The duty to defend under any policy depends on the terms of coverage and the exclusions. (Photo: Shutterstock/nejron-ph53)
A federal district court in Utah has ruled that an insurance company had no duty to defend its insureds under a cyber liability policy when the allegations against the insureds alleged “knowledge, willfulness, and malice” instead of “errors, omissions, or negligence.”
Global Fitness owns and operates fitness centers in several states with numerous members who provided either credit card or bank account information through which Global Fitness could bill the members (Member Accounts Data.). Federal Recovery Services, Inc. (FRS) and Federal Recovery Acceptance, Inc. (FRA) dba Paramount Acceptance (together, the defendants) provide processing, storage, transmission, and other handling of electronic data for customers. Like many merchants, Global Fitness entered into a Servicing Retail Installment Agreement with FRA that required FRA to process the Member Accounts and transfer the members’ fees to Global Fitness.
The payment process worked like this: Global Fitness obtained billing information from its members, which it then uploaded to FRA’s encrypted website, including credit card, checking account or savings account information that the member selected to be charged each month for membership. For security purposes, the only copy of the Member Accounts Data was retained by FRA on behalf of Global Fitness. FRA would process or electronically withdraw the necessary funds from the Member Accounts and transfer those funds, following FRA’s deduction of its fee, to Global Fitness.
Global Fitness decided to sell its business and entered into an Asset Purchase Agreement (APA) with L.A. Fitness. As part of the APA, Global Fitness agreed to transfer all of its Member Accounts Data to L.A. Fitness. Global Fitness informed FRA of the APA and the need to return the Member Accounts Data to Global Fitness. FRA indicated that it would cooperate and produced the Member Accounts Data, but the data was missing several critical pieces of the information requested. After additional communications, FRA again produced the data in an alternative format that included the majority of the missing pieces of the Member Accounts Data; however, FRA had not provided the credit card, checking account and savings account information. Global Fitness requested this information be returned at a date closer to the closing date with L.A. Fitness.
(Photo: Shutterstock/ismagination)
Incomplete information—on purpose?
Global Fitness sued FRA alleging that FRA withheld the Member Accounts Data until Global Fitness satisfied several vague demands for “significant compensation.” According to Global Fitness, FRA refused to transfer funds it received in servicing the Member Accounts until all matters were resolved. Global Fitness asserted claims against FRA for conversion, tortious interference, and breach of contract, and asked for injunctive relief, punitive damages, and attorneys’ fees.
Global Fitness later filed an amended complaint adding FRS as a defendant and adding various factual allegations. Among other things, Global Fitness alleged that “Paramount and/or FRSI withheld the Billing Data unless and until Global Fitness satisfied several demands for significant compensation above and beyond what were provided in the Agreement.” In addition, Global Fitness alleged that:
Paramount and/or FRSI retained possession of Member Accounts Data, including the Billing Data, which was the property of Global Fitness and was only provided to Paramount pursuant to the terms of the Agreement.
Paramount and/or FRSI willfully interfered with Global Fitness’s property and refused to return Global Fitness’s property without cause or justification.
Paramount and/or FRSI’s actions deprived Global Fitness of the use of its Member Accounts Data and its monies and threatened its ability to comply with its obligations under the APA with L.A. Fitness.
As a result of the delay caused by Paramount and FRSI’s actions, the purchase price of the APA decreased dramatically.
Paramount and/or FRSI’s actions knowingly harmed Global Fitness’s rights under the APA with L.A. Fitness thereby causing Global Fitness irreparable harm and loss.
The defendants tendered defense of the action brought by Global Fitness to Travelers Property Casualty Company of America, which had issued a “CyberFirst” policy to them. Travelers filed an action for declaratory relief, and the defendants moved for partial summary judgment, seeking a determination that Travelers owed them a duty to defend.
(Photo: Shutterstock/RAGMA IMAGES)
The Travelers Policy
The policy provided that Travelers had “the right and duty” to defend the insured against any claim or “suit” seeking damages for loss to which the insurance provided under one or more of “your cyber liability forms” applies.
It also provided that Travelers had no duty to defend the insured against any claim or “suit” seeking damages for loss to which the insurance provided under “your cyber liability coverage forms” does not apply.
The “cyber liability coverage forms” under the policy included a “Technology Errors and Omissions Liability Form” that stated:
SECTION I—ERRORS AND OMISSIONS LIABILITY COVERAGE
1. Insuring Agreement
a. We will pay those sums that the insured must pay as “damages” because of loss to which this insurance applies. The amount we will pay for “damages” is limited as described in Section III Limits Of Insurance in your CyberFirst General Provisions Form.
b. This insurance applies to loss only if:
(1) The loss arises out of “your product” provided to others or “your work” provided or performed for others;
(2) The loss is caused by an “errors and omissions wrongful act” committed in the “coverage territory”;
(3) The “errors and omissions wrongful act” was not committed before the Errors and Omissions Retroactive Date shown in the CyberFirst Declarations or after the end of the policy period; and
(4) A claim or “suit” by a person or organization that seeks “damages” because of the loss is first made or brought against any insured….
The policy stated that “[e]rrors and omissions wrongful act” means any error, omission or negligent act.
(Photo: Shutterstock/chrisdorney)
No negligence alleged
The Utah federal district court denied the defendants’ motion and ruled that Travelers did not have a duty to defend.
In its decision, the court found that the Global Fitness action had not triggered Travelers’ duty to defend under the Technology Errors and Omissions Liability Form.
The court pointed out that although the policy covered errors, omissions, and negligent acts, Global’s claims against the defendants alleged “far different justifications for the data to be withheld.” The court observed that Global had not alleged that the defendants had withheld the data because of an error, omission, or negligence but, rather, that the defendants had “knowingly withheld this information and refused to turn it over until Global met certain demands.” In the court’s view, instead of alleging errors, omissions, or negligence, Global alleged knowledge, willfulness, and malice.
The court found that, to trigger Travelers’ duty to defend, there had to be allegations in the Global action that sounded “in negligence,” but that there were no such allegations.
Therefore, the court concluded, the insurer had “no duty to defend.”
The case is Travelers Property Cas. Co. of America v. Federal Recovery Services, Inc., No. 2:14–CV–170 TS (D. Utah May 11, 2015).
Originally published on FC&S Legal: The Insurance Coverage Law Information Center. FC&S Legal is
the industry’s ONLY single-source, comprehensive portal developed specifically for insurance coverage law professionals. To find out more, visit www.fcandslegal.com. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.
This article is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold with the understanding that the publisher is not engaged in rendering legal, accounting or other professional service. If legal advice is required, the services of a competent professional person should be sought.
http://www.propertycasualty360.com/