Florida Federal Court Finds No
"Personal Injury" Coverage or Data Breach Claim
St. Paul Fire and Marine sought a declaratory judgment as to whether it had a duty to defend its insured, Millennium, against a claim alleging that Millennium negligently provided data security services to Rosen Hotels & Resorts (“Rosen”), resulting in a breach of Rosen’s credit card system.
St. Paul Fire & Marine Ins. Co. v. Rosen Millennium, Inc.
, No. 6:17-cv-540-Orl-41GJK, 2018 WL 4732718 (M.D. Fla. Sept. 28, 2018). Specifically, Rosen alleged that Millennium “made private information known to third parties that violated a credit card holder’s right of privacy.”
Id.
at *3. Millennium asserted that loss of use of credit cards implicated “property damage” coverage under its commercial general liability policies and that such policies also covered Rosen’s costs for complying with notification statutes. The district court, however, ruled that these claims were not ripe for declaratory judgment because they were not specifically set forth in Rosen’s notice of claim.
The district court also found that Rosen’s claim did not potentially implicate “personal injury” coverage arising out of the enumerated offense of
"[m]aking known to any person or organization covered material that violates a person’s right of privacy.” Despite that the claim virtually tracked the language in the “right of privacy” offense, the court agreed with other jurisdictions that have interpreted “personal and advertising injury” coverage as applying to acts committed by the insured, and not when the offense is committed by an uncovered third party. The court, thus, concluded that “personal injury” coverage did not apply because the confidential information was published by third party hackers. As Millennium did not publish the information, the court also found that the claims did not arise out of Millennium’s business activities, as required to implicate “personal injury” coverage.
Millennium timely filed a notice of appeal and, thus, the Eleventh Circuit may have a chance to weigh in on whether data breach claims are potentially covered under a commercial general liability policy.
