1. Page 1 Recording of this session via any media type is strictly prohibited. Edward M. Joyce Partner Jones Day Invasion of Privacy, Hacking & IP Claims: Are You Covered?

2. Page 2 Recording of this session via any media type is strictly prohibited. The views expressed by the speakers are not those of the speaker’s employer, firm, clients, or any other organization. The views expressed by the speakers are not those of the speaker’s employer, firm, clients, or any other organization. The opinions expressed do not constitute legal or risk management advice. The opinions expressed do not constitute legal or risk management advice. The views discussed are for educational purposes only, and provided only for use during this session.

3. Page 3 Recording of this session via any media type is strictly prohibited. A Public Relations Nightmare Data breaches become public Target & Neiman Marcus (Dec 2013/Jan 2014) Barnes & Noble (Oct 2012) Global Payments (Mar 2012) - $84 Million Zappos (Jan 2012) Sony’s Playstation Network (Apr 2012) State attorneys general publicize breaches online Privacy advocates track and publicize breaches Litigation

4. Page 4 Recording of this session via any media type is strictly prohibited. Coverage for Responding to a Data Breach Property Insurance Crime Insurance/Fidelity Bond Cyber Liability/Data Breach Policies

5. Page 5 Recording of this session via any media type is strictly prohibited. The Lawsuits that (Inevitably?) Follow Data Breach/Invasion of Privacy Invasion of privacy Negligence and other tort claims Breach of contract Enforcement actions by federal regulators Actions by State Attorneys General Can result in (1) substantial defense costs; and (2) possible damages/settlements. 5

6. Page 6 Recording of this session via any media type is strictly prohibited. Coverage for the Follow-on Lawsuits re Data Breach/Invasion of Privacy Commercial General Liability (CGL) Errors and Omissions (E&O) Liability Directors and Officers (D&O) Liability Cyber Liability/Data Breach Policies

7. Page 7 Recording of this session via any media type is strictly prohibited. Insurance Policy Conditions Traps to Avoid “Notice is not like wine, it does not get better with age!”

8. Page 8 Recording of this session via any media type is strictly prohibited. Traps to Avoid First Party Property Policies Notice of loss Proof of loss When and how? At the Company’s request? Partial Proof/interim payment Suit limitation clause Tolling agreement/waiver

9. Page 9 Recording of this session via any media type is strictly prohibited. Traps to Avoid - Liability Policies Notice Give notice as soon as practicable v. immediately; but give notice of what? Notice of claim/notice of circumstances to lock in a specific policy period (typically claims made policies) Cooperation Clause/Claims Management What should you be sending the insurer? Insurance Company Consent/Approval For expenses, defense costs and settlements Is it in writing?

10. Page 10 Recording of this session via any media type is strictly prohibited. What Triggers the First Party Property Policies for Data Breaches? First Party Property Policies Direct physical loss of or damage to property Exclusions: computer data -- in or out? Date of discovery -- Crime Insurance/Fidelity Bond Recent 6th Circuit decision in DSW Inc. (Aug 2012)

11. Page 11 Recording of this session via any media type is strictly prohibited. What Triggers the Liability Policies for Data Breach/Invasion of Privacy Claims? CGL Policies Bodily Injury and Property Damage Personal and Advertising Injury “Oral or written publication, in any manner, of material that violates a person's right of privacy” Covered Offense Invasion of Privacy During the Policy Period Publication

12. Page 12 Recording of this session via any media type is strictly prohibited. What Triggers the Liability Policies for Data Breach/Invasion of Privacy Claims? Claims-Made Policies D&O, E&O/Professional Liability Breadth of your D&O entity coverage Private company v. public company: what are the differences?

13. Page 13 Recording of this session via any media type is strictly prohibited. What Triggers the Liability Policies for Data Breach/Invasion of Privacy Claims? Claims-Made Policies (cont.) Breadth of "Claim" definition - What is included? FTC action/proceeding? What kind? Subpoena? Investigations? "Wrongful Act" definition -- error, omission and/or act; does it need to be negligent? "Loss" Definition -- does the definition list specific ins and outs?

14. Page 14 Recording of this session via any media type is strictly prohibited. What Triggers the Liability Policies for Data Breach/Invasion of Privacy Claims? Claims-Made Policies (cont.) Breadth of exclusions -- willful, malicious and/or criminal acts? Whose willful, malicious and/or criminal acts? Interrelated claims/interrelated wrongful acts -- Where does this claim go? Whose policy is up? Tension between interrelated claims/wrongful acts, “Claim” definition, exclusions and notice

15. Page 15 Recording of this session via any media type is strictly prohibited. Questions?

16. Page 16 Recording of this session via any media type is strictly prohibited. Edward M. Joyce Partner Jones Day Invasion of Privacy, Hacking & IP Claims: Are You Covered?