Recent Seventh Circuit Decision Illustrates Legal Pitfalls to Individuals Who Lose Personal Information
The risks associated with loss of sensitive personal information are (or should be) well-known to companies that routinely handle such information. But the risks to individuals employed by such companies must be considered as well. These risks were brought to the forefront in a recent opinion from the U.S. Court of Appeals for the Seventh Circuit. In Nationwide Ins. Co. v. Central Laborers’ Pension Fund, 2013 U.S. App. LEXIS 721 (7th Cir. Jan. 11, 2013), the court affirmed a ruling that an insurer had no duty to cover an employee’s loss of personal information.
The case presented a rather unsurprising data-loss scenario. An accounting firm’s employee left a laptop—with a compact disc inside containing the Pension Fund’s participants’ and beneficiaries’ personal information (names, birthdates, social security numbers)—inside her car. The laptop was stolen while the car was parked outside the employee’s home.
The Pension Fund sued the employee in Illinois state court seeking to recover the credit monitoring and insurance expenses it incurred due to the loss. (The opinion notes the Pension Fund also sought recovery from the accounting firm). The employee tendered the claim to Nationwide, which had written her homeowner’s insurance policy.
Nationwide then brought a federal diversity action seeking a declaration that it had no duty to defend or indemnify the employee. Nationwide argued that two exclusions applied. First, the policy excluded damage to property in the insured’s care. Second, the policy excluded property damage in connection with business conducted by an insured.
The district court granted summary judgment for Nationwide, and the Seventh Circuit affirmed. Because the CD was within the employee’s exclusive possession, the “in care of” exclusion applied. The business exclusion also applied. The Court found the employee’s accounting firm was no doubt a “business,” and the employee had a duty to safeguard the confidential information because she was acting as an accountant employed by the firm. The employee’s breach therefore directly correlated to a breach of her duties to the firm.
This decision aptly illustrates the risks of personal exposure attendant to data breaches. Although the Pension Fund pursued the accounting firm, it clearly did not hesitate to pursue the employee directly. Insurance was obviously a motivating factor (the Pension Fund itself appealed the district court ruling), but regardless the data loss and resulting lawsuit no doubt caused the employee significant expense. This decision is also a reminder that most homeowners’ insurance policies (which frequently include exclusions similar to those discussed here) will likely not cover data losses like that involved here. Safeguarding personal information is critical, not only to the business involved but to the individual employees entrusted with such data. And leaving a laptop in a car is never a good idea.
If you would like more information, please contact your Lathrop Gage attorney or one of the attorneys listed on this alert.