Cyber-Coverage: Clarity Or Confusion?

As the number of data breaches and disclosure of personally identifiable information ("PII") increases, courts are being asked to decide whether such claims for data breach and disclosure of PII are covered by traditional commercial general liability (CGL) policies. Most often, companies who have only traditional CGL policies, argue that such claims should fall under their policies' coverage for "personal and advertising injury," which is typically defined as injuries arising out of the oral or written publication of material that violates a person's right of privacy.

Sony made this same argument in the recent case of Zurich American Insurance v. Sony Corporation of America. Sony argued that coverage for a consumer class action filed against Sony for a 2011 data breach of Sony's Playstation network should fall under its CGL policy's coverage for "personal and advertising injury" which included the typical definition.