Conn. court determines that lost data isn’t a “publication” under CGL

In a case that explores a different view of data breach cases and insurance coverage, the Connecticut Supreme Court has agreed with a lower court that a commercial general liability policy did not provide defense or indemnification in the case of an information management company that lost computer tapes containing personal information.

In the case of Recall Total Information Management, Inc., et al. v. Federal Insurance Company et al., Recall Total had a contract with International Business Machines (IBM) to transport and store computer tapes containing personal information of current and former IBM employees, according to the Connecticut high court’s decision. Recall then outsourced the project to a subcontractor called Ex Log, which lost the tapes, but carried a CGL and an umbrella policy with Federal Insurance Company and Scottsdale Insurance Company, both of which named Recall as an additional insured. The tapes fell off a truck operated by Ex Log and were “retrieved by an unknown individual.”

“There is no evidence that anyone ever accessed the information on the tapes or that their loss caused injury to any IBM employee, but IBM spent significant sums providing identity theft services and, in informal negotiations, sought reimbursement of those sums from Recall and, by extension, Ex Log,” noted the Court.

Recall argued that under the insurance policies, the loss amounted to a personal injury coverable under the CGL’s provision for any injury “caused by an offense of . . . electronic, oral, written or other publication of material that . . . violates a person’s right of privacy . . . .” The Appellate Court determined that the loss didn’t constitute a “publication” of the material and the Supreme Court agreed.