The loss of personal data creates many problems for those responsible to protect it.  The Connecticut Supreme Court decided – insurance does not have to pay notification expenses where there was no  proof that anyone used the missing data.  Recall Total Information Management v Federal Insurance CT Supreme Court (2015)

FACTS Personal data of 500,000 IBM employees, on physical tapes, fell off a truck that was moving those tapes to storage.  The tapes went missing but there was no proof anyone ever accessed or used the data.  IBM spent $6M notifying its employees and guarding against identity theft. IBM demanded that the transport company recoup the expenses. The transport company notified its insurer, who refused to take part, saying there was no coverage. The transport company sued its insurer for refusing to defend it or to join the settlement.

ISSUE When costs from responding to lost personal data are incurred must a General Liability insurer respond?

HOLDING  No duty to defend where there is no coverage, no duty to join settlement talks either.

REASONS Since there was no proof showing the lost data was ever accessed, there was no personal injury as the insurance policy defined it.  The policy excluded coverage for “intangible property” so there was  no property damage loss either.  Just because laws require notification and protection for people whose data is lost, that does not mean insurers have to pay, they pay only for what the policy defines as personal injury or property damage.