply to actual damages suffered.  The idea in the claim is that if an insured has a legal obligation to pay something that is damages, the insurer will pay it on its behalf.

The substantive components of this Insuring Agreement are, first, the idea of Privacy Wrongful Act (PWA), second,  the idea of Privacy Incident, and third, the idea of  Damages (D).  

First we examine PWA, since the term "privacy" is not independently defined, so we start with PWA.

This is a blessed definition since it is short and direct.  PWA "means any actual or alleged act, unintentional error, omission, neglect or breach of duty by an Insured or a Service Provider that results in a" PI. 

PI--and now we arrive at the crucial part of the insuring agreement--is, roughly speaking (1) the unpermitted disclosures of Non-Public Personal Information or Confidential Corporate Information that "is in the care, custody, or control of any Insured or Service Provider, ad defined., or (2[a]) it is a violation of any Privacy Regulation or (2[b]) or is a "failure to comply with the  Company's own privacy policy."

Privacy Regulation is a concept of extraordinary significance.  It includes a number of named federal and state statutes "associated with the control and use of personally identifiable financial, medical, or other sensitive information," plus "any similar, state federal or foreign identity theft or privacy protection statute."


 

DEFINITIONS



Damages of course, is a crucial idea in all insurance policies.  The definition of Damages in this policy is a complex one, to say the least. There are 4 components of what the term means, and there are 9 lines setting forth what the terms does not mean, and the 9th line contains at least 13 different concepts which the term does not cover.

Here is that which the term applies.  It resembles traditional lists of damages in some "so-called" real world policy:

• that for which the insured is legally obligated to pay as the result of a covered judgment, award or settlement
• monies the  court victorious victim has been able to impose on the insured, e.g., attorney fees and so forth
• pre- and post-judgment interest (with exceptions)
• punitive, exemplary or multiple damages to the extent that an state law applies and to the extent more that one applies, the one which is most favorable to the insurer if insurable.

Defense costs are usually covered else where in the policy; they are usually not found in the definitions of damages.

An apparent complexity in the definition of Damages is to be found in a list of that to which the term does not refer.  The positive side of the definition is straight forward and relatively simple.  Most of its components resemble the definition or characterizations of Damages found in so-called "real-world" policies, except for defense costs.  That matter is usually set forth else where in at least most policies. The "Damages do not include" section explicitly sets forth a number of situations to which the term Damages does not apply. These matters are usually found in exclusionary sections.

There are several special components "added" on, as it were, to the definition of Damages, which are "not included" in the definition section or other sections of so called, "real-world" policies--as already stated, one would expect these to be in an exclusion section. The following are included among the not included:

#6. nearly 5 lines of activities which might have to be undertaken, including "Computer System of the Company, [its] security system and Electronic Publishing."  Significantly,  Electronic Publishing includes Electronic Data, and other things, objects, events and activities.  [MSQ:  Obviously this definition of what is not included in the a covered definition is enormously complex.] 

#7. "any discount, coupon, prize, award, redemption or other incentive;"

#8. "Bodily Injury or "Property Damage;"  [MSQ: It is easy to see why they are let's say excluded, by definition, they are two of the principal coverages under some significant "real world" insurance policies, e.g., the Commercial General Liability.

#9. Business Interruption Income Loss, Claim. . . . Regulatory Proceeding.  [In total, there are 13 separate categories included in this "not included in the definition of Damages" category.]

 And so forth. Significantly, all definitions found in the definition section are used throughout the policy.  In many "real world" policies, different sections may have at least some different definitions

EXCLUSIONS
 

The list of exclusions is a long, long one, so not many of them can be addressed.  Some are repetitions of what is in the definition or the "not included" definition of Damages and perhaps elsewhere to boot. Many of them resemble, or are analogues of exclusions found in so-called "real world" policies.

For example, there is an exclusion for Losses resulting from various causes, most of them contract based (or likely contract based).  It is more complex than the usual exclusion of that sort; it takes up 7 lengthy subsections. Perhaps what is happening here is that given the "new-ness" of this type of policy, the insurer is trying to make sure nothing is left out. Perhaps it believes that details cut exposure. Of course, this may be wrong. It may be that all they do is create new exposures.

Here are some other exclusions:

• based on actions brought by some trade associations, particularly an international array of those from the IP sector
• based on violations of various statutes
• resulting from various kinds of discrimination
• resulting from various types of unsolicited cyber misconduct
• thefts of various sorts
• IP misconducts of various sorts related to thefts  [Some of these pertain to the proposition that there is no insurance for many types of intentional acts and especially for those involving crimes.]
• mechanical and electrical faults
• gambling, etc. 

Thus, this insurance policy in general and perhaps this section in particular resemble "real world" insurance policies, but in vastly more important ways, they are a new species--one filled with new ideas, new definitions, and new coverages. Interestingly, most of the new coverages are, in one way or another, topics widely discussed in various media.

Now, for Insuring Agreement I.D Privacy Breach Expenses Coverage.  See Part V.



 

 

An Ironshore Cyber Policy--Part #1

Michael Sean Quinn, Ph.D, J.D., Etc.

1300 West Lynn #208

Austin, Texas 78703

(o) 512-296-2594

(c) 512-656-0503

mquinn@msqlaw.com

TechDefender

Tech E&O, Network Security, Internet Media and MPL Insurance Policy 

Part One (i):  Introduction

In previous parsing of cyber policies, I have tried to do whole policies all at once. That approach won't work for this policy; it may have been a bad idea as all times and across the board. With regard to this policy, I am going to divide it up, so that the individual blogs are much, much shorter. The attempt will be to do, where possible, one insuring agreement per part. In addition, there will be not attempt to spell out in detail each relevant provision: insuring agreement, definition, condition, and/or what have you. This may lead to subtleties being left out and/or other errors, but I will probably come pretty close

I will include one small  substantive thing in this introductory section.  It is a concept taken over from standard, tangible Director & Officer policies, and since the D&O insuring agreement in this policy comes first in the discussions--it is, after all, the A insuring agreement--that order makes sense, at least for now.

This Ironshore contract of insurance is a complex--very complicated--blanket cyber policy concentrating mainly on liability insurance. It contains 11 different insuring agreements (A-K), 60 "primary" definitions and a great many "included" definitions" (A-LLL).  All the insuring agreements contained at least one primary definition, and many of the primary definitions are to be found in more one.  Many of the definition parts, at least, are really exclusions in disguise, though courts do not pay attention to that obvious truth. 

In addition, there are 22 exclusions, some containing subparts, some of which take more than half a page, and--of course--almost all of them use at least one of the definitions.

Taken as a whole, the policy is 34 pages long. The application takes up 13 pages, and it becomes part of the policy. 

*******************************************************************************

 Part One (ii): Close to an Introduction

Preliminary Observation Regarding Insuring Agreement I.A

Insuring Agreement: "SIDE A" D&O LIABILITY COVERAGE

"Side A" is the first phrase in the first insurance agreement.  Many readers will not recognize it, so let's start there.  The locution "Side A" is not the same as the designation of Insuring Agreement I.A.

So, what is "Side A"?  The directors of corporations won't serve without some sort of protection from liability.  The same thing is true for "senior" officers, e.g., CEO, COO, some VIPs--roughly, whoever is named in the bylaws of the company as an officer: "Big Deal Administrators Capable of Large Decisions." 

Such protection--indemnify protection--can be provided by the entities themselves. Then again, consider Enron. Nobody wants that.

Or consider what might happen if the company went bankrupt.  The directors and perhaps the officers might  get dragged into the pit. Consider the failure of Dewey LaBoeuf.

Now consider a financial liability policy on the corporation, as well as the directors and officers. In this situation the company might take care of its self and throw the directors and officers "under the bus," as they say.

It's better for the directors and officers to have their own policy, and its better for there to be separate policy limits for each of them built into the same policy. These policies are called "Side A" policies. They are called excess policies because they quite often stand above other policies and funds. If the company can pay on behalf of a director, the Side A policy is never triggered. If the insurance on both the company the individual directors and   officers pays, then the directors and officers are protected. Only when neither the company itself nor the insurance policy covering  the company, the directors and the officers can pay all owed is the insurance that directly covers only the directors and officers, i.e., the Side A policy, ever triggered. Only if the underlying policies cannot pay will the Side Excess policy step up to the plate.

Of course, there is always the possibility--even if--it is extremely unlikely and not the sort of thing normal business persons and insurance underwriters would ever think will occur.  This would happen when neither the company nor the "together-we-stand D&O policy" actually has coverage. Maybe the individualized Side A policy would provide coverage.  If so, then the Side A policy wouldn't be just an excess policy but an umbrella policy as well.

Make sure you have read the immediately preceding blog in "Wrongful Acts, Claims, and Responses."

Now for some cyber insurance policy discussion focusing on one very complex policy.  It will involve at least 12 parts, all keyed to different insuring agreements.