What it does
CG 00 69 12 23 is ISO's Exclusion – Violation Of Law Addressing Data Privacy. ISO introduced it with the 12 23 data and cyber forms (filing GL-2023-OFOFR), approved in most states effective December 1, 2023.
It is part of the same package as the revised access or disclosure exclusion (CG 21 06 12 23) and the cyber incident exclusion (CG 40 35), and, as its title indicates, addresses claims based on violations of laws that govern data privacy, such as biometric and consumer data privacy statutes.
Who needs it
Businesses exposed to class actions under privacy statutes: employers with fingerprint or face-scan timeclocks, retailers, apps and websites, healthcare providers.
Key provisions and limits
- Works together with CG 21 06 12 23 and the recording and distribution exclusion built into the coverage form.
Quoting and selling notes
- Privacy statute class actions need cyber or privacy liability coverage; check that the cyber policy does not exclude biometric or statutory privacy claims.
