Insurance coverage lawyers and commentators have drawn considerable attention to state and federal data protection statutes in recent years. E.g., Freya K. Bowen, “Beyond GDPR: Insurance Coverage for Emerging Cybersecurity and Privacy Regulatory Exposure,” Perkins Coie Tech Risk Report (April 10, 2019), available here. Statutes governing the collection and use of biometric data have received much less attention, even though several states have passed such statutes and other states presently have some version under consideration. As previously noted in this blog, Jim Davis, “Biometrics Liability on the Rise: Are you Covered?” Perkins Coie Tech Risk Report (May 8, 2019), available here, these statutes apply to data as diverse as fingerscans DNA swabs, and even, potentially, facial recognition scans. Companies may be subject to regulatory actions or private litigation for violations, and, naturally, may seek insurance coverage for the resulting exposure. Some of these insurance claims will be subject to the same issues arising with claims relating to other data protection or privacy statutes, while other claims will raise specific insurance concerns unique to biometric data. Although these statutes are quite new, several recent cases help give policyholders a good indication of where the key risks may lie. Policyholders with exposure to these statutes should ensure that the appropriate insurance coverage is in place. 
Continue Reading Employee Biometric Data: Are You Covered for Collecting or Using It?

As previously reported here, (Nov. 8, 2017), companies falling victim to electronic impersonation (“spoofing”) schemes have frequently turned to “computer fraud” coverage found in typical crime policies. In this type of fraud, someone impersonates a vendor, contract partner, or company executive via email or other electronic means, and directs the transfer of funds to

Can an intentional attack carried out through social media trigger liability coverage? A recent Pennsylvania case found potential coverage under a homeowner’s policy for a case of cyber bullying that ended in the suicide of the victim. The court found that the intentional actions of the insured’s son constituted an accident, and therefore an occurrence, because the claim in part alleged negligence and because the actions of the victim were not necessarily expected from the standpoint of the insured. This specific situation is, of course, unlikely to arise in the context of a businesses concerned about social media risks, but the underlying reasoning may be useful in assessing potential coverage for other intentional acts carried out over social media or other communications technology.
Continue Reading Can There Be a Duty to Defend Intentional Acts on Social Media?

Many businesses rely upon social media to raise awareness and enhance visibility of a new product or new line of business.  Social media platforms such as Facebook are often used to generate buzz around an opening or a launch before it takes place.  Anticipatory use of social media, however, can complicate insurance coverage if the right policies are not already in place.  The Idaho Supreme Court recently upheld the denial of coverage to a business that had published a preview of a new logo prior to opening.  Scout, LLC v. Truck Ins. Exch., 434 P.3d 197 (2019).  The court held that a Facebook post by the insured pub showing a close facsimile of the anticipated logo constituted a “prior publication,” triggering an exclusion under the pub’s subsequently purchased commercial general liability policy.  Although some other courts have reached different conclusions in relatively similar circumstances, the case stands as a cautionary tale for new businesses.
Continue Reading Social Media and New Businesses: Can Anticipatory Use of Social Media Threaten Insurance Coverage?

Social engineering and electronic impersonation scams have increased in recent years, as have cases involving resulting claims for insurance coverage. Claims typically involve the impersonation of a company executive, employee, or client and a fraudulent electronic communication directing an employee of the policyholder to transfer funds to another account. As outlined in our update of November 8, 2017, courts differ significantly as to whether or not this situation triggers coverage under a standard crime policy or fidelity bond. For example, some courts have held that the scheme does not produce a loss “resulting directly” from the “use of a computer” as required for certain “computer fraud” coverage. E.g., Apache Corp. v. Great Am. Ins. Co., 662 Fed. Appx. 252, 258 (5th Cir. 2016); Incomm Holdings, Inc. v. Great Am. Ins. Co., No. 1:15-cv-2671-WSD, 2017 WL 1021749, at *8-*10 (N.D. Ga. Mar. 16, 2017). Other courts have reached the opposite conclusion and found coverage. E.g., Principle Solutions Grp., LLC v. Ironshore Indem., Inc., No. 1:15-CV-4130-RWS, 2016 WL 4618761, at *2, *5 (N.D. Ga. Aug. 30, 2016).

Continue Reading False Pretense Exclusion No Bar to Coverage of Fraudulent Impersonation Scams