As of May 1, 2014, Insurance Services Office, Inc. (ISO) requires a data breach liability exclusion endorsement to its standard commercial general liability (CGL) policy form. The endorsement is titled "EXCLUSION - ACCESS OR DISCLOSURE OF CONFIDENTIAL OR PERSONAL INFORMATION AND DATA-RELATED LIABILITY - WITH LIMITED BODILY INJURY EXCEPTION." Insurance regulators in virtually all U.S. states and territories have reportedly approved the endorsement.

Under Coverage A - Bodily Injury and Property Damage Liability of the CGL policy form, exclusion "p" is revised to exclude damages arising from any "access to or disclosure of any person’s or organization’s confidential or personal information, including … trade secrets, … customer lists, … credit card information, health information or any other type of nonpublic information…."

Under Coverage B - Personal and Advertising Injury Liability, coverage is removed for personal and advertising injury liability arising from any access to or disclosure of such non-public information. The exclusion applies to damages claimed for notification costs, credit monitoring expenses, public relations expenses, and other expenses that arise from any access to or disclosure of such non-public information. The exclusion retains a limited exception for damages that arise because of "bodily injury."

It seems that no company is immune from a data breach. According to the Identity Theft Resource Center, the number of data breaches increased 20.5 percent from January 1, through July 25, 2014 over the same time period last year.

Companies may have to incur significant expenses as a result of a data breaches. These can include computer forensic, notification, and public relations expenses. Therefore, this exclusion should provide an incentive for companies to revisit their insurance coverages to determine if they should purchase some form of data breach/data privacy/cyber liability insurance coverage.

For information concerning U.S. data security breach notification laws, please see this at-a-glance chart (add link to Privacy Corner Article).