Seventh Circuit: No “Publication” in Unlawful Recording of Telephone Calls
The U.S. Court of Appeals for the Seventh Circuit, applying Indiana law, has held that an underlying lawsuit alleging that a policyholder secretly recorded phone calls during which customers provided sensitive personal information did not trigger coverage under the personal and advertising injury coverage section of a Comprehensive General Liability (CGL) policy because the recording of information did not constitute “publication.” See Defender Sec. Co. v. First Mercury Ins. Co., 2015 U.S. App. Lexis 17116; No. 14-1805 (7th Cir. Sept. 29, 2015).
The policyholder, a seller of home security systems, was sued in a putative class action alleging that it recorded phone calls from customers without first notifying them and/or obtaining their permission. The named plaintiff also alleged, among other things, that she provided personal information, such as her full name, address, date of birth, and social security number, during the phone call. The lawsuit alleged that the policyholder’s conduct violated California Penal Code § 632, which prohibits the recording of confidential telephone communications without the consent of all parties, and § 632.7, which does the same for communications made from a cellular or cordless phone.
The policyholder tendered the suit under its CGL policy, which afforded “personal and advertising injury” coverage for injuries “arising out of...[o]ral or written publication of material that violates a person’s right of privacy.” The insurer refused to defend, however, and the policyholder subsequently brought suit alleging breach of contract and bad faith. The district court granted the insurer’s motion to dismiss, holding that the lawsuit did not trigger coverage in the first instance, because the complaint did not allege facts showing that the injury arose from a “publication.” The policyholder appealed.
On appeal, the Seventh Circuit affirmed the decision in favor of the insurer. In so doing, the court, applying Indiana Law, ruled that the plain meaning of the term “publication,” as used in the policy, was not so broad as to encompass the mere unlawful recording of information. The court reasoned that because there was no allegation that the information conveyed to and recorded by the policyholder was ever accessed by or shared with a third party, it was not “published,” and thus could not trigger coverage.
Limits of Coverage
The Seventh Circuit’s decision in Defender Security is an important reaffirmation of the limits of personal and advertising injury coverage under CGL policies. It illustrates that that coverage is limited to certain enumerated torts, and that claims involving the internal misuse of customer data—short of sharing that information with third parties—will not trigger coverage.
Indeed, in September alone, two federal appellate courts and one federal district court ruled that “personal and advertising injury” coverage was not triggered by internal misuse of confidential data. In addition to Defender Security, see the stories in this issue on OneBeacon Am. Ins. Co. v. Urban Outfitters, Inc., No. 14-2976 (3d Cir. Sept. 15, 2015) (collection and misuse of ZIP code information did not trigger coverage because there was no publication); and Am. Econ. Ins. Co. v. Aspen Way Enters., Inc., No. 1:14-00009-SPW (D. Mont. Sept. 25, 2015) (collecting and retaining customers’ private data in violation of the Washington Consumer Protection Act and the Washington Computer Spyware Act did not trigger coverage because there was no publication). These rulings join other state and federal decisions similarly recognizing the limits of such coverage. See, e.g., Recall Total Info. Mgmt., Inc. v. Fed. Ins. Co., 115 A.3d 458 (Conn. 2015) (no “publication” where there was no proof that a third party accessed confidential information on data tapes); Creative Hospitality Ventures, Inc. v. U.S. Liab. Ins. Co., 444 Fed. App’x 370, 375-76 (11th Cir. 2011) (the phrase “publication, in any manner” was unambiguous and did not apply when there was no dissemination of information to the public); Ticknor v. Rouse’s Enters., LLC, 2 F. Supp. 3d 882, 896 (E.D. La. 2014) (in order for “publication” to occur, the material must be “made generally known, announced publicly, disseminated to the public, or released for distribution”).