Hacking, Data Exclusion Clauses and the Duty to Defend
Recently, the Ontario Court of Appeal released a decision which opined on the novel interpretive issue of data exclusion clauses. In Family and Children’s Services of Lanark, Leeds and Grenville v. Co-operators General Insurance Company, 2021 ONCA 159, the appellate court unanimously allowed for the appeal of an application judge’s decision requiring an action be brought in order to deny the duty to defend.
In this case, the respondent, Family and Children’s Services of Lanark, Leeds and Grenville (“FCS”), hired the respondent, Laridae Communications Inc. (“Laridae”), to provide communication and marketing services, namely updating FCS’s website. Laridae obtained and was insured under both a professional liability policy and a commercial general liability policy (“CGL”) from the appellant, Co-operators General Insurance Company (“Co-operators”). FCS was an additional insured under the CGL.
In April 2016, a password-protected portal on FCS’s website was hacked. After which, a hyperlink to a confidential report, which contained numerous clients’ personal information, was posted on a social media platform.
Subsequently, a class action was brought against FCS and others. As a result, FCS commenced a third-party claim against Laridae for breach of contract and negligence.
Both FCS and Laridae brought applications seeking a declaration that the appellant had a duty to defend them against the class action and third-party claim after their request was denied.
On the application, the appellant argued that coverage was excluded under both policies for any personal injury arising from the distribution or display of data (“data exclusion clause”). The respondents took the position that the data exclusion clause did not exclude all the claims against them. Moreover, the respondents argued that this was an important issue that should not be determined on an application
The application judge agreed with the respondents concluding that coverage should not be determined on an application. The judge also found that there is the possibility of coverage in this case. Lastly, the application judge concluded that the appellant would be obligated to fund both defences, if there was a conflict of interest between the two respondents and neither of which would report to appellant.
The appellant successfully appealed.
The Ontario Court of Appeal held that a determination regarding the appellant’s duty to defend could be made based on the application materials before the court. Through a coverage analysis, the court found that the exclusion clauses are clear and unambiguous. Moreover, the appellant court disagreed that some of the claims could be covered by the policy. Based on the substance of the claims pleaded in the class action, the allegations would fall directly within the policy exclusions. Therefore, the appellant owes no duty to defend either respondent.
Lastly, Appellate Court affirmed that the onus would be on the insured to establish a reasonable apprehension of a conflict of interest on the part of the insurer in order to remove their right to participate in the defence.