In OneBeacon America Ins. Co. v. Urban Outfitters Inc., 2014 WL 2011494 (E.D.Pa. 2014), the Eastern District of Pennsylvania analyzed the application of “personal and advertising injury” coverage to alleged violations of consumer confidentiality statutes and, in ruling in favor of the insurers, found that the claims did not come within the policy’s insuring agreement or were otherwise excluded.
The coverage case concerned three underlying cases alleging that Urban Outfitters and Anthropologie illegally collected customers’ zip codes when processing credit card transactions. Urban Outfitters and Anthropologie were covered by policies that insured them against claims of, among other things, “personal and advertising injury” which includes “oral or written publication, in any manner, of material that violates a person’s right to privacy.” However, under Pennsylvania law the only type of invasion of privacy which is covered under the insuring agreement is the breach of a person’s “right to secrecy.” The policies also contained an exclusion for “Personal and advertising injury” arising out of a violation of any “statute, ordinance or regulation…that addresses, prohibits, or limits the … dissemination, … collection, recording, sending, transmitting, communicating or distribution of material or information.”
The court analyzed three underlying claims to determine if the duty to defend was triggered with respect to any of them. The first claim, the Hancock Action, alleged that the insureds collected zip codes from customers when processing credit card transactions and transmitted the zip codes to corporate headquarters for use in marketing campaigns. The court held that this action did not come under the insuring agreement because the transmission of the zip code information to corporate headquarters did not constitute a “publication.” Since the insuring agreement requires an “oral or written publication” and there was no third-party dissemination that could constitute a publication, there was no coverage for the Hancock Action. However, the second claim, the Dremak Action, did involve a publication because it alleged that the zip code information was sold and disseminated to third parties in violation of the Song-Beverly Credit Card Act of 1971. Although the court held that the personal and advertising injury insuring agreement was triggered, it also held that the exclusion for claims arising out of the violation of a statute addressing the handling of information applied and, therefore, the claim was excluded.
Lastly, the third claim, the Miller Action, alleged the insured collected zip codes with credit card transactions, and used that information to send mail advertising to its customers. The court held that sending junk mail to a customer did not invade their right to secrecy, and because the personal and advertising injury insuring agreement only covered violations of the right to secrecy, there was no coverage for the claim. Accordingly, the court granted summary judgment in favor of the insurers.