News & Insights  |  Newsletters

Authors

Practice Areas

Third Circuit Finds No CGL Coverage for Claims Challenging Retailer’s Collection of Customer ZIP Codes

October 2015
Privacy In Focus

The U.S. Court of Appeals for the Third Circuit, applying Pennsylvania law, has held that a series of Comprehensive General Liability (CGL) and umbrella policies did not afford coverage for three lawsuits against a retailer in connection with the retailer’s alleged practices in collecting ZIP codes at point of sale in credit card transactions and then using the data for promotional purposes. See OneBeacon Am. Ins. Co. v. Urban Outfitters, Inc., 2015 U.S. App. Lexis 16399, No. 14-2976 (3d Cir. Sept. 15, 2015).

Prior Proceedings

The policyholder, a clothing retailer, was sued in three underlying putative class action lawsuits alleging that it violated a number of state statutes and customers’ common law privacy rights in connection with the retailer’s practices at point of sale. After the policyholder sought coverage for those suits from two insurers that had issued it CGL and umbrella policies, one of the insurers filed a declaratory judgment action seeking a determination that it had no duty to defend or indemnify the policyholder in the three underlying suits. The policyholder, in turn, joined the second insurer as a third-party defendant.

The policies at issue afforded coverage for “personal and advertising injury,” which was defined to include an injury arising out of “oral or written publication [, in any manner,] of material that violates a person’s right of privacy.” The policies also contained identical exclusions for “‘personal and advertising injury’ arising directly or indirectly out of any action or omission that violates or is alleged to violate...[any] statute, ordinance or regulation...that addresses, prohibits or limits the...dissemination,...collecting, recording, sending, transmitting, communicating or distribution of material or information.” The district court ruled in favor of the insurers, holding that none of the suits were covered by the relevant policies.

A discussion of the district court ruling, as well as its implications, can be found here.

Third Circuit Decision

On appeal, the Third Circuit affirmed. Regarding the first lawsuit, the court ruled that coverage was not triggered because the suit did not allege a “publication.” In so ruling, the court noted that the lawsuit focused on allegations that the retailer requested and collected customer ZIP codes and then used those ZIP codes for its “own pecuniary benefit, including by engaging in direct marketing campaigns … by matching the customers’ names with their ZIP codes to identify the customers’ home/business address via commercially available databases.” The court ruled that there was no “publication” because there had been no “dissemination [of information] to the public at large” alleged in the underlying suit, and as a result, that coverage was not triggered in the first instance.

The court next ruled that the second lawsuit, which involved a single cause of action for violations of the Song-Beverly Credit Card Act of 1971 following the dismissal of various other claims, was not covered by the policies either. In so ruling, the court applied an exclusion barring coverage for “‘[p]ersonal and advertising injury’ arising directly or indirectly out of any action or omission that violates or is alleged to violate...[a]ny federal, state or local statute, ordinance or regulation...that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.” In holding that the exclusion squarely applied, the court rejected the policyholder’s argument that the same allegations supporting the Song-Beverly Credit Card Act count could also support common law claims.

Finally, the court ruled that a third lawsuit, which alleged that the defendants “engage[d] in a practice of ‘collecting ZIP codes at checkout at its...stores from customers who make purchases with Credit Cards, recording that information as part of the Credit Card transaction, and then using that information for its own marketing and promotional purposes, including to send unsolicited marketing and promotional materials, or ‘junk mail,’” did not trigger coverage. The court ruled that the “right to privacy” at issue in those allegations was the right to “seclusion” (protecting an interest to be free from unsolicited commercial contacts), whereas the “right to privacy” covered under the personal and advertising injury coverage section of the policies was the right to “secrecy” (an interest in keeping data secret). Here, because the allegations in the underlying complaint only implicated the right to seclusion (not an interest in keeping their ZIP codes secret), the court ruled that the complaint allegations did not trigger coverage under the policy.

The Decisional Trend

The Third Circuit’s Urban Outfitters ruling is consistent with a growing number of decisions that have declined to find general liability coverage for consumer claims concerning “privacy” and policyholder handling of data containing personally identifiable information. Thus, a number of courts specifically have recognized limits on the meaning of the CGL Coverage B offense of “publication” of material that violates a person’s right to privacy. See, e.g., Whole Enchilada, Inc. v. Travelers Prop. Cas. Co. of Am., 581 F. Supp. 2d 677, 697 (E.D. Pa. 2008); Creative Hospitality Ventures, Inc. v. U.S. Liab. Ins. Co., 444 Fed. App’x 370 (11th Cir. 2011). Further demonstrating that CGL policies will not broadly respond to privacy claims, in the first high court decision to address coverage under a CGL policy for data breach claims, the Connecticut Supreme Court recently held that the personal and advertising injury coverage section did not afford coverage. See Recall Total Info. Mgmt., Inc. v. Fed. Ins. Co., 115 A.3d 458 (Conn. 2015).

Urban Outfitters is an important ruling directly addressing whether CGL and umbrella insurance coverage may respond to a suit alleging improper gathering and use of ZIP code information. Wiley Rein LLP will continue to follow litigation over whether and to what extent insurance coverage responds to such suits.