Cyber Ruling Illustrates Risks Of Overlapping Coverages

A decision by the U.S. District Court for the District of Minnesota, applying Minnesota law, highlights complications that can arise when a single claim triggers multiple coverages under the same policy.

In Illinois Casualty Co. v. Kladek Inc., the court held on July 23 that the insurer had a duty to defend a lawsuit alleging personal and advertising injury under both the cyber protection coverage and the general liability coverage of the insurer's businessowners policy.

Background

Several models sued the insured, a gentleman's club, alleging that their images were used in advertisements on the insured's social media accounts without their consent. The insured sought coverage for the suit under two sections of its businessowners policy: the cyber protection coverage and the general liability coverage. The insurer denied coverage under both insuring agreements.

The endorsement through which cyber coverage was added to the policy expressly required arbitration of any coverage dispute thereunder. The arbitration panel tasked with assessing potential coverage under the cyber endorsement determined that the insurer had a duty to defend under the cyber protection coverage endorsement. The arbitration panel also concluded that it did not have authority to weigh in on coverage under the general liability coverage of the policy.

The question before the federal district court was whether the insurer also had a duty to defend under the general liability coverage.

The insurer relied on three exclusions within the general liability coverage of the policy:

• The "Law Exclusion," which barred coverage for liability arising out of any action alleged to violate "[a]ny federal, state, county, municipal or local consumer fraud protection law, regulation, ordinance, order, or directive barring fraud, unfair competition, and/ or deceptive business practices";
• The "Electronic Chatroom Exclusion," which barred coverage for claims "[a]rising out of any electronic chat room, bulletin board, or blog the insured hosts, owns, or ... control[s]"; and
• The "Multimedia Exclusion," which precluded coverage for "multimedia perils" unless covered by the cyber endorsement.

First, the court held that the law exclusion did not apply to the Lanham Act and Minnesota Deceptive Trade Practices Act claims insofar as those claims did not implicate fraudulent conduct directed at consumers. The court reasoned that the claims were commercial and involved advertising injury rather than consumer fraud, so it held that the exclusion did not bar coverage.

Second, the court rejected the insurer's reliance on the electronic chatroom exclusion, finding that Facebook, Instagram and Twitter (now X) are not "chatrooms" or "bulletin boards" as those terms are commonly understood, nor did the insured host or control those platforms.

Finally, the court held that the multimedia exclusion — which precluded coverage for multimedia perils if such perils were covered by the cyber protection coverage endorsement — was not a bar to coverage under the general liability coverage.

On this point, the insurer had asserted that the underlying suit alleged a "multimedia peril," defined to include the display of electronic media on the insured's website resulting in misappropriation of likeness, and it also observed that the arbitration panel had found coverage for the peril under the cyber endorsement.

The court disagreed that the multimedia exclusion applied for two reasons.

First, the court noted that the arbitration panel only had determined that the insurer had a duty to defend under the cyber endorsement; the panel had not determined whether the insurer had a duty to indemnify under the cyber endorsement. This meant that the panel left open the possibility that the case could be decided on grounds other than the claims that triggered the cyber endorsement, and such a judgment would therefore not be covered under the cyber endorsement.

Relatedly, because the arbitration necessarily was limited to the assessment of potential coverage under the cyber endorsement, the court inferred that the parties "presumably acknowledged that there were claims that fell outside the Cyber Endorsement."

Second, the court held that the cyber endorsement was ambiguous, including because it was "unclear with respect to its relationship with the main liability policy" and, unlike the main occurrence-based liability form, provided coverage on a claims-made basis. Because it was, in the court's view, unclear whether the cyber endorsement afforded stand-alone coverage or modified the businessowners liability coverage, the court concluded that the ambiguities must be construed against the insurer and the multimedia exclusion did not apply.

Analysis

This case illustrates some of the complications that may arise if a policy contains multiple coverages and does not explicitly indicate whether one insuring agreement is mutually exclusive with another.

Here, the court effectively ruled that the insurer had a duty to defend under both coverages, even though the general liability coverage had many distinctions from the cyber coverage:

• The main policy form provided coverage on an occurrence-based basis, whereas the cyber coverage provided claims-made coverage;
• The cyber coverage limited disputes to arbitration, whereas the general liability coverage did not;
• And the multimedia exclusion in the general liability coverage was worded to exclude at least some claims that otherwise could receive coverage from the cyber coverage endorsement.

The court acknowledged the many distinctions as at least suggesting that the cyber coverage was meant to provide stand-alone coverage. Notably, however, the court ultimately concluded that the policy wording left some uncertainty as to the intended relationship between the cyber endorsement and the main form of the policy, predictably holding then that any ambiguity needed to be resolved in favor of coverage.

The court's determination in this regard was particularly significant to the coverage outcome here because the cyber coverage endorsement had a lower limit than the general liability coverage in the policy. Thus, had the court held that the multimedia exclusion applied, the insurer would have been able to significantly limit its overall exposure.

This case also exposes a challenge associated with a policy imposing different dispute resolution mechanisms or forums on different coverages within the same policy. Here, the dispute over cyber coverage was subject to a mandatory arbitration provision, whereas disputes pertaining to all other coverages under the policy were not.

That the cyber coverage endorsement was the coverage subject to mandatory arbitration is not particularly surprising, as it's where cyber insurers and policyholders alike may favor the confidentiality that arbitration affords in matters often involving sensitive issues, i.e., private or proprietary information, and an insurance product still very much developing to address them. However, had the entire dispute been decided within the same forum, the result may have been different.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.