With increasing instances of data breaches, data exclusion clauses are likely to undergo increased scrutiny before the courts. Insurers should be wary of overly broad data exclusions in policies, especially where an insured is likely to store confidential or personal information.
This case provides a potential warning to insurers that issue broadly worded “Data Exclusion Clauses”. Such clauses may be difficult to rely on as a basis for not having a duty to defend. Here, insureds brought applications seeking a declaration that the insurer owed them a duty to defend in a court action that had been brought against them pursuant to the commercial general liability and E&O policies that they had purchased. An unauthorized party had accessed confidential documents held by the insureds, and in response, those individuals who were affected brought a class action in against the insureds. The Data Exclusion stated:
There shall be no coverage under this policy in connection with any claim based on, attributable to or arising directly, or indirectly from the distribution or display of “data” by means of an Internet Website, the Internet, an Intranet, Extranet, or similar device or system designed or intended for electronic communication of “data”.
The court noted that data exclusion clauses have not yet been litigated, and that there were complex issues raised by the broad wording contained in the data exclusion clause before it. A full record would be required to properly examine this novel interpretive issue, and such a finding was not appropriate on a ‘duty to defend’ application. The court further noted that the broad language of the exclusion was likely to exclude coverage for a significant portion of services provided by the insured, thus rendering a significant portion of coverage the insurer was contracted to provide illusory. Finding that the exclusion did apply would potentially run contrary to the parties’ reasonable expectations when the contract for insurance was entered into. As such, the court could not conclude that there was no possibility of coverage under the policies and was not satisfied the insurer had discharged its onus of establishing that the substance of the claims clearly falls within the data exclusion provision.
As such, the court could not conclude that there was no possibility of coverage under the policies. Given this, the court was not satisfied the insurer had discharged its onus of establishing that the substance of the claims clearly falls within the data exclusion provision.