Prevention & Mitigation of Losses Good Areas of Focus

John Mullen called me after reading coverage of our teleconference, Private Data Breaches: Insurance Coverage Implications & Prevention. His feeling is, in the end, typical CGL policies will not cover these events.

Of course, as Nelson, Levin, de Luca & Horst’s Complex Litigation Chair, Mullen counsels carriers and represents their insureds. But he was adamant that, as a practical business matter, because carriers did not contemplate these kinds of losses, they will not cover or, more likely, they will outright exclude them. Instead, as many major carriers are, they will write coverage specifically for what they view as a new and different kind of risk.

Some carriers have remained silent on the subject, while others have excluded claims related to data breaches. New products, riders and policies specifically for data loss have surfaced. Mullen rattled off a list of companies that are writing these policies, including ACE, Arch, AIG/Chartis, Beazley, CNA, Hiscox, Zurich and The Hartford.

Another practical issue he raised is that not that many companies are in the business strictly of data storage, relative to the number of companies simply handling, collecting and storing data as part of their business. For those companies whose business is storing data, they could find coverage for losses under their CGL or professional liability contracts. But this is a small minority of businesses/entities exposed to the risk of data breaches.