Between the Lines

A Discussion of Case Law and Statutory Law Affecting Commercial Lines of Insurance


Three Strikes, You’re Out: General Liability Coverage and Privacy Claims

Retailer Whiffs on Personal and Advertising Injury Coverage for ZIP Code Claims

Businesses seeking insurance coverage for privacy violation claims keep striking out.

Policyholders don’t have a great batting average lately for coverage claims under general liability policies where the underlying suit alleges mishandling of private customer information. OneBeacon America Ins. Co. v. Urban Outfitters, Inc., United States District Court for the District of Pennsylvania Civil Action Number 13-5269 (May 15, 2014), is yet another decision illustrating why many businesses are looking at separate cyber liability and privacy  coverage for these risks (see my earlier post on this issue here).

The Urban Outfitters case vividly illustrates the difficulty facing policyholders seeking to access shrinking general liability privacy coverage for statutory privacy claims.  If you can get past the publication requirement, and the plaintiffs frame their allegations in a way that fits the jurisdiction’s case law regarding what types of privacy violations are covered, you are likely to be faced with an exclusion barring coverage for statutory violations.

Urban Outfitters was sued in three different jurisdictions for collecting ZIP code data from customers while processing credit card purchases.  Urban tendered the claims to its general liability insurers, who filed for declaratory judgment in the Eastern District of Pennsylvania, where Urban is based.  The issue was the applicability of the general liability policies’ personal and advertising injury coverage, which applies to damages for “oral or written publication of material that violates a person’s right of privacy.”

In a recent decision, the court called Urban out on strikes, ruling it was not entitled to coverage in any of the underlying suits, for three different reasons.

The fastball

First up was a suit alleging violations of the District of Columbia’s Consumer Identification Information law alleged that Urban collected ZIP codes from customers and used them for direct marketing.     That suit did not allege that Urban disseminated the ZIP code information to third parties, just that it used the information to market to the plaintiffs.  The court ruled there was no “publication,” as is necessary to trigger personal and advertising injury coverage, and therefore no coverage.

The curve

Next up was  a California suit alleging that Urban violated the Song-Beverly Credit Card Act of 1971, which prohibits businesses from requesting or requiring personal identification information from consumers as a condition of a credit card transaction.  Because there were allegations that Urban disseminated  customer ZIP code information to other businesses, the court ruled that there was a publication.  Also, under Pennsylvania law, the personal and advertising injury coverage for privacy applies to claims for violation of the right to secrecy, but not claims alleging intrusion upon seclusion.  The suit turned on the private nature of the information, the court found, so the California suit alleged a claim based on the right to secrecy.  However, the policies excluded personal and advertising injury arising out of violation of a statute that prohibits the collection or dissemination of information.  The California statute fell within the exclusion, so there was no coverage for the California suit.

The slider

Finally, in a Massachusetts suit, the plaintiffs alleged violation of a state statute prohibiting a business from requiring a customer to provide personal identification information not required by the credit card issuer.  The Massachusetts Supreme Judicial Court has determined that this statute applies to ZIP codes.  However (presumably in order to establish an injury under the Massachusetts consumer protection statute), the plaintiffs alleged that they were injured by receiving junk mail from Urban after it used the ZIP codes to find their addresses.  That is an intrusion upon seclusion, a recognized privacy tort, but not a violation of the right to secrecy, and therefore not a privacy violation within the personal and advertising injury coverage as interpreted by Pennsylvania courts.  There was no coverage for the Massachusetts suit.

The court granted the insurers summary judgment declaring they had no duty to defend Urban in any of the three suits.


About the Author

Harvey Nosowitz – Counsel

Harvey helps clients with commercial litigation, in particular insurance coverage, personal injury and products liability cases.

Please contact him with any questions:
(617) 621-6555.

Posted In: Personal and Advertising Injury

Find an Attorney