News from IABAC

Privacy Alert:
How Your Copy Machine May Put You Out of Business!

You may have seen the recent CBS news investigation highlighting how nearly every digital copier built since 2002 contains a hard drive - like the one on your personal computer - storing an image of every document ever copied, scanned or emailed by that machine. Among the used photocopiers looked at in the CBS news story was one from a police station which showed tens of thousands of documents detailing confidential police reports, victim statements and other personal information.

This information sets off alarm bells for every individual who has ever used a copy machine in a public place, had their medical records copied routinely at the doctor's office or seen personal information copied by their bank or other institution. But it is also cause for concern for those of us who are small business owners and those who insure many of these same entities against risk. Members of congress have recently directed the FTC to look into the matter of data security and personal privacy. And state representatives are also getting into the act, with two New Jersey lawmakers introducing legislation that would require all hard drives on copy machines to be wiped clean to protect the sensitive data retained on them.

Not surprisingly, the revelation has introduced a whole new area of liability and potential litigation as well. If confidential information were to be leaked from your copy machine's hard drive would your business be exposed to liability? Does your Errors and Omissions (Professional Liability) Insurance policy cover incidences such as these? How about Federal Law and some States that now mandate that customers be notified of data breaches? At a minimum of $.44 per 1st class letter, such costs could be astronomical for small businesses.

According to Fred Fisher, CEO of E.L.M. Insurance Brokers and an industry expert on professional liability coverage, some of the exposures you could be facing and the coverage's that may not be included on your errors and omissions insurance include:

Breach of Privacy coverage , includes Damages resulting from alleged violations of HIPAA, state and federal privacy protection laws and regulations
Coverage for expenses resulting from a breach of consumer protection laws Including the Fair Credit Reporting Act (FORA), the California Consumer Credit Reporting Agencies Act (CCCRAA) and the European Union (EU) Data Protection Act
Customer Breach Notice Expense Coverage (via sub-limit) -reimburses for costs to notify and provide 12 months of credit monitoring Coverage for acts of a rogue employee causing intentional damage to the Insured's Computer Network
Public relations expense coverage available to cover costs resulting from a data breach
Customer Notification Expenses include legal expenses, credit monitoring expenses, postage and advertising costs
Privacy Breach definition extends to acts of the Insured and acts of a Service Provider acting on behalf of the Insured
Most favorable venue wording for punitive or exemplary damages
Definition of Claim includes demand for monetary and non-monetary damages or request to toll applicable statutes of limitations
Cyber Extortion includes credible threats to Digital Assets acquired by unauthorized access or unauthorized use; introduce malicious code; corrupt, damage or destroy computer systems, pharming/phishing or denial of service attacks
Interruption expenses include additional costs associated with rented/leased equipment, use of third party services, additional staff expenses or labor costs directly resulting from a covered Loss of Digital Assets claim
Personally identifiable information (PH) broadly defined to include an individual's name in combination with social security number, driver's license number, account number, credit or debit card or any non-personal information as defined in any privacy regulation
Favorable Knowledge provision includes President, Executive Officer, Chairman, Chief Information Officer, Chief Technology Officer, Risk Manager or General Counsel
Crisis Management may also bee needed involving an emergency response expenses incurred because of the crisis created

There may be Cyber Liability policies available that can be purchased that will cover those costs.

It is important that prior to disposing of any copy machine you have the hard drive removed and wiped clean or dispose of the hard drive yourself through your approved document destruction vendor.

Frederick J. Fisher, J.D., CEO of E.L.M. Insurance Brokers and Executive VP of Insurance Specialty Group's Professional Liability Practice specializing in insuring professional liability risks. Mr. Fisher can be reached at 310.322.1301 or ffisher@e-o.com