Class action lawsuits alleging statutory violations for privacy-related claims are on the rise. Like all class actions, these suits are expensive to defend and often expensive to resolve. Whether there is insurance coverage for such suits is hotly contested, and insurance companies increasingly are rushing into court trying to obtain determinations that they are not obligated to cover the latest lawsuit. This “race to the courthouse” should be seen for what it is: a strategy akin to “the best defense is a good offense.”
Businesses should not assume that there is no coverage for these class action lawsuits. Many policies contain broad coverage grants that are subject to exclusions that courts are required to construe narrowly. Moreover, some exclusions apply only to indemnity coverage, such that the insurer will be obligated at least to pay defense costs. The facts of each claim and the precise language in each policy are operative, however, and knee-jerk denials of coverage should not be accepted. Rather, experienced coverage counsel should be consulted to review the scope of available coverage.
The Nature of the Liability
An increasing number of federal and state statutes regulate how businesses interact with their customers and the public to protect personal and private consumer information. These statutes typically regulate conduct that affects a large number of consumers and award statutory damages for each violation, even if there is no evidence of actual damages. The statutory award can range from $100 to $2,500 per violation, and it is not uncommon for the potential class to include many thousands of members. Thus, companies are exposed to multimillion-dollar statutory damage awards. Moreover, most of these statutes allow for an award of attorney's fees and costs once a violation has been shown, and, as with any class action lawsuit, the attorney's fees often run up into the multimillion-dollar range.
By way of example, the Telephone Consumer Protection Act (“TCPA”), originally enacted over 20 years ago to protect consumers from unwanted telephone calls and faxes, has been the subject of a large number of class actions across the country. Typically, these suits target unsolicited fax advertisements, calls to residential numbers on the “do not call list,” and auto-dialed or prerecorded calls to residential numbers and cell phones. The TCPA allows for minimum statutory damages of up to $500 and allows recovery of attorney's fees.
The Video Privacy Protection Act (“VPPA”) is an anachronistic statute that has seen new life as the video rental store moved to the Internet. Enacted in 1988, the VPPA prevents the retention and distribution of data on consumers' movie watching habits. The advent of online streaming video content such as Netflix and YouTube has given this statute new relevance. The VPPA provides for statutory damages of $2,500 along with an award of attorney's fees.
For other statutes, amendments have created new causes of action that are being vigorously pursued by the plaintiffs' class action bar nationwide. The Fair Credit Reporting Act (“FCRA”), which regulates the collection and use of consumer information for credit and background reports, was amended in 2003 by the Fair and Accurate Credit Transactions Act (“FACTA”) to, among other things, prohibit the amount of credit card information that may be printed on customer receipts. Both the FCRA and FACTA allow for statutory damages of $100 to $1,000, plus attorney's fees.
The common theme to all these statutes is that claims are very expensive to defend and expose companies to very significant settlements and judgments. Most companies expect, and need, to rely on insurance coverage to resolve these liabilities.
The Scope of Available Coverage
A variety of different insurance policies may provide coverage for some or all of the claims asserted in a statutory class action lawsuit. Most companies have commercial general liability (“CGL”) and umbrella liability policies that should be evaluated for coverage. In addition, some companies may have errors and omissions (“E&O”) and/or cyber liability policies that provide coverage for such lawsuits. Indeed, some lawsuits may require a “patchwork quilt” of insurance policies to address the asserted claims. Consulting with experienced coverage counsel to navigate the nuances of these different coverages is highly recommended.
The CGL policy provides coverage for “personal injury,” which typically is defined to include invasion of privacy, defamation, slander, and libel. Most statute-based privacy claims include allegations that trigger this coverage. For example, a movie rental service that rented movies nationwide over the Internet and through self-service kiosks was named as a defendant in a class action lawsuit alleging that it retained and used customer rental history for marketing purposes in violation of the VPPA. The company sought coverage under its CGL policy, and the insurer denied coverage.
Many CGL policies now contain exclusions for statutory violation claims. It is very important, however, to carefully review the scope of these exclusions as insurers tend to try to “stretch” their application. Likewise, many insurers will broadly pronounce that statutory damages are not covered by the CGL policy without citing any specific policy language to support that contention. Courts in many jurisdictions have rejected coverage denials on this ground.
Policyholders also must be on the lookout for important differences that may exist between the scope of coverage provided by CGL and umbrella policies. Sometimes, the umbrella policy may contain a broader coverage grant or a narrower exclusion that imposes a coverage obligation on the umbrella insurer.
Another potential source of coverage for these lawsuits is an E&O policy. Businesses that provide professional services that include the handling of consumer information likely have E&O coverage. It is important for those companies to carefully review their E&O policies to make sure that “loss” is broadly defined and any exceptions to the definition are narrowly tailored. These companies also must carefully evaluate the terms and conditions of any “intentional acts” and/or breach of contract exclusions that may be contained in the policy. In some instances, an exclusion may apply only to the insurer's indemnity obligation such that a defense for the class action must be provided.
Finally, there are specialty insurance policies – broadly referred to as “cyber liability” or “media” policies – that provide coverage for specific kinds of risk, including privacy-related claims. These specialty policies will cover claims associated with data breaches, hacking, and inadvertent releases of personally identifiable information and other consumer information that may be alleged in a class action lawsuit. It is important to emphasize, however, that there are currently a wide variety of “cyber” liability policy forms available on the market, and the scope of coverage provided varies tremendously from one form to the other. Moreover, because these policies are relatively new, there is not a well-developed body of law addressing coverage disputes under these types of policies. Accordingly, companies will be well served to perform a careful risk assessment and policy form review before the policy is purchased so that the necessary and expected coverage is in place when a claim is presented.
Once You've Found Coverage, Don't Lose It
After a class action lawsuit has been filed and all applicable policies have been identified, notice should be promptly given to the relevant insurers. Depending on the facts of the lawsuit, companies should be careful to consider whether prior policy periods should be noticed.
The importance of prompt notice cannot be overstated because, among other things, coverage for defense and investigative costs typically begins with notice to the insurer. Likewise, defense costs typically will not be “credited” against any applicable self-insured retentions and/or deductibles unless the insurer is on notice of the claim.
More important, in some jurisdictions, a slight delay in giving notice of a claim may provide the insurer with a strong late-notice defense, even if the insurer was not prejudiced by the delay. In addition, some policies are written on a “claims made” basis and delayed notice may be fatal for the claim. Accordingly, the best practice is to provide notice early and broadly as soon as possible after the lawsuit has been served.
Conclusion
Statutory class actions are significant liabilities that require substantial resources to resolve. Too often, companies wrongfully assume there is no coverage for these claims because their insurer has issued a knee-jerk denial, or because they consider insurance coverage too late in the process of responding to the suit. Coverage is available under many policies for at least some of the claims asserted. While these claims can present novel coverage issues, they can be addressed or mitigated with prompt and careful attention.
About the Authors
Lynda A. Bennett is the chairwoman of Lowenstein Sandler's insurance coverage practice, and she regularly represents policyholders in insurance coverage dispute and counseling matters. Ryan J. Cooper is a Litigation Counsel with the firm's insurance coverage and class action litigation groups. The authors may be contacted at [email protected] and [email protected], respectively.