RECALL TOTAL INFORMATION MANAGEMENT, INC., et al. v.
FEDERAL INSURANCE COMPANY et al., SC 19291
Judicial District of Hartford
Insurance; Whether Insurers Breached Duty to Defend; Whether Loss of Employees’ Personal Data Covered by Policy’s Personal Injury Provision. Plaintiff Recall Total Information Management, Inc. (Recall), entered into an agreement with IBM to transport and store IBM’s electronic media. Recall subcontracted with plaintiff Executive Logistics, Inc. (Ex Log), for the required transportation services. Ex Log purchased insurance policies from the defendants in which Recall was named as an additional insured. The primary policy provided coverage for any damages that the insured became obligated to pay for “personal injury,” defined as “injury, other than bodily injury, property damage or advertising injury, caused by an offense of . . . electronic, oral, written or other publication of material that . . . violates a person’s right to privacy.” (Emphasis added.) The policy also provided that the insurer had the duty to defend the insured against a “suit” or “other dispute resolution proceeding.” During transport, IBM’s computer tapes fell out of the back of a van and approximately 130 tapes were taken from the roadside by an unknown person and never recovered. The lost tapes contained employment-related data for 500,000 past and present IBM employees, including social security numbers, birthdates and contact information. IBM took steps to protect the affected employees against identity theft and demanded reimbursement from Recall for over $6 million in expenses it incurred for the mitigation measures. The defendants denied the plaintiffs’ claim for coverage and, after reaching a settlement with IBM, the plaintiffs brought this action alleging breach of the insurance contract. The trial court granted summary judgment for the defendants, concluding that the plaintiffs’ losses were not covered under the personal injury provision. The plaintiffs appealed, claiming that the defendants had breached their duty to defend by not providing a defense during the settlement negotiations and therefore that they were liable for the full amount of the settlement with IBM. They maintained that settlement negotiations constituted a “suit” or “other dispute resolution proceeding” under the policy. The Appellate Court (147 Conn. App. 450) disagreed and affirmed the judgment for the insurers, concluding that there was no breach of the duty to defend because the terms “suit” or “other dispute resolution proceeding” could not be construed to encompass settlement negotiations. The court also rejected the plaintiffs’ claim that the policy’s personal injury provision covered the cost of notifying the affected employees following the loss of the tapes because the information on the tapes had been published to the “thief’ who took them from the roadside. The court rejected that claim as entirely based on speculation, noting that, as there was no evidence that the information on the tapes had ever actually been accessed by anyone, there had been no publication. Finally, the Appellate Court rejected the plaintiffs’ claim that, because New York and Connecticut statutes required IBM to notify affected employees of the data loss, the triggering of those statutes constituted a presumptive invasion of privacy and personal injury. The plaintiffs appeal, and the Supreme Court will determine whether the Appellate Court properly affirmed the judgment in favor of the defendants.