As a follow-up to the case of National Union Fire Insurance Company of Pittsburgh, PA v. Coinstar, Inc., No. C13-1014-JCC (W.D. Wash. Feb. 28, 2014) (see my blog post here), the Southern District of Indiana also recently addressed a privacy issue in the commercial general liability context and similarly denied coverage.
Defender Security Company v. First Mercury Ins. Co., No. 13-245 (S.D. Ind. Mar. 14, 2014), involved an underlying class action in which phone conversations were recorded without notice to callers. Lead plaintiff Kami Brown alleged that she had telephone conversations disclosing her name, address, date of birth and social security number to employees of Defender Security. The underlying complaint alleged violations of California's Invasion of Privacy Act, arguing that calls were systematically recorded by Defender without notifying the caller of the recording. A federal judge in California denied Defender's Motion to Dismiss in October 2012 and in December 2013, Defender filed the coverage action against First Mercury, arguing that the insurer had a duty to defend and indemnify Defender.
Central to the court's analysis was the policy language pertaining to "Advertising Injury" and "Personal Injury." Under both provisions, coverage required that the injury arose from "publication of material that violates a person's right of privacy." First Mercury argued that the complaint did not allege any "publication" of the information and the court agreed. Conceding that "publication" can be found when communication is to just one individual (See Doe v. Methodist Hospital, 690 N.E.2d 681 (Ind. 1997)) the court nevertheless found that the facts in the case at bar showed that the underlying plaintiff established:
"...at most only that she published information about herself, not that Defender published information about her. Assuming the truth of Ms. Brown's allegation that Defender utilized 'Call Recording Technology' to store the recording of her telephone call likewise shows merely that Defender maintained a record of the call, not that it communicated the content of the recording to anyone." (emphasis in original).
The court therefore found that First Mercury had no duty to defend the insured and granted First Mercury's Motion to Dismiss.
There does not appear to be substantial case law on the "publication" issue but given the rise in data breach scenarios in which personal information is exposed, cases that analyze the publication requirement of many CGL policies will be closely watched.