Groundwater Contamination and Vapor Intrusion Cases

The seminar, which will be put on by Law Seminars International, will take place at the Sheraton Newark Airport Hotel on September 15 and 16.

For more information and to register go to: http://www.lawseminars.com/seminars/11GWATNJ.php

The speakers include noted attorneys, remediation consultants and and other noted experts in the field. The seminar is co-chaired by Ira Gottlieb of McCarter & English. Steven and Ira will also be speaking on insurance coverage issues relating to groundwater claims.

Once a jury trial is demanded in a pleading in New Jersey, both parties must consent to waive the jury demand unless there is no right to a jury for the claims. It is interesting to note that only the plaintiff demanded a jury trial in the pleadings of this case, but that it was NJM that insisted on the jury trial. NJM’s position was joined by the amici curiae Insurance Council of New Jersey, and the Property Casualty Insurers Association of America.  Whether the decision to assert the jury right was a strategic maneuver to avoid an adverse decision and keep the matter open for further negotiation, or was truly an assertion of a substantive right, the decision reveals the importance of assessing whether a jury demand should be included in the initial complaint or answer as the demand may be a significant factor in the overall handling and final trial of a case.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( www.dbnjlaw.com ) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of clients in insurance coverage. For additional information about the matters in this bulletin or in the firm’s insurance practice, please contact Steven A. Kunzman, Esq. who heads our Insurance Coverage Department.

truback@newjerseylaw.net

May 23, 2011

On April 13, 2011 India issued final regulations that implement parts of the Information Technology Act of 2008.  The new regulations will have a significant impact on US companies that outsource to India, because they seemingly apply to outsourcing providers.  Since many insurance policies require the insured to comply with all data protection laws, it is prudent for risk management executives and the insured to assess whether the insured’s India-based outsourcing partners are in compliance with the new privacy regulations.  The assessment should be both technical and functional to determine whether the outsourcing partners are meeting the new obligations imposed upon them by the regulations.  If they are not, then the US based companies could be in violation, by extension of their outsourcing partners, of the India privacy regulations and subject to liability.  Further, US financial services companies could be in violation of the Gramm-Leach-Bliley Act, which under certain circumstances could be a breach of their insurance policies.

The India privacy rules are unique in three ways:

1. They apply to individuals who provide their personal information even if they are outside of India.
2. All personal information must be protected according to ISO 27001standards.
3. Prior written consent must be obtained for the collection of sensitive personal information, which includes financial information.

For Personal Information:

Notice- Notice must be given to individuals when their personal information is being collected.  Notice includes disclosing the purpose of the collection of the information, the use of the information, the intended recipients of the information, the name and address of the organization collecting the information, and the name of the organization that will retain the information.  

Privacy Policy-Organizations covered by the new privacy rules must establish and make a privacy policy readily and easily available. 

Right to Access- Organizations must give the individuals the right to access and correct their personal information.

Security- Organizations must secure information according to accepted and approved technical standards, specifically ISO 27001. 

Dispute Resolution- Organizations must also establish and maintain a dispute resolution process.

For Sensitive Personal Information:

There are additional layers of obligations when sensitive personal information is going to be collected.  Sensitive personal information is broadly defined, but it includes passwords, financial information about a bank account, or a credit/debit card, or other payment instruments, physical or mental health conditions, medical records, sexual orientation or biometric information.  When an organization is collecting sensitive personal information, then prior written consent (email, fax or letter) must first be obtained.  The individual always has the right to refuse to provide the sensitive personal information and to withdraw any prior consent.  The organization cannot refuse to provide the service if the sensitive personal information is not provided. Before a person’s sensitive personal information can be disclosed to a third party, the individual must also give prior written consent to the disclosure, unless it is allowed by contract or is required for legal compliance.  And the transfer of sensitive personal information to any other organization, if outside of India, is only allowed if that country has a privacy law that ensures the same level of data protection as India or if it is necessary to perform the function for which the information is collected.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC (www.dbnjlaw.com ) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of clients in technology and privacy matters. We have affiliated offices in New York, Philadelphia, London, and Boca Raton.  For additional information about the matters in this bulletin or in the firm’s insurance practice, please contact Todd. R. Ruback, Esq., CIPP, CIPP/IT, who heads the Privacy and Technology Law Department, at truback@newjerseylaw.net or at 908-757-7800 x196.

In analyzing the plaintiffs’ claims of collective liability, the court first considered whether the law of New Jersey or the law of New York applied as evidence indicated that the OPV was administered in New York; however, the plaintiffs have resided in New Jersey for over 35 years. The Court reviewed the various theories of collective liability and concluded that under the laws of both states, they could not be applied in this case.  The court distinguished a New York decision applying market-share liability to the manufacturers of another drug, DES, because the injury did not result from the defective design of the drug, as with DES, but was due to the failure of a manufacturer to comply with federal regulations relevant to screening and neutralization of SV40 and “and produced a defective or deviant vaccine.” The Appellate Court, therefore, concluded that the failure of a single manufacturer to comply with proper manufacturing processes and procedures did not warrant imposition of liability on all the manufacturers of the same product.

This decision continues to reinforce the requirement of proper product identification, and the need for the plaintiff to prove causation-in-fact, and further reviews the limited grounds where a court will shift the burden to defendants to distinguish their product or actions from that of other defendants.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( www.dbnjlaw.com ) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of clients in environmental and defense of toxic exposure matters. For additional information about the matters in this bulletin or in the firm’s environmental practice, please contact Steven A. Kunzman, Esq. who heads our Environmental and Latent Injury Litigation Department.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( www.dbnjlaw.com ) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of clients in insurance coverage matters as well as technology and privacy matters. For additional information about the matters in this bulletin or in the firm’s insurance practice, please contact Steven A. Kunzman, Esq. who heads our Insurance Coverage Department; for additional information about the firm’s technology and privacy practice, please contact Todd. R. Ruback, Esq. who heads our Technology and Privacy Law Department

Steven A. Kunzman, Esq.

And

Todd B. Ruback, Esq., CIPP

Privacy Overview

 The pervasive use of the Internet as a business platform and for the collection, use and transmission of personal information presents fertile ground for the growth in claims arising from data breaches and improper privacy practices. As these claims arise, they will undoubtedly be tendered to insurers for defense and indemnification under various commercial policy forms, including those recently developed to provide coverage for privacy claims.[1] Insurance companies must be cognizant of the changing winds on the privacy landscape.  Due to increasing regulatory compliance requirements and a spike in privacy related litigation flowing from record setting data breaches, organizations and insurance carriers will undoubtedly be faced with privacy as a significant risk component to business.  According to Verizon Business’s 2009 Data Breach Investigation Report, 2008 saw more reported data breaches than the previous four years combined, with 285 million records breached. [2]  The Poneman Institute estimated in its 2009 Annual Study that the average cost for a data breach exceeded $200 per record for organizations that were first time victims of a data breach.[3]  Numerous class action suits for privacy violations have been filed, the most famous of which is against Heartland Payment Systems, for a massive breach caused by external hackers.[4]  Additionally, the FTC and Attorneys General of states across the country appear to be stepping up enforcement actions against companies for improper privacy practices.

 The likelihood of an organization facing a privacy-related claim for liability or a regulatory enforcement action for improper privacy practices has increased significantly.  Concordantly, claims for coverage under insurance polices will increase significantly over the coming years. Although the present anticipated harm to any individual does not appear to be significant, these claims will have an impact on an insurer by increasing costs for claims processing, investigation, incident response management, complying with statutorily required breach notification processes, litigation defense and payment of claims, particularly the costs for any class action claims.

Privacy Litigation and its Impact Upon the Insurance Carrier

 Some background in privacy issues is helpful to put these potential claims into an understandable context. There are two components to privacy:  data protection and privacy practices.  Both components are governed in large part by either regulation or statute, and in some cases by common law. 

 Data Protection:            Data Protection encompasses the security of data that contains personal information.  There are generally three elements to security: technical, physical and administrative.  Industries such as financial services and healthcare have security standards as respectively enumerated in the Gramm-Leach-Bliley Act (GLBA) and Health Insurance Portability and Accountability Act (HIPAA).  Further, the payment card industry has created its own technically objective security standard, PCI-DSS, which applies to many organizations that accept payment cards.

 A security breach may take many forms, some of which include the unauthorized access to personal information by   an external source such as a hacker or an outsourced service provider, the unauthorized access to personal information by an internal source such as an employee or contractor, or something as simple as the theft of a company laptop that contains personal information 

Private party lawsuits against companies for failing to protect data due to deviation from certain standards are based upon a negligence theory.  To date plaintiffs have had difficulty prevailing on negligence claims, although there have been numerous and significant settlements.[5]  The challenge plaintiffs have faced is in proving actual damages that were proximately caused by the defendant’s failure to protect personal information.6  Some courts, however, are beginning to view data breach litigation in a similar light to toxic tort medical monitoring claims in that the threat of future harm may be sufficient to sustain a claim.7  If this “future risks” approach to data protection litigation gains traction, then insurance companies can look forward to more protracted and costly litigation, with the potential for significant jury awards under the class action umbrella.

 Privacy Practices:            Privacy practices that may be subject to claims include: improper collection, use, or transfer of personal information; the improper collection of information using unauthorized cookies, spiders, spy ware, or other technological means; failure to protect personal information according to a company’s posted online privacy statement; having a privacy statement that does not meet regulatory requirements8 spamming, improper faxing or telemarketing, and the commission of privacy torts such as the invasion of privacy.  For companies that transact online business in not only the United States, but also the European Union (EU) where the laws on privacy practices are greatly different, compliance become complex and risk of an improper privacy practice rises greatly.

 Companies committing improper privacy practices are often subject to multiple layers of penalties or fines not only in the EU but also in the United States.  For example, if a company fails to protect personal information according to its posted online privacy statement, it may be subject to an investigation and penalties from both the Federal Trade Commission (FTC) and state authorities for unfair/deceptive online trade practices,9 in addition to the potential private claims for violations of state consumer protection laws.  In essence, a company may pay three times for the same transgression in the US.  Although insurance policies generally exclude coverage for regulatory or enforcement actions by governmental bodies, the exposure is presented in private litigation, which may require aggressive defense of the regulatory claim.  It appears, however, that some of the new privacy insurance policies may offer coverage for regulatory matters. 

 Insurance Coverage:  Coverage Part B of a typical Comprehensive General Liability  (CGL) insurance policy generally includes coverage for damages cause by “personal injury” and “advertising injury.” Although those representing the insured often consider this section of the insurance policy to provide an expansive grant of coverage, this coverage is usually considered by the insurer to be limited to a number of specified claims such as personal injury, which is often defined in a CGL policy as “an injury arising out of…violation of an individual’s right of privacy.”  Part B of the policy states that the insurance applies to personal injury if “caused by an offense…[a]rising out of the conduct of your business, excluding advertising, publishing, broadcasting or telecasting done by or for you.” These policy forms were surely designed without any contemplation of the current risks since they have only come into existence with the pervasive use of computers and the Internet to transact business. In addition, there may be issues as to when the “injury” has taken place; at the time of the breach or the time when the personal injury is actually sustained.  In order to be able to properly evaluate and assume the risks some insurers have, therefore, developed policies to specifically address the risks presented. Undoubtedly if claims continue to rise and develop as anticipated, insurers may dispute coverage and/or respond to the claims being asserted based upon polices that, at the time of issuance, did not envision the present risk of injury caused by data breach.  Management of the risk therefore requires a thorough understanding of the nuances of the laws and requirements of   best of breed privacy practices

 Conclusion

The changing privacy landscape will have a tangible impact on an insurance carrier’s costs of responding to claims under the personal injury and advertising portions of the CGL policies and under specifically designed policies.  Foresight in addressing these

risks and an understanding of the landscape of privacy laws and issues will be an

essential component to underwriting the risks and defending the claims.

 End Notes

[1] Zurich North America Commercial Expands Security, Privacy Insurance Coverage, http://www.darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=218400572

2 Verizon Business 2009 Data Breach Investigations Report, By Wade Baker, April 15, 2009

3 Poneman Institute’s Fourth Annual US Cost of Data Breach Study, By Dr. Larry Poneman, January 2009

4 In Re: Heartland Payment Systems, Inc. (626 F. Supp 2d 1336; 2009 U.S. Dist. LEXIS 81493) (Order 

  granting consolidation of class action lawsuits.)

5 See, In re TJX Cos. Retail Sec. Breach Litig., 246 F.R.D. 389; 2007 U.S. Dist. LEXIS 87920 (over $40M settlement) and Department of Veterans Affairs Data Theft Litigation, No. 06-0506 (D.D.C. January 27, 2009) ($20M settlement)

6 See, Forbes v. Wells Fargo Bank, N.A., 420 F. Supp2d 1018, 1021 (D.Minn.2006); Giordano v. Wachovia Sec., LLC., 2006 2177036 (D.N.J. July 31, 2006) (unpublished); Guin v. Brazos Higher Educ. Serv. Corp., Inc. 2006 WL 288483 (D. Minn.) Feb 7, 2006 (unpublished); Hendricks v. DSW Shoe Warehouse, 444 F. Supp. 2d 775, 783 (W.D. Mich. 2006)

7 See, Pisciotta v. Old Nat. Bancorp, 499 F.3^rd 629 (7^th Cir. Aug. 21, 2007)

8 See, GLBA

9 See, Pinero v. Jackson Hewitt Tax Services, No. 08-3535 (E.D. La. Jan 7, 2009)

 Todd B. Ruback, Esq. is chair of the Privacy and Technology Practice at the law firm of DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, P.C.  He is also a Certified Information Privacy Professional (CIPP) and thought leader in the area of privacy law.  He has authored or co-authored numerous publications on privacy and is also a lecturer at various privacy seminars and conferences.  He is a present nominee to be on the Board of Directors of the International Association of Privacy Professionals (IAPP) for the upcoming term of 2010-2015 and will be a speaker at the IAPP International Privacy Convention to be held in Washington, D.C. in April 2010, where he will lecture on trends and risk in privacy litigation. 

 Steven Kunzman, Esq. is the chair of the Insurance Coverage Practice of the law firm of DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, P.C.  He has been providing counsel and representation to insurance companies on insurance coverage matters and defense to insurance company clients for over 25 years.  

The Court also addressed the exclusion for loss due to vandalism where the property is vacant for more than 90 days. The court considered vandalism as being undefined as a question of fact. The Court therefore considered the experts for the parties as to the cause of the fire. The insured’s expert considered the cause to be “undetermined” because the state of the building did not permit a determination. The insurer’s expert did, however, conduct building inspections both inside and outside and interviewed witnesses, which supported the opinion that the fire was set, a result of vandalism. Since the report of the insured’s expert did not advance a determination based upon facts, it did not create a genuine issue of material fact precluding summary judgment in favor of the insurer.

The Court addressed whether there was any value to the loss, since the building could not be used for any discernable purpose, thus the building was a liability (the cost of removal) and the value was solely based on vacant land. The insured focused on the policy as an Agreed Value Policy. The Court concluded, however, that the language of the policy made agreed value an upper limit rather than a liquidated damage. Since this was no longer a needed determination, the Court did not address the issue further.

Although the Court was able to dispose of the case based upon the vacancy and vandalism issues, it also reviewed a number of other issues. One issue was whether the failure to have a sprinkler system, contrary to representations in the policy application, constituted an increased of hazard. Since there was no such system in place, there was no change in the use.  The Court considered this to be a different from Dynasty v. Princeton Ins. Co. 165 N.J. 9 (2000) in which the sprinkler system existed, but had been disabled;  justifying a determination of an “increase-in-hazard.” The Court here noted that the issue was not one of increased hazard but a claim for rescission due to a misrepresentation in the policy. On this issue, the Court questioned whether the misrepresentation was made by the insured or the broker. The Court stated that there was a question of fact as to whether the statements could be attributed to the insured. Since, however, there were other grounds to find no coverage there was no need to remand the case for a further determination of facts. Of course this is an important issue to be kept in mind in a case dealing with alleged misrepresentations in the policy; who made the statements and are the statements of the broker attributable to the entity actually applying for the coverage.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( www.dbnjlaw.com) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of insurance companies in coverage matters. For additional information about the matters in this bulletin or in the firm’s Insurance Coverage Practice, please contact Steven A. Kunzman, Esq. 

       After the trial and award of coverage, plaintiffs filed a motion to be able to assert a claim against NJUIA for breach of the covenant of good faith and fair dealing. In affirming the denial of the motion, the Court restated the reasoning of  Picket v. Lloyds, 131 N.J. 457, 67 (1993) that a finding of bad faith requires there to be no “fairly debatable” reason for denial  of a claim or where there is an unreasonable delay in processing a claim. Since the decision of NJUIA to deny the claim was “fairly debatable” there was no basis for a claim of bad faith to be sustained; therefore the denial of the motion was affirmed.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( www.dbnjlaw.com ) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of insurance companies in coverage matters. For additional information about the matters in this bulletin or in the firm’s Insurance Coverage Practice, please contact Steven A. Kunzman, Esq. 

The trial court found that the evidence was undisputed that the “repairs to the other floors would not have been required if the seventh floor wall had not collapsed and also that the angle irons were required [to be installed on all floors] as a consequence of the December 2003 partial collapse.” Although the parties agreed that the repair of the seventh floor required GNY to pay to reconstruct that floor in accordance with the current code, they disagreed as to coverage for repairs to the separate, undamaged portions of the building.

After reviewing case law from other jurisdictions, and restating that coverage sections of an insurance policy are to be liberally construed in favor of coverage; that exclusions are to be narrowly construed, and that ambiguities are to be construed against the insurer, the court concluded that since there was a causal connection between the collapse of the seventh floor wall and the requirement to bring the other floors in compliance with the existing building code, there is coverage for the corrective work. The court specifically stated that the decision was limited to the facts of the case, and that it may be different if the code problems were unrelated to the collapse of the wall. Since, however, the work to install angle irons to the remainder of the building was directly related to the cause of the initial collapse, involving the same structural part of the building and the same building code provisions. The court also stated that while the policy specifically excluded pre-existing code violations, the policy did not specifically exclude situations where a covered structure is grandfathered under the code but lost that status due to the occurrence. The court concluded that if the insurer had intended to exclude coverage in these situations, it could have written the policy to specifically exclude the coverage.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( www.dbnjlaw.com ) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of insurance companies in coverage matters. For additional information about the matters in this bulletin or in the firm’s Insurance Coverage Practice, please contact Steven A. Kunzman, Esq.