In one of the most closely-watched insurance coverage cases in the country, the New York Supreme Court held on February 21, 2014 that standard CGL policies do not provide coverage for claims against Sony Corporation as a result of the massive PlayStation data breach in April 2009.  The breach exposed the personal information of more than 60 million users throughout the U.S. and spawned more than 50 class actions.  Meagher & Geer partners Charles E. Spevacek and Paula Weseman Theisen represented St. Paul Fire & Marine Insurance Company in the case, Zurich American Ins. Co. v. Sony Corp. of Am., et al., Case No. 651982/2011 (N.Y. Sup., New York County)(Order of Mar. 3, 2014).

The plaintiffs in the underlying actions sought damages from Sony under various theories, including negligence, breach of warranty, violation of state consumer protection laws, and failure to comply with California's data-breach notification law.  Sony tendered the claims to its CGL carriers and argued that they had a duty to defend the Sony entities under the Coverage B "Personal Injury" provision.  The policies included standard ISO-based language, which covers "personal and advertising injury."  "Personal and advertising injury" is defined as "injury...arising out of one or more of the following offenses...: [O]ral or written publication, in any manner, of material that violates a person's right of privacy."  The primary issue before the court was whether the underlying complaints alleged "an oral or written publication, in any manner," that violated the PlayStation user's rights of privacy, such that the primary carriers had a duty to defend Sony against the claims. 

Following arguments on cross-motions for summary judgment, presiding Judge Oing ruled from the bench that Sony had failed to establish that the claims fell within the Coverage B insuring provision, noting that courts addressing the "personal injury" definition generally have held that the insured must have conducted or perpetrated the wrongful act (i.e., the publication), with the "in any manner" language referring to the way in which the material is publicized, not who is doing it.  Judge Oing further held that reading the policy as a whole, he could not find that it provided coverage for acts of a third party, and that the "invasion of privacy" portion of the definition can only be read to require that the insured have committed the publication. Interpreting the language to expand liability to publication by third parties would expand coverage beyond what the insurers had agreed to assume. Accordingly, since the publication at issue in the PlayStation data breach cases was not a publication perpetrated by Sony, but a publication perpetrated by third-party criminal hackers, there was no CGL coverage for the claims.