Innovak International, Inc. v. Hanover Insurance Co. , 280 F. Supp. 3d 1340 ( 2017 )

ORDER

MARY S. SCRIVEN, UNITED STATES DISTRICT JUDGE

THIS CAUSE comes before the Court for consideration of Plaintiffs Motion for Partial Summary Judgment, (Dkt. 19), Defendant’s response in opposition thereto, (Dkt. 20), Defendant’s Dispositive Cross-Motion for Final Summary Judgment, (Dkt. 21), and Plaintiffs response in opposition thereto. (Dkt. 22) Upon consideration of all relevant filings, case law, and being otherwise fully advised, the Court DENIES Plaintiffs Motion for Partial Summary Judgment and GRANTS Defendant’s Motion for Summary Judgment.

I. BACKGROUND

a. Procedural History

On July 19, 2016, Plaintiff, Innovak International, Inc. (“Plaintiff’ or “Innovak”) filed this action in state court seeking a declaration that Defendant, The Hanover Insurance . Company- (“Defendant” or “Hanovér”) is. contractually obligated, under a commercial general liability insurance policy to defend Plaintiff in a class action filed against Plaintiff in the United States District Court for the Middle District of Alabama styled as Bohannon, et al. v. Innovak International, Inc., Case No. 1:1116-cv-272-WKW-WC (“Underlying Action”). (Dkt. 2) Plaintiff has also asserted a breach of contract, claim against Defendant for its failure to provide a defense in the Underlying Action in alleged contravention of-the insurance policy. (Id.) On August 25, 2016, Defendant removed this action to this Court. (Dkt. 1)

On March 16, 2017, Plaintiff moved for summary judgment on its- declaratory judgment claim asserting that it is entitled to judgment as a matter of law because the claims asserted in the Underlying Action are covered by the insurance policy. (Dkt. 19) Defendant ■ filed a cross-motion for summary judgment contending that the insurance policy does not cover the claims in the Underlying Action and therefore it has no duty to defend Plaintiff in the same. (Dkt. 21)

b. Undisputed Facts

On April 18, 2016, several individuals (“Underlying Claimants”) filed' a putative class action in the United States District Court for the Middle District of Alabama alleging damages resulting from the release of their personal private information (“PPI”) after Innovak was the subject of a data breach. (Dkt. 19-1 at 8-27) The Underlying Claimants amended their complaint on January 17, 2017. (Id. at 29-47)

According to the Underlying Claimants’ amended complaint (“Underlying Complaint”), Innovak “designs, develops, and sells accounting and payroll computer software systems to schools, school districts, and to other entities across the United States.” (Id. at 35) The Underlying Claimants allege that “Innovak’s software and database provides up-to-date W2 and pays-tub information to end users, which is accessible remotely via an internet portal.” (Id.) They contend that Innovak “was the subject of. a data breach when hackers appropriated the personal private information (“PPI”) stored on its software, database, and/or its portals, including but not limited to social security numbers, addresses, telephone numbers, dates of birth, employment information, and/or spousal information from numerous individuals in several different states whose PPI was stored and made accessible through Inno-vak’s internet portal.” (Id. at 29-30) Due to Innovak’s alleged failure to protect adequately the- Underlying Claimants’ PPI and to timely disclose the data breach to end users, the Underlying Claimants have sued 'Innovak for negligence, breach of implied contract, gross negligence, unjust enrichment, - and fraudulent suppression. (Id. at 29-46) The Underlying Claimants allege that as a result of Innovak’s conduct, they suffered, inter alia, “psychic injuries,” including “stress, nuisance, loss of sleep, worry, and the annoyance of having to deal with issues resulting from the Innovak data breach.” (Id. at 31)

On May 13, 2016, Innovak notified Hanover of the Underlying Action and demanded that Hanover defend Innovak in the suit pursuant to a Commercial General Liability Insurance Policy, Policy Number ZH6A06623802, (“Insurance Policy”)' that Hanover issued to Innovak covering the period of August 1, 2015 to August 1,2016. (Dkts. 21-2; 21-3) Three portions of the Insurance Policy are relevant to this action: (1) Coverage A, (2) Coverage B, and (3) the Data Breach Form.

Coverage A describes the Insurance Policy’s coverage of bodily injury and property damage claims... (Dkt. 21-2 at 216-21) Coverage B explains the policy’s coverage of personal and advertising injury claims. (Dkt. 21-2 at 221-22) It states, in pertinent part: -

We will pay those sums that the insured becomes legally obligated to pay as damages because of “personal and advertising injury” to which this insurance applies. We will have the right and duty to defend the insured against, any “suit” seeking those, damages. However, we will have no duty to defend the insured against any ‘suit’ seeking damages for ‘personal and advertising injury5 to which this insurance does not apply.

(Dkt. 21-2 at 221) The policy goes on to define “personal and advertising injury” in part as “injury, including consequential ‘bodily injury’, arising out of one or more of the following offenses: ... e. Oral or written publication, in any. manner, of material that violates a person’s right pf privacy.” (Dkt. 21-2 at 230)

The Data Breach Form describes coverage related to a data breach. (Id. at 14, 65-74) It provides, in relevant part:

We will provide .Data Breach Services, Data Breach Expense, Coverages and Additional Expense Coverages as described below, if yQU have a ‘data breach’ that: ■ .

a. Iá discovered during the coverage period of this Data Breach Coverage Form; and

b. Is reported to us within 30 days of your discovery of the ‘data breach’.

(Id. at 65) The Data Breach Form also notes, however, that is does not cover “[a]ny fees, costs, settlements, judgments or liability of any kind arising in. the course of, or as a result of a claim for damages, lawsuit, administrative proceedings, or governmental investigation, against or involving you.” (Id. at 68),

In a letter dated June 13, 2016, Hanover notified Innovak of its denial of coverage for the Underlying Action under Coverage A, Coverage B, and the. Data Breach Form. (Dkt. 19-1 at 49) In the letter, Hanover asserted that Coverage A of the Insurance Policy does not cover “psychic injury” claims asserted by the Underlying Claimants because the Policy “specifically addresses mental anguish[,] and státes that mental anguish, mental injury, shock, or fright constitute ‘bodily injury* if they result from ‘bodily injury', sickness, or disease.” (Dkt. 19-1 at 52) (emphasis in original) Thus, Hanover concluded, “[b]e-cáuse the [Underlying Claimants’] alleged injuries are purely emotional or psychic in hature, they do not fit within the Policy’s definition of ‘bodily injury ” and “coverage is not triggered.” (Id.) Hanover additionally denied coverage under Coverage A because the Underlying Claimants’ claims are based on the intentional acts of third party hackers, and Coverage A only covers “accidents” or unintentional conduct. (Id. at 53) It also .denied coverage under this section because the PPI 'appropriated by the third party hackers is intangible and thus cannot constitute property damage. (Id.) ’

Hanover also rejected coverage under Coverage B of the Insurance Policy. It stated: “Coverage B does not apply to the [Underlying Claimants’] claims because it necessarily requires an act or conduct by the Insured for coverage to be' present. Here, third party hackers,, not the .Insured, caused the data breach.” (Id. at 53)

- Finally, Hanover denied coverage based on the Data Breach Form. It asserted that “[c]overage is also not afforded under [the Data Breach Form] for the [Underlying Claimants’] claims against the Insured because [the Policy] specifically excludes ‘defense or legal liability’ and ‘legal advice or services’, including expenses relating to third party liability litigation.” (Id.)

In its Motion for summary judgment, Innovak argues that Hanover has a duty to defend it in the Underlying Action under Coverage B of the policy because the complaints in the Underlying Action “plainly and unequivocally allege that Innovak negligently prepared, designed and published software that allowed private personal information to be . known by third parties.” (Dkt. 19 at 7) It claims that Coverage B provides for coverage for claims alleging any publication of material that violates a person’s right to privacy, whether the publication is directly or indirectly committed by the insured. (Id. at 14) Notably, Inno-vak does not claim coverage under either Coverage A or the Data Breach Form in this action. (See Plaintiffs Response to Defendant’s Cross-Motion for Summary Judgment, Dkt. 22 at 1-2) (“Pages 11 through 18 of Hanover’s motion address the existence of coverage under a “Data Breach” endorsement and coverage under Part A of the Commercial General Liability Policy. Innovak makes no contention that there is coverage under these portions of the Policy.”)

In its response to Plaintiffs Motion and in its own Motion for Summary Judgment, Hanover contends that Coverage B does not provide coverage to Innovak because the Underlying Claimants did not allege publication, that is, public dissemination, of their PPI, but instead alleged appropriation of their information by third party hackers. (Dkt. 20 at 4-5, Dkt. 21 at 18-19) Hanover also claims that there is no coverage under Coverage B even if the Underlying Complaint alleges publication, because Coverage B requires alleged publication by the insured, not by a third party. (Dkt. 21 at 19-21) Finally, Hanover argues that even if the claims are construed as alleging publication by Innovak, coverage is still not available under Coverage B because the section only applies to intentional acts by the insured and the Underlying Claimants alleged that Inno-vak’s conduct was negligent.¹ (Id. at 21-22)

II. STANDARD OF REVIEW

Summary judgment is appropriate when the movant can show that there is no genuine issue of material fact and that the movant is entitled to judgment as a matter of law. Fennell v. Gilstrap, 559 F.3d 1212, 1216 (11th Cir. 2009) (citing Welding Servs., Inc. v. Forman, 509 F.3d 1351, 1356 (11th Cir. 2007)). Which facts are material depends on the substantive law applicable to the case. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). The moving party bears the burden of showing that no genuine issue of material fact exists. Clark v. Coats & Clark, Inc., 929 F.2d 604, 608 (11th Cir. 1991).

Evidence is reviewed in the light most favorable to- the non-moving party. Fennell, 559 F.3d at 1216 (citing Welding Servs., Inc., 509 F.3d at 1356). A moving party discharges its burden on a motion for summary judgment by showing or pointing out to the Court that there is an absence of evidence to support the non-moving party’s case. Denney v. City of Albany, 247 F.3d 1172, 1181 (11th Cir. 2001) (citation omitted).

When a moving party has discharged its burden, the non-moving party must then designate specific facts (by its own affidavits, depositions, answers to interrogatories, or admissions on file) that demonstrate there is a genuine issue for trial, Porter v. Ray, 461 F.3d 1315, 1320-21 (11th Cir. 2006) (citation omitted). The party opposing a motion for summary judgment must rely on more than conclusory statements or allegations unsupported by facts. Evers v. Gen. Motors Corp., 770 F.2d 984, 986 (11th Cir. 1985) (“conclusory allegations without specific supporting facts have no probative value,”). “If a party fails to properly support an assertion of fact or fails to properly address another party’s assertion of fact ... the court may grant summary judgment if the motion and supporting materials ... show that the movant is entitled to it.” Fed. R. Civ. P. 56(e).

“The standard of review for cross-motions for summary judgment does not differ from the standard applied,when only one party files a motion, but simply requires a determination of whether either of the parties deserves judgment as a matter of law on the facts that are not disputed.” S. Pilot Ins. Co. v. CECS, Inc., 52 F.Supp.3d 1240, 1242-43 (N.D. Ga. 2014) (citing Am. Bankers Ins. Group v. United States, 408 F.3d 1328, 1331 (11th Cir. 2005)). “Cross-motions may, however, be probative of the absence of a factual dispute where they reflect general agreement by the parties as to the controlling legal theories and material facts.” Id. at 1243 (citing United States v. Oakley, 744 F.2d 1553, 1555-56 (11th Cir.1984)).

III. DISCUSSION

A federal court sitting in diversity applies the conflict-of-law rules of the state in which it sits. Klaxon Co. v. Stentor Elect. Mfg. Co., 313 U.S. 487, 496, 61 S.Ct. 1020, 1021, 85 L.Ed. 1477 (1941); Bryan v. Hall Chem. Co., 993 F.2d 831, 834 (11th Cir.1993), and thus the Court must apply Florida’s choice of law rules. Florida courts apply the rule of lex loci contractus, which provides' that “in the absence of á contractual provision specifying the governing law, a contract (other than one for the performance of services) is governed by the law of the state in which the contract is made, i.e., where the last act necessary to complete the contract is done.” Fioretti v. Massachusetts Gen. Life Ins. Co., 53 F.3d 1228, 1235 (11th Cir. 1995) (citing Equitable Life Assurance Soc’y of the U.S.A. v. McRee, 75 Fla. 257, 78 So. 22, 24 (1918); Lacy v. Force V Corp., 403 So.2d 1050, 1056 (Fla.1st DCA 1981); Jemco, Inc. v. United Parcel Serv., Inc., 400 So.2d 499, 500 (Fla. 3d DCA1981), review denied, 412 So.2d 466 (Fla.1982)). The Parties agree that because the Insurance Policy was issued and delivered in South Carolina, South Carolina law governs the Court’s interpretation of the policy terms. (Dkt. 19 at 10; Dkt. 21 at 10; Dkt. 22 at 2)

Under South Carolina law, “ ‘an insurer’s duty to defend is determined by the allegations of the underlying complaint.’ ” Canopius US Ins., Inc. v. Middleton, 202 F.Supp.3d 540, 546 (D.S.C. 2016) (citing Union Ins. Co. v. Soleil Grp., Inc., 465 F.Supp.2d 567, 572 (D.S.C.2006)). “If the underlying complaint creates a possibility of coverage under an insurance policy, the insurer is obligated to defend.” Id. (citation omitted) In interpreting an insurance contract, the Court must “ascértain and give legal effect to the parties’ intentions as determined by the contract language.” Id. (citing Beaufort Cty. Sch. Dist. v. United Nat'l Ins. Co., 392 S.C. 506, 709 S.E.2d 85, 90 (S.C.Ct.App.2011)). “If the contract’-s language is clear and unambiguous, the- language alone, understood in its plain, ordinary, and popular sense, determines the contract’s force and effect.” Id.(citation omitted). “However, an insurance contract which is in any .respect ambiguous or capable of two meanings must be construed in favor of the insured.” Id. (citation omitted).

In accordance with South Carolina law, the Court first looks to the claims made in the complaint in the Underlying Action (“Underlying Complaint”) to determine the scope of Plaintiffs coverage claim. In Count I, the ‘Underlying Claimants allege that Innovak was negligent when it breached its duties to the Underlying Claimants by failing tó: (1) “adequately protect the [Underlying ' Claimants’] PPI,” (2) “adequately design, develop, and sell software that would not (sic) protect the [Underlying Claimants’] PPI” (3) “maintain adequate data security measures,” (4) “timely disclose the material fact that the security measures on Innovak’s software and/or portals were inadequate to protect the [Underlying Claimants’] PPI,” and (5) “disclose in a timely manner and accurate manner the material fact of the Innovak Data breach.” (Dkt. 19-1 at 40-41)

In Count II, they claim breach of implied contract for Innovak’s alleged failure “to safeguard them PPI” and “timely notify the [Underlying Claimants] that their PPI was at risk, breached or otherwise compromised.” (Dkt. 19-1 at 42) In Count III, the Underlying Claimants allege gross negligence, recklessness and/or wantonness against Innovak for its “failure to provide.adequate security to protect the [Underlying Claimants’] PPL” (Dkt. 19-1 at 43) They bring- a claim for unjust enrichment in Count IV, contending that they paid Innovak “to provide adequate security measures to protect the [Underlying Claimants’] highly sensitive personal information.” According to the Underlying Claimants, because Innovak failed to provide this service, it was unjustly enriched to the ' extent of the compensation it received. (Dkt. 19-1 at 44) Finally, in Count V the Underlying Claimants allege a claim for fraudulent‘suppression, asserting that “Innovak knew or should have known that it failed to adequately protect the [Underlying Claimants’] PPI” and “fraudulently suppressed from the [Underlying Claimants]’ the material fact that their PPI was at risk of being compromised.” (Dkt. 19-1 at 44-45)

In the instant action, the Parties dispute whether the claims in the Underlying Complaint are covered under Coverage B of the Insurance Policy as claims for “personal and advertising injury.” Coverage B defines “personal and advertising injury” in part as: “injury, including consequential ‘bodily injury’, arising out of one or more of the following offenses: ... e. Oral or written publication, in any manner, of material that violates a person’s right of privacy.” (Dkt. 21-2 at 230)

Hanover contends that it has no duty to defend Innovak in the Underlying Action because the Underlying Claimants do not claim “publication” of their PPI as they never allege public, dissemination of the information. (Dkt. 21 at 19) Instead, the Underlying Claimants allege that third party hackers appropriated/stole the information. (Dkt. 21-1 at 2) Moreover, according to Hanover, the publication must be made by the insured/policyholder. (Dkt. 21 at 20) Thus, under this interpretation, coverage is not available even if the Underlying Claimants’ allegations are construed as alleging “publication” of their PPI because Innovak was not the alleged publisher. In response, Plaintiff argues that the Coverage B “does not require ultimate publication of the PPI directly by the insured.” (Dkt. 19 at 14) It argues that the .Underlying Claimants’ claims are covered under Coverage B because the Underlying Claimants essentially allege that “Innovak negligently published software that was the proximate cause of the publication of PPI by unknown third parties.” (Id.)

Upon consideration, the Court finds that there is no coverage under Coverage B for the Underlying Action because the Underlying Complaint does not allege a publication by Innovak. The Court notes that Innovak materially mischaracterizes the allegations of the Underlying Complaint. Nowhere in the Underlying Complaint do the Underlying. Claimants contend that their PPI was “published,” whether by third party hackers or by Innovak. However, even if the Court views the alleged data breach as an alleged publication- of the Underlying Claimants’ PPI, the Underlying Claimants do not allege that Innovak published their information. Innovak apparently concedes the point as it contends that the Underlying Claimants’ allege that Innovak “published software,” rather than the Underlying Claimants’ private information. (Dkt. 19 at 14) However, publication of Innovak’s software does not “violate[ ] [the Underlying Claimants’] right of privacy” as required for coverage under Coverage B. The act that violates the claimants’ right of privacy is the publication of their PPI, and the Underlying Claimants have not alleged that Innovak directly or indirectly committed that act. Innovak makes several arguments to the contrary, but the Court finds each argument unavailing^

First, Innovak argues that the.language “in any manner” connotes that publication under Coverage B includes both “direct publication of PPI and negligent failure to prevent third parties from obtaining the PPI.” (Dkt. 22 at 7) Hanover contends that the phrase “in any manner” “merely ‘expands the categories of publication (such as email, handwritten letters, and, perhaps, ‘blast-faxes’) covered by the policy,’ ” (Dkt. 21 at 19) (citing Creative Hospitality Ventures, Inc. v. U.S. Liability Ins. Co., 444 Fed.Appx. 370, 375-76 (11th Cir. 2011))

Although case law' on the subject is-scant, the Parties both acknowledge that one court has addressed this issue in the data breach context, albeit in an unpublished opinion. (Dkt. 21 at 20; Dkt. 22 at 10) In Zurich American Insurance v. Sony Corporation of America, the Supreme Court of New York addressed a policy provision identical to Coverage B when considering whether claims concerning a data breach were covered under the policy. No. 651982/2011, 2014 WL 8382554, 2014 N.Y. Misc. LEXIS 5141 (N.Y. Sup. Ct. Feb. 21, 2014). The underlying plaintiffs in that case alleged that'the insured failed to implement adequate security measures, to protect their private information from internet hackers who illegally gained access to the same in a data- breach. Like Coverage B in the instant action,, the subject insurance policy provision, in Zurich provided coverage for claims of “personal and advertising injury,” which included, inter alia, “oral or written publication in any manner of the material that violates a person’s right- of privacy.” Id. 2014 WL 3253541, 2014 N.Y. Misc. LEXIS 5141 at *24-25.

The court determined that this definition of “personal and advertising injury” did not encompass a claim that the insured implemented inadequate security measures that led to a data breach. It stated that the publication of the private information in such a circumstance is “perpetrated by the hackers,” not by the insured. Id. 2014 WL 3253541, 2014 N.Y. Misc. LEXIS 5141 at *70. It found that the subject policy provision “requires the policyholder to perpetrate or commit the act,” and reasoned that construing the policy to include the acts of third parties “would be expanding coverage beyond what the insurance carriers were ... knowingly entering into.” Id. 2014 WL 3253541, 2014 N.Y. Misc. LEXIS 5141 at *71 (emphasis added). Regarding the words “in any manner,” the court determined the words indicated “the medium,” or “the kind of way it is being publi-cizéd,” rather than “who actually sends that kind of publication.” Id The Court concurs in that reasoning and finds that the only plausible interpretation of Coverage B is that it requires the insured to be the publisher of the PPI.

Even if the Court accepts Innovak’s argument Coverage B “does not require ultimate publication of the PPI directly by the insured,” (Dkt. 19 at 14), and that indirect publication can suffice, the argument nonetheless fails because the Underlying Complaint does not contain any allegations of indirect publication by Innovak. The Underlying Claimants’ allegations -with regard to Innovak’s actions are clear. They repeatedly contend that Innovak failed to protect their PPI by failing to implement sufficient data security measures. This is not an allegation of indirect publication; it is not an allegation of publication at all. Thus, the Court declines to construe the Underlying Claimants’ claims as claims for indirect publication of their information by Innovak.

Second, Innovak argues that the Court should liken this case to a case from the Middle District of California, Hartford Casualty Insurance Company v. Corcino & Associates, et al, No. CV 13-3728 GAF JCX, 2013 WL 5687527, at *1 (C.D. Cal. Oct. 7, 2013), in which, according to Plaintiff, the California court “determined that [an insurer] had a duty to defend [an insured] under Part B coverage of a commercial general liability policy using identical language to the language in this case.” (Dkt. 19 at 15) Corcino is wholly inapposite.

Notably, Corcino involved allegations that private information was actually posted by the insured, through one of the insured’s job applicants, to a' public website, which connotes a “publication” of information. Here, the Underlying Claimants do not allege that their PPI was ever made publicly accessible by Innovak. Moreover, although the insurance policy in Corcino contained a definition of “personal and. advertising injury” substantially similar to that contained in Coverage B in this action, that definition was not the subject of dispute in the action. Indeed, the insurer in the action “[did] not dispute that the Underlying Litigation involve[d] claims that [the insured] is liable for electronic publication of material that violates the underlying plaintiffs’ rights of privacy.” Corcino, 2013 WL 5687527, at *3. The Corcino court simply did not address the issues presented in this action.

Third, Innovak contends that Hanover may not raise the asserted defenses to coverage in this action because it failed to apprise Innovak of such defenses in its coverage denial letter. (Dkt. 22 at 4-6) (citing Harleysville Grp. Ins. v. Heritage Cmtys., Inc., 420 S.C. 321, 803 S.E.2d 288 (S.C. 2017)) However, the Court need not reach this issue because the defense on which this Court’s resolution of the instant motions is based, namely, that the publication must have been perpetrated by the insured in order for coverage to be invoked, was concededly included in the coverage denial letter. (See Plaintiffs Response to Defendant’s Cross-Motion for Summary Judgment, Dkt. 22 at 6) (“The only issue discussed in any manner in Hanover’s denial letter that approaches South Carolina’s law for coverage communication is its assertion that the Underlying Complaint does not allege that Innovak directly published the [Underlying Claimant’s] PPI.”); (Defendant’s Coverage Denial Letter, Dkt. 19-1 at 53) (“Coverage B does not apply to the [Underlying Claimants’] claims because it necessarily requires an act or conduct by the Insured for coverage to be present. Here, third party hackers, not the Insured, caused the data breach.”) Thus, the fact that Hanover has mounted additional alternative arguments in this action that it did not mention in the coverage denial letter is a moot point.

Accordingly, the Court finds that Defendant does not owe Plaintiff a duty to defend Plaintiff in the Underlying Action under the Insurance Policy.

IV. CONCLUSION

Upon consideration of the foregoing, it is hereby ORDERED as follows:

1.Plaintiffs Motion for Partial Summary Judgment, (Dkt. 19), is DENIED.

2. Defendant’s Dispositive Cross-Motion for Pinal Summary Judgment, (Dkt. 21), is GRANTED.

3. The CLERK is directed to enter JUDGMENT in favor of the Defendant, The Hanover Insurance Company, TERMINATE any pending motions, and CLOSE this case.

DONE and ORDERED in Tampa, Florida, this 17th day of November, 2017.

1 . Hanover also contends that it owes no duty to defend Innovak in the Underlying Action because Innovak failed to notify Hanover of the data breach in a timely manner in violation of the Data Breach Form and because defense costs arising from a data breach are expressly excluded from coverage under the Data Breach Form. (Dkt. 21 at 12-14) To this end, the Court notes that the Data Breach Form may serve as a limitation on any coverage that may be available under Coverage B. However, the Court need not reach this issue because, as explained herein, Coverage B does not provide coverage for the defense of the Underlying Action.