Violation of Biometric Information Statute Claim Triggers Duty to Defend Under Liability Insurance Policy

A flurry of class-actions have been filed over the past few years in Illinois concerning the collection of biometric information, which is regulated under Illinois’ Biometric Information Privacy Act (“BIPA”). Indeed, a marked increase in BIPA lawsuits have followed a 2019 Illinois Supreme Court decision allowing suits to proceed without a showing of actual injury, as long there was a technical violation of BIPA. As a result, it was only a matter of time before Illinois courts weighed in on the insurance coverage implications of… Continue Reading

Ransomware Hits Hard During 2019

Highly visible ransomware attacks have occurred since the start of 2019. At their most basic, ransomware attacks involve the introduction of malware onto a victim’s computer or server, rendering it unusable. The fraudsters will then demand payment from the victim in order to restore the systems. In recent months, major cities such as Atlanta, Baltimore, and Johannesburg have fallen victim to ransomware attacks. The ransomware attack to Baltimore is especially revealing as its impacts continue to be felt. While the mayor rebuffed the criminals’ demand… Continue Reading

Biometric Class Action Against Facebook Greenlit by Ninth Circuit Court of Appeals

In an opinion article dated August 8, 2019, the Ninth Circuit Court affirmed the district court’s order certifying a class action of users who claim Facebook’s facial-recognition technology violates Illinois’s Biometric Information Privacy Act (BIPA). A copy of the Ninth Circuit’s opinion can be found here.  At issue is Facebook’s use of facial-recognition technology without first obtaining the consent of its users. The court agreed that the plaintiffs had sufficiently alleged a concrete and particularized harm sufficient to confer Article III standing. The court… Continue Reading

Equifax Agrees to Largest Ever Data Breach Settlement

In connection with the massive 2017 Equifax data breach which affected more than 147 million consumers, a global settlement has been reached to resolve a multi-district consumer action as well as a suit brought by the Federal Trade Commission. Equifax, one of the largest consumer reporting agencies, was allegedly aware of a critical security vulnerability in March 2017. However, it failed to address the issue until July 2017, when suspicious traffic was detected. Ultimately, on September 7, 2017, Equifax announced a data breach involving… Continue Reading

Yearly Cyber Report Reveals Large Increases in Cyberattacks and Costs

The third Hiscox Cyber Readiness Report, which was published in April 2019, highlights the increased cyber risks that businesses are facing. The report, which drew data from seven countries (Belgium, France, Germany, the Netherlands, Spain, the United Kingdom, and the United States), noted the marked rise in both the amount of attacks and the overall costs stemming from cyber losses. Turning first to the increase in cyberattacks, 61 percent of respondents reported a cyber incident, up from 45 percent last year across the seven… Continue Reading

San Francisco Legislation Would Ban the City’s Use of Facial Recognition Technology

Over the last few years, there has been a marked increase in legislation regulating the collection and retention of individuals’ biometric information.  For instance, Illinois, Texas, and Washington have enacted legislation regarding the collection of biometric information, and the European Union’s General Data Protection Regulation broadly regulates the collection of biometric data.  In San Francisco, one motivated municipal lawmaker with similar concerns relating to privacy and the disproportionate impact surveillance has had on certain communities proposed a bill that would regulate how the city uses… Continue Reading

An International Vow to Address Cybersecurity

On Monday, November 12, 2018 , during the Internet Governance Forum at UNESCO’s headquarters in Paris, the French President Emmanuel Macron announced an international agreement referred to as the “Paris Call for Trust and Security in Cyberspace.” The agreement was signed by over 50 countries as well as businesses, including Facebook, Google, and Microsoft, and other organizations. Australia, the United States, Israel, Russia, and China are notably absent. The agreement first highlights what is the future of AI, the central role cyberspace plays in… Continue Reading

GAO Report on Cybersecurity Provides Useful Strategies for Federal Agencies and Private Industry

The Government Accountability Office (GAO) recently published another report in its High-Risk Series detailing the major cybersecurity challenges facing the federal government and outlines key strategic elements to address those challenges. While the report focuses on issues pertaining to federal agencies, several of the observations, and recommendations are also applicable to private businesses. To start, the report details five key elements that are needed to make progress in addressing cyber threats: 1) Leadership Commitment; 2) Capacity; 3) Action Plan; 4) Monitoring; and 5) Demonstrated Progress.… Continue Reading

Sixth Circuit Uses Every Tool in the Box To Build Case for Coverage for Defrauded Policyholder

July 12, 2018, we reported on the Medidata decision handed down by the Second Circuit in which the court found coverage for a claim resulting from social engineering fraud. We suggested the ruling in Medidata lacks persuasive power due to its unusual factual circumstances and atypical policy language. The Sixth Circuit’s decision in American Tooling Center, Inc. v. Travelers Casualty & Surety Co. of America, No. 17-2014, 2018 WL 3404708 (6th Cir. July 13, 2018), will have more persuasive power, but due to… Continue Reading

Second Circuit’s Decision Upholding Social Engineering Fraud Coverage Likely a Paper Tiger

In a case closely monitored by the insurance industry, the Second Circuit upheld in a non-precedential summary order a New York federal district court’s summary judgment finding coverage under the computer fraud coverage of a commercial crime policy. Medidata Solutions, Inc. v. Fed. Ins. Co., No. 17-2492, 2018 WL 3339245 (2d Cir. 2018). Although the policyholders are apt to tout the decision as a seismic victory, the atypical policy language and factual circumstances should greatly limit its persuasive value. As background, the insured, Medidata… Continue Reading