What it does
The 12 23 edition (titled "Exclusion – Access Or Disclosure Of Confidential Or Personal Material Or Information") adds Coverage A and Coverage B exclusions for injury or damage arising out of any access to or disclosure of any person's or organization's confidential or personal material or information, including patents, trade secrets, processing methods, customer lists, financial and credit card information, health information, biometric information and any other nonpublic material or information. It applies even if damages are claimed for notification, credit or identity monitoring, forensic, public relations, data restoration or extortion expenses.
The 05 14 edition was titled "Exclusion – Access Or Disclosure Of Confidential Or Personal Information And Data-Related Liability – With Limited Bodily Injury Exception". It replaced Coverage A exclusion 2.p. with an exclusion for access or disclosure and for loss of electronic data, kept coverage for bodily injury from loss of electronic data, and added a Coverage B access or disclosure exclusion. The 12 23 edition no longer contains the electronic data wording and expressly names biometric information.
Who needs it
All businesses that collect customer, patient or employee data: retailers, restaurants, healthcare, professional services, property managers, and employers using biometric timeclocks.
Key provisions and limits
- Coverage B privacy claims tied to disclosed information are excluded along with Coverage A.
- Biometric information is named in the 12 23 edition, which matters for biometric privacy statute suits.
Quoting and selling notes
- Sell stand-alone cyber or privacy liability; this exclusion means the CGL will not respond to breach or biometric privacy claims.
- The 05 14 edition retained only in a few jurisdictions after the 12 23 revision.
- Related: CG 21 07 (05 14, no bodily injury exception), CG 21 08 (Coverage B only), CG 40 35 (cyber incident exclusion).
Selling cyber
- With this exclusion, data breach costs, privacy claims and identity theft suits fall to a cyber policy; most small businesses lack one.
- Ask about card payments, customer and employee records, biometric timeclocks and health information.
- Biometric privacy statute claims can carry statutory damages per violation; check that the cyber policy does not exclude them.
- The 12 23 edition is part of a data and cyber package with CG 00 69 (violation of data privacy laws) and CG 40 35 (cyber incident); check which of these appear on each quote.
