Electronic Data Liability: What Small Businesses Need to Know
Electronic Data Isn't Tangible Property
Does your business perform work on customers' premises? If so, you could inadvertently cause an accident that damages a customer's electronic data. If the customer sues you for the cost of replacing or restoring the data, the claim will likely be excluded by your business liability policy. Fortunately, you can buy back some coverage for data-related claims via a standard endorsement.
What Is the Electronic Data Exclusion?
Most general liability policies contain an "Electronic Data" exclusion under Bodily Injury and Property Damage Liability. The exclusion eliminates coverage for damages arising from any of the following:
- Loss of electronic data
- Loss of use of data
- Damage to or corruption of data
- Inability to access or manipulate data
The electronic data exclusion is very broad. It eliminates coverage for virtually any third-party property damage claim involving electronic data.
Examples of Excluded Claims
The Electronic Data exclusion eliminates coverage for most claims or suits that arise from loss or damage to data. Here are some examples.
- A landscaping worker is planting trees at an office complex when he accidentally cuts a fiber optic cable, causing the tenants to lose their internet connection for two days. The tenants subsequently sue the landscaping firm for the income they lost during the outage.
- A dental office hires a billing company to handle insurance claims and patient billings. A billing service employee inadvertently sends an email infected with ransomware to the dental office. The dental practice suffers a ransomware attack and then sues the billing service for the cost of the ransom it paid to regain access to its files.
- A worker employed by an electrical contractor is installing new equipment in a legal office when he accidentally causes a power surge. The surge damages two computer hard drives, causing the law firm to lose hundreds of important files. The law firm sues the electrician for the cost to restore the lost data.
The Electronic Data exclusion contains one exception. Coverage is provided for damages that result from bodily injury. That is, if you accidentally lose, damage, or corrupt someone else's data, and the incident results in injury to a third party, the injury should be covered. For example, in the third scenario cited above, suppose the power surge injures one of the attorneys. If the attorney sues the electrician for bodily injury, the claim should be covered by the electrical contractor's general liability policy.
General liability policies do not cover claims arising from data breaches. You can protect your business from claims stemming from security breaches and other negligent acts by purchasing cyber liability insurance.
Damage to Data Isn't Property Damage
If the electronic data exclusion didn't exist, would your liability policy cover property damage claims involving electronic data? The answer is likely no. Property damage is a defined term in the standard general liability policy, and it means damage to tangible property. The definition clearly states that electronic data is not tangible property. Consequently, the policy wouldn't cover claims resulting from damage to electronic data even if it didn't contain an electronic data exclusion.
Electronic Data Liability Endorsement
Liability policyholders can buy back some coverage for data losses by purchasing the Electronic Data Liability endorsement. When the endorsement is added to the policy, the electronic data exclusion applies only to data losses that don't result from physical injury to tangible property. That is, the policy covers loss, damage, or corruption of data that results from physical injury to tangible property.
Electronic Data Liability insurance is available via a standard Insurance Services Office (ISO) endorsement for an additional premium.
In the examples of excluded claims described above, the first scenario involved office tenants who lost access to their data after a landscaping employee accidentally cut a cable. The loss of data resulted from physical injury to tangible property (the cable). If the landscaping firm's liability policy includes the Electronic Data Liability endorsement, it should cover the tenants' claims.
The second scenario involved a lawsuit by a dental office to recover the cost of a ransomware attack. Because the dental office did not sustain any property damage, its claim against the billing company would not be covered by the Electronic Data Liability endorsement. The billing firm can protect itself against claims stemming from ransomware and other types of data losses by purchasing a cyber liability policy.
In the third example, an electrical worker caused physical damage (by an electrical surge) to tangible property (the law firm's hard drives). If the electrical contractor's liability policy includes the Electronic Data Liability endorsement, it should cover the law firm's data loss claim.