The Fifth Circuit Court Rules in Favor of the Insured Vendor For Alleging “Personal and Advertising Injury”

The Fifth Circuit Court Rules in Favor of the Insured Vendor For Alleging “Personal and Advertising Injury”

On July 21, 2021, the United States Court of Appeals for the Fifth Circuit ruled that an insurer owes a duty to defend its insured in an underlying suit arising from a payment card breach. It found that the complaint filed by the insured sufficiently alleged a “personal and advertisisng injury”, under the terms of the policy. Landry’s Inc. v. Ins. Co. of the State of Pa., 2021 WL 3075937 (5th Cir. July 21, 2021).

The insured was a retail property manager and suffered a payment card breach at fourteen of its locations between May 2014 and December 2015. The said breach involved an unauthorized installation of a program on its credit card-processing devices. The installed program was designed to capture the data from the magnetic strips on credit cards. The captured data included name of the cardholder, card number, its expiration date, and an internal verification code. The installer thereafter used the captured information through the program and made around $20 million in unauthorized charges. Thus, as per the payment card processing agreement, the insured’s payment processing vendor sought indemnification from the insured, for the losses incurred. However, as the insured refused to pay, the vendor filed a suit against the insured.

Following the same, the insured demanded coverage for the liability under its general liability insurance policy. The said policy provided coverage for damages incurred because of “personal and advertising injury” and defined a personal and advertising injury as “injury . . . arising out of . . . oral or written publication, in any manner, of material that violates a person’s right of privacy.” However, the insurer refused the coverage stating that the underlying litigation did not allege a personal and advertising injury. The district court sided with the contentions of the insurer and held that there was no coverage under the policy.

Resultantly, the insured filed an appeal before the Fifth Circuit. The Fifth Circuit court reversed the district court’s ruling. It held that the complaint successfully alleged a “publication” and arose from a violation of “a person’s right of privacy”, which meant that the insurer owed a duty to defend. The court interpreted the meaning of the term, “publication” and held that the coverage was to be given in case of “publication in any manner”. This meant that the policy intended to apply the broadest definition of “oral or written publication”. It further concluded that the publication requirement under the policy should be at least as broad as the tort of defamation, which requires transmission of information to one other person. Therefore, the complaint sufficiently alleged a “publication” because it claimed that credit card information of its customers was exposed to hacker and other merchants to make fraudulent purchases. The Court also held that the theft of information also led to the violation of customers’ right of privacy.

Thus, the Court rejected the arguments made by the insurer that the policy only covered tort lawsuits filed by individual customers and not breach-of-contract action brought by vendors. The Fifth Circuit court has provided an important ruling in clarifying that a breach of contract action brought by vendors are to be entertained under the general insurance policy.