Connecticut Supreme Court Makes Significant Ruling in Data Breach Case

The Connecticut Supreme Court made a very significant ruling yesterday in Recall Total Information Management, Inc. v. Federal Insurance Co., adopting wholesale the Appellate Court’s well-reasoned ruling that an insured’s loss of sensitive records, without more, does not constitute a “publication” of material that violates a person’s right of privacy. Notably, the Appellate Court held that absent proof of an unauthorized third party’s access to the personal identification information, the “publication” element of the Privacy Offense (under the definition of “personal and advertising injury” in a standard CGL policy) is not satisfied. This ruling is a boon to insurers and provides further evidence that CGL policies are not a viable option for data breach coverage. This is especially true in light of the new ISO data breach exclusion entitled “Exclusion – Access or Disclosure of Confidential or Personal Information and Data Related Liability – With Limited Bodily Injury Exception” (CG 21 06 05 14).

Click here to view the brief opinion.