June 2010

By the end of 2009, 45 states, the District of Columbia, and two U.S. territories had enacted laws requiring notification of security breaches involving personal information. New York’s law is typical. It requires businesses that own or license computer data that includes private information to disclose any security breach of the system to any state resident whose private information the business believes was accessed without authorization. The businesses must provide the notice by mail, phone or e-mail as soon as possible after discovering the breach, inform the state government of the notices, and inform consumer reporting agencies if the breach affected more than 5,000 residents.

Notifying the victims is only one part of the costs businesses that suffer security breaches can expect. They might face lawsuits from the victims, fines from regulators, and serious harm to their reputations. Lockton International has estimated the cost of a security breach to be $15 per person affected. Lockton issued a paper in 2010 that discussed several ways that businesses can avoid cyber attacks and handle those that do occur, including:

• Assemble a multifunctional team to identify cyber risks and develop plans for preventing attacks. The team should include individuals responsible for legal compliance, risk management or insurance, information technology, procurement of vendors, and operations.
• Comply with applicable federal and state laws and regulations, including HIPAA (which applies to security of private health information) and the Gramm-Leach-Bliley Act (which applies to private financial information.)
• Manage vendors that have a high risk of data security breaches, including payroll companies, credit card processors, and accountants. Require them to meet legal and industry standards, obtain insurance against security breaches, and indemnify the business from related losses.
• Manage the people as well as the system. Train and educate employees on system security, monitor them for poor security practices and possible malicious acts, and verify that they have not installed unauthorized software that would increase vulnerabilities in the system.
• Regularly test the system and repair security problems. Perform internal tests, external system penetration tests, scans for viruses and other malware, and evaluate work processes.
• Encrypt private data on the network, while it is being e-mailed or transferred another way, and while it is on laptops, smart phones, and other mobile devices.
• The team should develop a plan for effectively responding to security breaches.

As more businesses become aware of their exposure to data losses, insurance companies are beginning to offer specialized policies to cover these incidents. An electronic data liability policy covers a business’s liability for damages resulting from accidents, negligent acts, errors or omissions, or a series of these, leading to a loss of electronic data. Coverage applies to claims made during the policy period for losses occurring on or after a date specified in the policy. Another policy offered by specialty insurers covers a business’s lost income and extra expenses resulting from harm to its reputation after a security breach.

Most businesses and organizations today have some exposure to loss from cyber risks. Just as they try to prevent fires, car accidents, and workplace injuries, businesses must make preventing data security breaches a standard part of their operations. Speak with our professional insurance agents about the insurance you might need when breaches occur. With proper loss control and the right insurance, a business can survive a cyber attack.

A school district near Philadelphia is facing lawsuits and possible criminal action because school officials remotely turned on students’ laptop computers and watched students in their homes. An interest group that focuses on Internet issues recently reported that employers are not paying enough attention to the privacy and security risks posed by employees who telecommute. Researchers at Rutgers University have warned that smart phones, such as Blackberries and iPhones, are vulnerable to a computer virus that records the user’s location, movements, and even conversations. Modern technology has enhanced our lives and made us more productive, but it also puts users at risk of having their privacy violated, and businesses at risk of invading others’ privacy, even unintentionally.

Businesses and other organizations can avoid the predicament facing the school district by asking some simple questions:

• Why is the organization collecting this information and how does it expect to benefit? Does the data meet a legitimate business or operational purpose? How important is it that the organization have this information? The school district argues that, since it owns the students’ laptops, it has an interest in locating laptops its employees believe were stolen. Parents and others argue that the school has no right to watch students when they are off school property. Businesses frequently ask customers for data such as Social Security numbers and telephone numbers, but unless this data is essential to delivering services, it might be better to not ask for it.
• What data does the organization want to collect and what type of information might it collect unintentionally? The school district wanted to monitor potential theft of the laptops. By activating the computers’ webcams, however, the district could have captured images of the students during private moments. Businesses legitimately use security cameras to watch for threats to people and property. Although most of the images they capture are of little interest, the cameras could catch people off guard.
• What could go wrong if the organization collects the information? All information stored on computer networks is vulnerable to potential theft from individuals inside and outside the organization. If hackers obtain customer credit card information, the organization could face lawsuits from those whose information was stolen. School district employees might face criminal prosecution if authorities believe they violated the law.
• Is the organization informing customers and employees of its actions and looking at alternative approaches? Businesses often post signs informing customers that they are using security cameras. The school district could have considered other ways of tracking stolen laptops, such as by using GPS technology.
• What obligations will the organization assume by collecting the information? Federal and state laws require special protections for sensitive employee and customer data, such as birth dates, Social Security numbers, and personal financial information. Even where statutes do not apply, organizations may have common law obligations to protect data.
• If you had to justify the data collection in court or to a customer, would you be able to? People might have trouble understanding why the school district felt that watching students in their homes secretly was appropriate. A court might decide that a museum’s collection of members’ Social Security numbers was unnecessary.

Even when organizations use good judgment and take precautions, data loss can occur. To prepare for this possibility, discuss these issues with one of our insurance agents to determine whether you have the right coverage. Sound loss prevention practices coupled with adequate insurance will help your organization take advantage of technology while protecting yourself, your employees, and your customers.

Liability insurance is essential for protecting a business against losses caused by injuries or damages the business causes to others. As at least one contractor and a project owner found out, however, the extent of the coverage the policy provides is extremely important. A policy that does not provide the needed coverage is worthless to that business, but a court might find that even a worthless policy is legitimate.

Fort Washington Avenue Owners Corp. hired DNA Contracting to renovate its property. DNA, a general contractor, hired Rauman Construction Co. to do the masonry and roof replacement parts of the project. The contract between DNA and Rauman required the roofing company to obtain Commercial General Liability insurance and to have the policy name both Fort Washington and DNA as additional named insureds. Rauman had an insurance policy provided by Utica First Insurance Co., and the insurance company added the two additional insureds as the Rauman requested. In March 2007, a concrete block fell on one of Rauman’s employees and injured him. The worker sued Fort Washington for his injuries, citing its obligations under New York State Labor Law. Fort Washington notified Utica First of the claim and requested coverage, since it was an additional insured under Rauman’s policy.

However, Utica First denied the claim. It said that provisions in its policy meant that the insurance did not apply to:

• Injuries suffered by any employee of an entity insured under the policy, to any contractor hired by an insured entity, or to any employee of a hired contractor, if the injury arose out of that person’s employment.
• Injuries or damages arising out of roofing operations, including roof replacement or recovering of an existing roof.
• Injuries or damages for which the insured entity was liable because it had assumed the liability under a contract.

The claim involved an employee of Rauman, an entity insured under the policy; it arose out of Rauman’s roofing work; and it involved liability that Rauman assumed in its contract with DNA. Consequently, Utica First said that its policy did not apply to the claim. Fort Washington sued Rauman, demanding that Rauman compensate it for its costs. It also sued Utica First for coverage under Rauman’s policy. Utica First argued that its insurance did not apply because of the provisions regarding employees and roofing operations. Fort Washington argued that Utica First’s insurance coverage was illusory and against public policy, since it did not provide coverage necessary for a construction project.

The court disagreed. It said that public policy prohibits insurance companies from limiting their coverage to less than that required by law. Although noting that “the exclusions buried within (the policy’s) terms rendered it inadequate for the purposes intended,’ the court said that the policy “violated no regulation or statutorily declared public policy regarding the contents of an insurance policy.” It went on to say that “the issuance of this worthless policy” did not directly violate the public policy objective of the state Labor Law, which was to protect construction workers. It acknowledged that the lack of insurance rendered that protection hollow, but since the state legislature had not enacted minimum requirements for Construction insurance, the court could not impose them. The applicable rule in this case, the court said, was “let the buyer beware.”

Contractors should be very careful when selecting insurance companies and policies for purchase. A policy that does not provide necessary coverage can leave a contractor in breach of contracts and uninsured for liabilities that may run to hundreds of thousands of dollars. The best advice: Examine offered policies thoroughly and reject any that leave coverage holes as large as this one did. That’s where we come in: As your insurance agent, we will assist you in examining the intricacies of your coverages with you in order to ensure that they meet the needs of your particular situation.