It has been a busy year at MEARIE. This issue of the Reciprocal News provides some yearend thoughts related to a couple of current discussion topics that have arisen during our recent customer visits: Third-Party Privacy, Cyber and Network Security Liability and hot water tank liability.
The Personal Information you collect from your customers is ultimately your responsibility. If you outsource operations to a third-party, such as
a billing service, and they experience a privacy breach, your customers may expect to recover any damages from your organization. After all, your customers have a relationship with and are dealing directly with you.
In dealing with your service suppliers, privacy- related risk management practices and your policies and procedures become even more important, particularly when service suppliers are handling your customers’ personal information
on your behalf. Do you know about the security policies and procedures, related to personal information or a data breach, your service providers have? How secure are their system controls? What does the contract with your service provider include in the way of indemnification arrangements for you?
In the event of a privacy breach claim, who will pay? MEARIE would initially respond, however if it were determined your service supplier was negligent, MEARIE would cease involvement in the claim and it would be expected the service supplier would take over and continue through the settlement. Your MEARIE Privacy, Cyber and Network Security Liability endorsement does not provide coverage for damages or expenses resulting from the breaches of your third-party suppliers.
Network Security/Privacy coverage is a relatively “new” insurance product in the marketplace. You may want to consider making it a requirement for any service provider who has access to your customers’ private information. Without analyzing the CGL wordings of your service provider you may not know if there is coverage or if there is a total exclusion. In the event of a privacy breach, it is important to ensure your service provider’s coverage also extends to cover your expenses related to the notification and credit monitoring for your customers. It should also extend coverage for your crisis management or reputational damage control expenses, should your service provider experience a breach related to your customer data.
Ultimately you are responsible to your customers so make sure that proper practices and controls are in place for both your company and your services providers. MEARIE’s Privacy, Cyber and Network Security Liability endorsement covers your organization’s liability; not your vendor’s.
|
Coming in 2012 watch for a Cyber Security Planning Guide, a self administered tool to help you in the analysis of your potential exposures. |
Does your company have a hot water tank program? MEARIE previously issued a bulletin on this topic discussing how you, as owner of the tanks, are responsible for any damage resulting from a failure. There has been a recent appeals court case illustrating this point. On December
7, 2011 the Ontario Divisional court released a decision on two appeals involving Reliance Home Comfort and leased hot water tanks.
The case sited involved two appeals that both described property damage caused by the failure of leased hot water tanks. In each case the hot water tank, located in the homeowner’s basement, developed a leak which resulted in damage to the home and contents. In one case the hot water heater was 10 years old; in the other case, 19 years. The defendant argued that, due
to the age of the leases, the warranty no longer could apply, but in both cases the appeals were denied. The court decision ruled that “a lessor... has an obligation to supply a safe and properly functioning product in each and every lease payment period, and will be liable for loss or damage resulting from a breach of that obligation, regardless of how far into the lease term that might occur. The decision stands for the proposition that, unless the contract provides otherwise (and is capable of so providing), those implied warranties will be effective throughout the term of the lease, regardless of how long a time has passed since the start of the lease, and not just during some relatively short period of time after that start date.”1
This case serves to illustrate how the owner of leased hot water tanks is always responsible to the leaseholder, regardless of the age or condition of the tank in question. If you provide hot water tank rentals, review you Policies and Procedures related to hot water tank rentals to see if you may reduce your exposure. For details on this specific ruling, click here: http://www.mccagueborlack.com/emails/articles/reliance.html
|
Update on the MEARIE Privacy, Cyber and Network Security Endorsement |
|
The MEARIE Group’s Reciprocal News is an electronic publication intended for Subscribers of The MEARIE Group’s Insurance programs. It is published on a periodic basis and is intended for information purposes only. In the event of specific claims, incidents or legal actions against the Subscriber, coverage will be determined by MEARIE policy interpretation. |