Duty-to-defend analysis of insurer’s data exclusion clause can be interpreted on application: Court

The Court of Appeal has ruled that an insurance provider has no duty to defend two customers in lawsuits which stemmed from a data hack because of data exclusion clauses in their policies.

“It's the first decision in Canada, that we're aware of, that involves a data exclusion. But it does not in any way change the duty-to-defend analysis set out by the Supreme Court,” says Danielle Marks, who represented the successful appellant, Co-operators General Insurance Company.

In May 2020, on applications to interpret the policies under Rule 14.05(3)(d) of the Ontario Rules of Civil Procedure, Superior Court Justice Andra Pollak found that Co-operator’s data exclusion clause was a “novel interpretation issue” and it would be “improper” to deny a duty to defend on an application.

The Family and Children’s Service of Lanark, Leeds and Grenville (FCS) and Laridae Communications Inc. were both being sued because of a data hack. FCS faced a class action from clients and others and had brought a claim against Laridae, which the former had hired for communications and marketing services. Pollak found the data exclusion clause did not release the insurer from its duty to provide for the legal defences of both parties.

But in a decision announced March 15, Court of Appeal Justices Alexandra Hoy, David Brown and Julie Thorburn allowed the appeal. The Court said the duty-to-defend issue could be resolved by application and that Co-operators did not have one in either lawsuit. 

Had the Court of Appeal allowed the Superior Court’s ruling to stand, it would have “vitiated” the duty-to-defend analysis and replaced it with a duty-to-indemnify analysis on trial, says Marks. This would have produced delays because if an insured alleged an exclusion clause nullified a primary grant of coverage or that the exclusion was novel, a full trial would have been required, she says.

“Procedurally, it's critical that the Court of Appeal has now made it absolutely clear that declining the analysis is not an option,” says Marks. “The court has reminded Both litigants and lower courts of the process set out by the Supreme Court. And as part of that, of the importance in the interpretation of looking at the substance and true nature of the allegations in the claim.”

“’What does the case really allege?’ and ‘What does the policy really say?’ It's a strong suggestion that we focus back on those two main issues, and that you're supposed to proceed with the analysis accordingly,” says Robert Dowhan, who also acted for Co-operators. Both Marks and Dowhan are partners at the Guelph office of SmithValeriote Law Firm LLP.

In 2015, FCS put together a confidential statistical report which included personal information on 285 clients and subjects of FCS investigations. They stored the report in a secured portal which was intended only to be accessible to FCS’s board of directors.

In April 2016, the report appeared on two public Facebook pages. Later that year, FCS and its executive director were hit with a class action seeking $75 million in damages for negligence, intrusion upon seclusion and s. 7 Charter breach.

FCS had contracted Laridae to work on their website, communications platforms and infrastructure; to develop communications protocols and train staff to enhance internal and external communication. FCS said Laridae had assured them they had enhanced the security of FCS’s website, allowing FCS to upload private documents for authorized users. FCS brought a third-party claim against Laridae, accusing the company of negligence and breaching contractual obligations. FCS is seeking damages and contribution and indemnity for liability arising out of the class action against them.

Co-operators insured Laridae under both a commercial general liability policy and a professional liability policy. FCS requested Co-operators defend and indemnify it in the class action and Laridae requested defence and indemnification in the third-party claim. Co-operators denied both, pointing to an exclusion in its policies for personal injury arising from distribution and display of data.

Both FCS and Laridae brought applications to the Superior Court, seeking declarations that Co-operators had a duty to defend. Co-operators sought a declaration of the opposite.

Justice Pollak held that whether Co-operators could evade their duty to defend via the data-exclusion clauses was an issue too important to be handled on an application. The onus was on Co-operators to show the substance behind the claims against FCS and Laridae clearly fell within the data exclusion clauses, which Pollak found the insurer had failed to establish. She found Co-operators owed a duty to defend FCS and Laridae.

The Court of Appeal found Pollak erred in finding it improper to deny the duty to defend with the materials before her, ruling Co-operators owed no duty to defend FCS or Laridae. The Court said the clauses were unambiguous, all claims were covered by the clause’s clear language and denial of coverage would not nullify the policy.