Innovak Int'l, Inc. v. Hanover Ins. Co.

280 F.Supp.3d 1340

INNOVAK INTERNATIONAL, INC., Plaintiff,

v.The HANOVER INSURANCE COMPANY, Defendant.

Case No: 8:16–cv–2453–MSS–JSS

United States District Court, M.D. Florida, Tampa Division.

Signed November 17, 2017

George E. Carr, Ver Ploeg & Lumpkin, P.A., Samuel A. Walker, Teeluck Persad, CPLS, PA, Orlando, FL, Heidi J. Livingston, Law Offices of Lorraine Lester, Lake Mary, FL, for Plaintiff.

Mallory Havens Thomas, Patricia A. McLean, Phelps Dunbar, LLP, Tampa, FL, for Defendant.

ORDER

MARY S. SCRIVEN, UNITED STATES DISTRICT JUDGE

THIS CAUSE comes before the Court for consideration of Plaintiff's Motion for Partial Summary Judgment, (Dkt. 19), Defendant's response in opposition thereto, (Dkt. 20), Defendant's Dispositive Cross–Motion for Final Summary Judgment, (Dkt. 21), and Plaintiff's response in opposition thereto. (Dkt. 22) Upon consideration of all relevant filings, case law, and being otherwise fully advised, the Court DENIES Plaintiff's Motion for Partial Summary Judgment and GRANTS Defendant's Motion for Summary Judgment.

I. BACKGROUND

a. Procedural History

On July 19, 2016, Plaintiff, Innovak International, Inc. ("Plaintiff" or "Innovak") filed this action in state court seeking a declaration that Defendant, The Hanover Insurance Company ("Defendant" or "Hanover") is contractually obligated under a commercial general liability insurance policy to defend Plaintiff in a class action filed against Plaintiff in the United States District Court for the Middle District of Alabama styled as Bohannon, et al. v. Innovak International, Inc., Case No. 1:1116–cv–272–WKW–WC ("Underlying Action"). (Dkt. 2) Plaintiff has also asserted a breach of contract claim against Defendant for its failure to provide a defense in the Underlying Action in alleged contravention of the insurance policy. (Id. ) On August 25, 2016, Defendant removed this action to this Court. (Dkt. 1)

On March 16, 2017, Plaintiff moved for summary judgment on its declaratory judgment claim asserting that it is entitled to judgment as a matter of law because the claims asserted in the Underlying Action are covered by the insurance policy. (Dkt. 19) Defendant filed a cross-motion for summary judgment contending that the insurance policy does not cover the claims in the Underlying Action and therefore it has no duty to defend Plaintiff in the same. (Dkt. 21)

b. Undisputed Facts

On April 18, 2016, several individuals ("Underlying Claimants") filed a putative class action in the United States District Court for the Middle District of Alabama alleging damages resulting from the release of their personal private information ("PPI") after Innovak was the subject of a data breach. (Dkt. 19–1 at 8–27) The Underlying Claimants amended their complaint on January 17, 2017. (Id. at 29–47)

According to the Underlying Claimants' amended complaint ("Underlying Complaint"), Innovak "designs, develops, and sells accounting and payroll computer software systems to schools, school districts, and to other entities across the United States." (Id. at 35) The Underlying Claimants allege that "Innovak's software and database provides up-to-date W2 and paystub information to end users, which is accessible remotely via an internet portal." (Id. ) They contend that Innovak "was the subject of a data breach when hackers appropriated the personal private information ("PPI") stored on its software, database, and/or its portals, including but not limited to social security numbers, addresses, telephone numbers, dates of birth, employment information, and/or spousal information from numerous individuals in several different states whose PPI was stored and made accessible through Innovak's internet portal." (Id. at 29–30) Due to Innovak's alleged failure to protect adequately the Underlying Claimants' PPI and to timely disclose the data breach to end users, the Underlying Claimants have sued Innovak for negligence, breach of implied contract, gross negligence, unjust enrichment, and fraudulent suppression. (Id. at 29–46) The Underlying Claimants allege that as a result of Innovak's conduct, they suffered, inter alia , "psychic injuries," including "stress, nuisance, loss of sleep, worry, and the annoyance of having to deal with issues resulting from the Innovak data breach." (Id. at 31)

On May 13, 2016, Innovak notified Hanover of the Underlying Action and demanded that Hanover defend Innovak in the suit pursuant to a Commercial General Liability Insurance Policy, Policy Number ZH6A06623802, ("Insurance Policy") that Hanover issued to Innovak covering the period of August 1, 2015 to August 1, 2016. (Dkts. 21–2; 21–3) Three portions of the Insurance Policy are relevant to this action: (1) Coverage A, (2) Coverage B, and (3) the Data Breach Form.

Coverage A describes the Insurance Policy's coverage of bodily injury and property damage claims. (Dkt. 21–2 at 216–21) Coverage B explains the policy's coverage of personal and advertising injury claims. (Dkt. 21–2 at 221–22) It states, in pertinent part:

We will pay those sums that the insured becomes legally obligated to pay as damages because of "personal and advertising injury" to which this insurance applies. We will have the right and duty to defend the insured against any "suit" seeking those damages. However, we will have no duty to defend the insured against any ‘suit’ seeking damages for ‘personal and advertising injury’ to which this insurance does not apply.

(Dkt. 21–2 at 221) The policy goes on to define "personal and advertising injury" in part as "injury, including consequential ‘bodily injury’, arising out of one or more of the following offenses: ... e. Oral or written publication, in any manner, of material that violates a person's right of privacy." (Dkt. 21–2 at 230)

The Data Breach Form describes coverage related to a data breach. (Id. at 14, 65–74) It provides, in relevant part:

We will provide Data Breach Services, Data Breach Expense Coverages and Additional Expense Coverages as described below if you have a ‘data breach’ that:

a. Is discovered during the coverage period of this Data Breach Coverage Form; and

b. Is reported to us within 30 days of your discovery of the ‘data breach’.

(Id. at 65) The Data Breach Form also notes, however, that is does not cover "[a]ny fees, costs, settlements, judgments or liability of any kind arising in the course of, or as a result of a claim for damages, lawsuit, administrative proceedings, or governmental investigation against or involving you." (Id. at 68)

In a letter dated June 13, 2016, Hanover notified Innovak of its denial of coverage for the Underlying Action under Coverage A, Coverage B, and the Data Breach Form. (Dkt. 19–1 at 49) In the letter, Hanover asserted that Coverage A of the Insurance Policy does not cover "psychic injury" claims asserted by the Underlying Claimants because the Policy "specifically addresses mental anguish[,] and states that mental anguish, mental injury, shock, or fright constitute ‘bodily injury’ if they result from ‘bodily injury’, sickness, or disease." (Dkt. 19–1 at 52) (emphasis in original) Thus, Hanover concluded, "[b]ecause the [Underlying Claimants'] alleged injuries are purely emotional or psychic in nature, they do not fit within the Policy's definition of ‘bodily injury’ " and "coverage is not triggered." (Id. ) Hanover additionally denied coverage under Coverage A because the Underlying Claimants' claims are based on the intentional acts of third party hackers, and Coverage A only covers "accidents" or unintentional conduct. (Id. at 53) It also denied coverage under this section because the PPI appropriated by the third party hackers is intangible and thus cannot constitute property damage. (Id. )

Hanover also rejected coverage under Coverage B of the Insurance Policy. It stated: "Coverage B does not apply to the [Underlying Claimants'] claims because it necessarily requires an act or conduct by the Insured for coverage to be present. Here, third party hackers, not the Insured, caused the data breach." (Id. at 53)

Finally, Hanover denied coverage based on the Data Breach Form. It asserted that "[c]overage is also not afforded under [the Data Breach Form] for the [Underlying Claimants'] claims against the Insured because [the Policy] specifically excludes ‘defense or legal liability’ and ‘legal advice or services’, including expenses relating to third party liability litigation." (Id. )

In its Motion for summary judgment, Innovak argues that Hanover has a duty to defend it in the Underlying Action under Coverage B of the policy because the complaints in the Underlying Action "plainly and unequivocally allege that Innovak negligently prepared, designed and published software that allowed private personal information to be known by third parties." (Dkt. 19 at 7) It claims that Coverage B provides for coverage for claims alleging any publication of material that violates a person's right to privacy, whether the publication is directly or indirectly committed by the insured. (Id. at 14) Notably, Innovak does not claim coverage under either Coverage A or the Data Breach Form in this action. (See Plaintiff's Response to Defendant's Cross–Motion for Summary Judgment, Dkt. 22 at 1–2) ("Pages 11 through 18 of Hanover's motion address the existence of coverage under a "Data Breach" endorsement and coverage under Part A of the Commercial General Liability Policy. Innovak makes no contention that there is coverage under these portions of the Policy.")

In its response to Plaintiff's Motion and in its own Motion for Summary Judgment, Hanover contends that Coverage B does not provide coverage to Innovak because the Underlying Claimants did not allege publication, that is, public dissemination, of their PPI, but instead alleged appropriation of their information by third party hackers. (Dkt. 20 at 4–5, Dkt. 21 at 18–19) Hanover also claims that there is no coverage under Coverage B even if the Underlying Complaint alleges publication, because Coverage B requires...