Laridae v Co-Operators, 2020 ONSC 2198
This is one of Canada’s first decisions to consider insurers’ duty to defend insured companies against lawsuits involving data breaches.
Family and Children Services of Lanark, Leeds and Grenville (“FCS”) retained Laridae Communications Inc. to update their website and advise them on issues relating to its design and security.
In 2016, an unauthorized party accessed documents from a secured section of FCS’s website. The unauthorized party downloaded documents containing personal information about 285 people who were subjects of FCS investigations. The documents were subsequently released on the internet.
The victims whose information had been released brought a class action lawsuit against FCS alleging breaches of their privacy rights. The claim alleges that the leaking of class members’ personal information was caused by FCS’s failure to properly secure its website.
FCS commenced a third-party claim against Laridae for negligence and breach of contract.
Both Laridae and FCS applied to Cooperators for coverage pursuant to Laridae’s CGL policy. FCS was an additional insured under the policy. However, Cooperators denied coverage based on “data exclusion” provisions which excluded liability “arising out of the distribution or display of data by means of an Internet Website, the Internet, an intranet, extranet, or similar device or system designed or intended for electronic communication of data.”
The Ontario Superior Court declared that Co-operators must defend Laridae in the Third-Party Claim and FCS in the Class Proceeding. The Court found that Co-Operators had not discharged its onus of establishing that the substance of the claims clearly fell within the data exclusion clauses and that there was no possibility of coverage under the policies. The claims included, for example, allegations related to physical, non-electronic, distribution of the private information.
You can read Laridae v Co-Operators, 2020 ONSC 2198 in its entirety here.
