On September 15, 2015, the Third Circuit Court of Appeals declared that Lamorak Insurance Company (formerly OneBeacon America Insurance Company)  and the Hanover Insurance Group don’t have to defend their insureds, Urban Outfitters, Inc. and its subsidiary Anthropologie, Inc., under “personal and advertising injury” coverage in three putative class action lawsuits challenging the stores’ collection of customer zip codes.

The putative class actions are in the District of Columbia, and Massachusetts and California state courts. Each of the underlying lawsuits alleged that the stores improperly requested and collected zip code information from its customers who made purchases with credit cards. The allegations as to how the retailers used the information varied among the suits.

The retailers sought coverage for each of the lawsuits under general liability policies. The insurers filed a declaratory judgment action in the United States District Court for the Eastern District of Pennsylvania. On a motion for summary judgment, the District Court held that the insurers had no duty to defend or indemnify the lawsuits for a variety of reasons. In a three-judge panel applying Pennsylvania law, The Third Circuit affirmed the District Court’s ruling.

In the underlying D.C. action, the lawsuit alleged that the retailers collected the customer data for use in “direct marketing campaigns.” The insurers sought coverage under the policies’ obligation to defend suits seeking damages for “personal and advertising injury.” The Third Circuit declined to find coverage and agreed with the District Court that “publication requires dissemination to the public at large.” The Court was guided by the ordinary dictionary definition of “publication.”

In the California case, the lawsuit alleged that the retailers used the information for its own marketing efforts and sold, or “published,” it to third party vendors. Specifically, the lawsuit alleged a violation of California’s Song-Beverly Credit Card Act, which prohibits businesses from requesting personal information from customers in connection with credit card transactions. The Court found applicable the policies’ exclusion titled “Recording and Distribution Of Material Or Information In Violation of Law,” which excludes coverage for:

‘Personal and advertising injury’ arising directly or indirectly out of any action or omission that violates or is alleged to violate … [a]ny federal, state or local statute, ordinance or regulation … that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.

In OneBeacon America Ins. Co. v. Urban Outfitters, No. 14-2976 (3d Cir. Sept. 15, 2015), the Third Circuit concluded that, because the lawsuit alleged a violation of the Song-Beverly Credit Card Act, the exclusion applied and the insurers didn’t have any defense or indemnity obligations.

In the Massachusetts action, the lawsuit alleged that the retailers used the information for targeted junk mail efforts. The Third Circuit considered whether the collection of customer information violated the customers’ rights of privacy. The court discussed that a person’s “right to privacy” applies to an individual’s right of secrecy, not to seclusion. The Third Circuit held that the insurers did not owe the retailers a defense or indemnity and reasoned that, because the retailers did not disclose confidential customer information to third parties, it did not qualify as a violation of their “right to privacy.”

This decision reinforces the narrower contours of personal and advertising injury coverage in general liability policies. This coverage is intended to cover liability from claims of libel, slander, invasion of privacy, copyright infringement, and misappropriation of advertising ideas (under the rubric of advertising injury), or false arrest, detention or imprisonment, malicious prosecution, wrongful eviction or entry, trespass and nuisance (under the rubric of personal injury offenses). The coverage is typically referred to as “Side B” coverage under a general liability policy, and is typically narrower than “Side A” bodily injury and property damage coverage. It is noteworthy to see how courts are contending with newer risks, such as the risk of data-mining, as in the Urban Outfitters decision here, or for cyber-security risks, such as a data breach incident for which the Connecticut Supreme Court found no coverage under the policyholder’s Side B coverage. For policyholders, the decision counsels in favor of careful design of an insurance package, to ensure any specialized risks, such as the risks of data collection, are addressed.

Image source: Pixabay