Likely Changes to Oregon Data Breach Law Should Prompt Review of Cyber Coverage

This excellent post by my colleague Brian Sniffen in our firm's IP Law Trends blog reports on the efforts by Oregon's attorney to strengthen the state's data breach notification laws.   The proposed amendments to the Oregon Consumer Identity Theft Protection Act (ORS 646A.602 et seq.) are part of Senate Bill 601, which is making its way through the legislature right now.  You can follow the bill's progress here).

As Brian reports, among the proposed changes are a lowering of the threshold for notification to the Attorney General to 100 records; expansion of the definition of confidential data to include medical and biometric information; and giving enforcement power to the Attorney General under the Unfair Trade Practices Act.

As we observed last week in our post about the insurance implications of Washington's effort to toughen its data-breach notification laws, these proposed Oregon changes should prompt every business -- whether it handles loads of consumer data or not -- to review its cyber insurance coverage to get a comfort level with any sub-limits relating to notification costs, and liability coverage for regulatory claims.  Of course, both state-level efforts could be upended if the President's proposed data-breach bill becomes federal law, because the federal law will likely trump all state laws.  All the more reason to review your cyber coverage with an insurance professional today.

Update April 22: The Oregon bill has received a "do pass" recommendation, with some amendments, from the Senate Judiciary Committee, and is awaiting transfer to the floor for passage.

Washington Policyholders, Check Your Cyber Policy as Data BreachNotification Law Moves Forward

Washington has moved a step closer to bringing its data-breach notification law in line with the laws of many states (including Oregon) that require notification in the majority of scenarios, closing what some viewed as loopholes in the law and mandating notification within 45 days, rather than the prior "as soon as possible" requirement.  (Oregon law still lacks a specific presumptive deadline).  In particular, the new Washington bill removes the exemption for lost or stolen data that is "encrypted," in recognition of the fact that "encryption" can fail if the technology used was old or if the encryption key was also stolen.  The Washington bill has passed the House and it set for hearings in the Senate later this week, and is expected to pass.

What does this mean from an insurance standpoint?  Cyber insurance policies typically provide "first-party" coverage for the costs of data breach notification, but often contain very low sub-limits on that coverage.  In a state like Washington with a weak data breach notification law a business could in theory get away with a low sub-limit because only in a rare set circumstances would broad-based notification be required.  That will no longer be the case and so those sub-limits, and any other restrictions placed on notification coverage, need to be re-examined.  And of course if your business lacks cyber coverage entirely, it is time to explore your options.  The most recent data on the cost of data breaches indicates that the cost of notification is the fourth-biggest category of impact from a data breach (after lost reputation; lost time/productivity; cost of new technology).  By comparison the cost of regulatory fines and lawsuits was tenth in the ranking of impacts on businesses experiencing a breach.   The conventional wisdom is that a business should expect to spend at least $188 per record  on notification and similar first-party response-related costs.  With the number of records routinely stored by businesses, particularly those in the online retail or cloud computing sector, it is easy to see why low sub-limits could be a huge problem if a breach occurs.  So check your policies, and call your insurance advisers, to get ahead of these changes in the law in Washington.

ps.  Speaking of Washington, not 48 hours after news broke this week of a major data breach at Premera in Washington a class action was filed. But the cause of action -- breach of contract -- may cause coverage problems. The liability portions of cyber policies often exclude breach of contract actions. One more reason to check those policies.

Update April 22: The bill has passed and is now awaiting signature by the Governor.

Policyholder Counsel Should Welcome Changes to Proposed Revisions to FRCPs - But Still Push For Rejection

The Advisory Committee on Civil Rules recommends changes to the Federal Rules of Civil Procedure to the federal Judicial Conference.  For several years that body has been debating proposals to curb perceived discovery abuses (particularly in the area of e-discovery sanctions) and to bring down the cost of discovery in civil litigation overall.  On the discovery side, initial drafts of the proposed amendments included changes to the presumptive number of interrogatories, requests for admission, number of depositions, and the length of depositions.

As reported in various places incuding the K&L Gates' e-discovery blog the committee, which is having a final meeting on these rules here in Portland starting tomorrow, has largely dropped these proposals following significant opposition from many quarters including comments by law professors and various segments of the bar.  However, the committee is still promoting a dramatic change to Rule 26's foundational rule on the scope of discovery which would put the burden on the requesting party to justify discovery requests as being "proportional" to the case.  As articulated in comments  by policyholder counsel, this change will disadvantage businesses (and individuals) in litigation with insurance companies, where it is usually the "little guy" (the policyholder) who is trying to penetrate layer upon layer of insurance company bureaucracy to find the truth.  This often requires multiple rounds of discovery requests, multiple depositions and a lot of other types of digging.

So while it is good news that the committee has withdrawn the changes on discovery tools, the overall proposed change to Rule 26 is still cause for concern.  Unfortunately, opportunities for public input are limited after this point - the issue may become fodder for an unusual public fight in the Congress over the federal rules.

Oregon Bill That Would Assist Insurers In "Lost-Policy" Battles Dies

Those of us in the coverage game who deal with "long-tail" claims -- that is, claims under older occurrence-based policies -- routinely have to deal with a common problem: the policies are gone.  Businesses destroy old records, change hands, have a flood, etc., and the old insurance policies are gone.  Professional records managers are now trained to keep insurance policies forever and many have digitized their insurance archives.  But for those without such an archive the "lost-policy" battle with the insurance company (and often multiple carriers) can turn into a real bruiser.

This year the insurance industry proposed an innocuous-seeming bill in the Oregon legislature that would have permitted insurance companies to unilaterally cease sending the full copy of a new insurance policy to the policyholder, instead giving the policyholder a link to the policy forms hosted on the carrier's website.  The bill would have only required the carrier to keep the link live for the term of the policy, and would have only required the policy to be archived for ten years.  This bill appeared to have been part of a nationwide push by industry to save money, and trees (a laudable goal), by delivering policies electronically.  The difference in the Oregon bill, however, was that it did not permit policyholders to choose not to participate in the new scheme - every other piece of legislation that I could find required the policyholder to "opt in" before the carrier was excused from doing things the "old-fashioned" way.

I penned a letter to the chair of a Senate committee hearing this bill, available here, and testified against the bill.  More detail on the problems that I saw with the bill, and in particular the further leg-up that it would give insurers in future lost-policy battles, is in the letter.  The bill stalled in committee and died with the end of the short session.

This is a good example of how even small, seemingly insignificant, and possibly well-intentioned changes to the insurance code can have unforeseen repercussions in insurance coverage disputes.  Hopefully now that the policyholder bar is a bit more organized we can engage the industry on every change, not just the big ones.

Implementation of Environmental Coverage Claims Mediation Program Underway

The recent amendments to Oregon's Environmental Cleanup Assistance Act (OECAA) included a potentially useful tool in the policyholder toolbox - one that could benefit all sides and the environment as well.  The amendments provided that an insured could demand that an insurer participate in a mediation over a broad range of environmental coverage disputes, and if the insurer refuses, that is a per se bad faith claims handling practice subjecting the carrier to increased damages.  The Oregon Department of Justice was given the responsibility for creating an environmental coverage mediation program including hiring a mediation service provider (MSP) to administer the program and writing regulations governing issues like qualifications and rates.  DOJ convened a public meeting of stakeholders this past Monday, December 2, in Salem, which was attended by insurers, policyholder advocates, and many representatives of the mediation community.  DOJ has also set up a website for the program which will track its progress.  There are a number of issues under discussion.  Let me know if you have thoughts that you'd like conveyed through the Advisory Committee that is being set up, and stay tuned.

Trial Court Rejects Constitutional Challenge to New Provisions of OECAA

Today the trial court judge in the long-running environmental coverage contribution battle between Lloyd's and several other carriers for Zidell Marine rejected a constitutional challenge mounted by Lloyd's to one of the newest provisions of the Oregon Environmental Cleanup Assistance Act (OECAA).  This case has had many zigs and zags but to briefly sum up, Zidell sued its carriers for failing to defend it in a cleanup action brought by the state, both for defense costs and for the cost of the cleanup.  Several of the carriers including Beneficial settled with Zidell.  Lloyd's did not.  Lloyd's later was tagged in the coverage action (which itself has gone on for years with multiple trips up the appellate chain) for millions of dollars; Lloyd's then sued Beneficial and others arguing that those carriers did not contribute to the overall "pie" in proportion to their coverage.  In June of this year new amendments to the OECAA went into effect.  One provision of the amendments provides that a carrier that has settled with a policyholder in "good faith" is protected from a contribution suit by other, non-settling carriers.  Beneficial and the other defendants in the Lloyd's contribution case filed a motion to dismiss arguing that under that new provision, Lloyd's has no cause of action.  Lloyd's in turn argued, among other things, that a) the statute does not apply if there has been a "final judgment" in the underlying coverage case; b) the statute is unconstitutional; c) there are questions of fact about whether the Beneficial et al. settlements were in "good faith."  In today's decision the trial court held that there has been no "final judgment" in the coverage case between Zidell and Lloyd's, meaning that the statute applies, and rejected the constitutional argument.  She held, however, that there are some questions of fact and allowed discovery into whether the settlements were in good faith.  More appeals appear inevitable, so stay tuned.  However, this appears to be the first enforcement by a trial court of the new provisions of the OECAA, and the first rejection of a constitutional challenge to one of the new provisions, and it's certainly notable for that alone.

Associated Oregon Industries Fails to Mention Opposition to HB 3160 In Legislative Recap

Perhaps there's an entirely innocuous explanation as I'm sure that AOI opposes many bills each session, but I found it notable that AOI's blog posting on the legislative session does not mention its opposition to HB 3160.  That bill would have provided businesses (and individuals) with a private right of action against insurance companies for unfair claims handling practices, creating a dramatic disincentive for the current practice (by liability insurers, in particular) of denying a claim first, then seeing if the insured has the wherewithal to hire an attorney to press the claim, and then if necessary "reconsidering" and accepting the claim- risk free, because there is no penalty in the current law for taking this "free breach" approach.  AOI came out against the bill reportedly at the instance of some big players in the group including Liberty Mutual and The Standard.  However, I'd wager a pint of your favorite local microbrew that the average AOI member had more to gain from HB 3160 than to lose.  Putting on my conspiracy theory hat (an occupational hazard of someone who litigates against big insurance companies for a living), perhaps that has something to do with the omission of HB 3160 from this update.


'via Blog this'

Oregon House Passes SB 414 Giving Insurance Commissioner Greater Authority

A significant win for individual consumers in the often frustrating and never fair battle for coverage, it remains to be seen whether these new powers granted
to the Commissioner will assist commercial lines consumers.    "6.28.13: House" http://feedly.com/k/127kunW

Senate Passes SB 414, Giving Oregon Insurance Commissioner Power to Order Restitution

Congratulations to Sen. Shields and his allies for getting this through.  Somewhat bittersweet, as I've reported before.  The need for a bad faith cause of action or direct right action under the Claims Handling statute was brought home yet again for me today when I heard this story: a single-family homebuilder in Dallas was sued by a disgruntled customer, tendered to his insurance company which initially accepted the defense but then yanked the defense (and even tried to prevent the builder from continuing on with the same lawyer) after it hired coverage counsel who advised the insurer not to defend based on a grossly unfair contortion of the allegations against the builder as being excluded, in violation of every precept of Oregon law culminating with the Bresee decision that I blogged about earlier.  Builder had to settle the claim with his own money and then find a lawyer to sue the insurance company, which is (amazingly) still contending that it did nothing wrong.  Fortunately a good friend was willing to take it on contingency.  A perfect example of the "free breach" thinking that carriers in Oregon employ to try to keep as much of their customers' premiums as they can without having to provide coverage.

Senate votes to hold insurance companies accountable through increased agency authority:

'via Blog this'

Oregon Supreme Court's Bresee Decision Makes the "Headlines"

The good folks at the large national firm Farella Braun posted this excellent summary of the Oregon Supreme Court's late-2012 decision in Bresee v. Farmers Insurance Exchange.  In Bresee the court made it clear that an insurer's decision to provide a defense under a liability policy must be based on only the words of the underlying complaint or other charging document itself, and that any ambiguity -- any ambiguity, including one created by the lack of specific allegations -- is construed in favor of providing the defense.  In that specific case the insurance company denied a defense based on a "completed operations" exclusion based on the insurance company's interpretation of the underlying complaint, which is said indicated that the property damage had occurred after "operations" were "complete."  As Farella's blog post points out, the court's admonition to insurance carriers that they cannot use such "reading between the lines" to deny a defense is a straightforward proposition - so straightforward, in fact, that most states permit a policyholder who is denied a defense to seek punitive or exemplary damages, via a bad faith claim, to deter insurance companies from the practice.  Unfortunately, unless HB 3160 or something like it passes, insurance companies will continue to ignore Bresee and its forebears (which they do, every day) because even though it is a clear-cut breach of their obligations to policyholders, in Oregon insurers get a "free breach," as I explained in my recent letter to Senator Betsy Johnson in support of HB 3160/the SB 414-A amendment.

Vote on SB 414, Permitting Insurance Commission to Order Restitution, Set for Today

Whether this bill will be useful to small business remains to be seen, but it is certainly a step in the right direction. However, as the "preferred alternative" by the insurance industry to real insurance claims handling reform, one has to assume that the industry will exert its pressure to keep the benefits of this change in the law restricted to consumers, who may remain unaware of the availability of recourse to the state's complaint process.

K-12 budget meltdown, wine and beer: Oregon Legislature today | OregonLive.com:

'via Blog this'

A Nice Summary of How Insurance Reform In Oregon Has Fared This Legislative Session

The Lund Report has a great piece today recapping how it came to be that SB 414 and SB 814 moved through the Legislature while HB 3160 has stalled, again.  It continues to be painful to see how successfully the insurance industry has distorted the issues and the relationship between a private right of action and the regulatory oversight exercised by the Insurance Commission.  As my former colleague Jim Guse of Ball Janik points out in this piece, Washington's bad faith law has had the entirely salutary effect of shortening the time in which claims are paid, and removing the incentive that carriers now have in Oregon to "roll the dice" on coverage litigation, exposing their small business insureds (in liability cases) to potentially disastrous consequences - including unpaid judgments, which for a contractor can mean the loss of a license.

Shields Pushes to Empower DCBS as Effort to Put Insurance Under UTPA Flounders | The Lund Report:

'via Blog this'

Insurance Industry Invests Heavily in Defeating Bad Faith Legislation

HB 3160, which among other things would give small business owners a private right of action against insurance companies for violating the state Unfair Claims Settlement Practices Statute, is still alive as the legislative session draws nearer its close, and the insurance industry and those that might be held to account under the bill continue to invest heavily in lobbying efforts to make sure that it again does not make it to the floor.  Among the canards that the industry continues to throw out there is that this is 'radical' reform, but failing to note that most states have some version of this kind of private right of action, or some other bad faith right of action, under state law.  I recently worked on a survey of bad faith law in the Pacific Northwest as my firm continues to expand its practice base, and was dismayed to note that Oregon lags behind even conservative states like Montana and Idaho in giving small business owners the leverage that they need, through a potential bad faith claim, to get insurance companies to step up when the going gets rough.  My Father's Day wish?  That the legislators currently on the fence, including Sen. Betsy Johnson, realize that this bill is not about enriching "tort lawyers" but is about bringing the insurance code into the modern era to protect ordinary Oregonians, including Oregon's small business owners.


Dozens of lobbyists tie up bill to let consumers sue insurance companies | OregonLive.com:

'via  Blog this'

Letter to Sen. Johnson Supporting SB414 - Small Business Needs Protection Beyond Environmental Claims

Here is the letter that I just sent to Senator Betsy Johnson urging her to support SB414, which has a work session scheduled for today.  In it I describe the experience of my client Anderson Brothers, Inc. with its attempt to get its insurance company to help defend it against an environmental claim, and explain that although the SB814 amendment to the OECAA was great work, most coverage problems faced by small business are not covered by the OECAA, and that SB414 would therefore help level the tremendously un-level playing field in Oregon.

Oregon Insurance Reform Champions Continue to Press for Broader Change

Champions of changes to the insurance code that would benefit policyholders, both commercial and individual, are not giving up hope on the idea behind HB3160, which was to remove the exemption of insurance companies from the Oregon Unfair Trade Practices act.  One key component of that effort was to enact a private right of action for violations of Oregon's Unfair Claims Settlement  Practices Act (UCSPA).  At this point the consumer protections in that law are only enforceable by the Insurance Division, which does not have the resources to act on every instance of insurer misbehavior, and has limited ability to make consumers whole.  The insurance industry howled at the idea of being subject to the Unfair Trade Practices Act, so legislators are now proposing a more focused amendment to the UCSPA in SB 414, available here.  While not perfect, this legislation would be a broad-based improvement that would help level the incredibly uneven playing field that Oregon's small businesses now must play on to get their insurance companies to honor their contracts and step up when called upon.

Governor Signs SB814, amending Oregon's unique environmental insurance coverage law

The Governor of Oregon has now signed into law far-reaching changes to ORS 465.475 et seq, the Oregon Environmental Cleanup Assistance Act.  The changes include, most notably, addition of a specific cause of action against an insurer for bad faith denial of coverage, patterned on the Washington Insurance Fair Conduct Act (IFCA).  Although constitutional challenges to the statute are a near-certainty, many provisions of the law will be beyond challenge and may help change the power dynamic between carriers and policyholders on environmental coverage issues in Oregon.  And as I have mentioned before, in light of the staggering projected cost of the Portland Harbor Superfund Site ($2 billion and growing), if this law does what it was designed to do it may be the largest change in Oregon insurance law by total dollar value in recent memory.  Many, many businesses (large and small) have become ensnared in the Superfund action and this law will help skilled policy-holder side lawyers representing those businesses clear some of the significant hurdles to getting indemnity coverage to fund the cleanup.

SB 814 :: Oregon Legislature Bill Tracker - Your Government - The Oregonian:

'via Blog this'

Oregon Senate Committee Makes "Do Pass" Recommendation for Insurance UTPA Bill

Reports of the demise of HB 3160, which would remove the exemption of insurance from claims under Oregon's Unfair Trade Practices Act (UTPA), may have been wrong.  The Oregon Senate Consumer and Small Business Committee has made a "do pass" recommendation on the bill.  However, the measure has been referred to the Rules committee.  As the legislative session winds down, predictions had been that the opposition of small-town insurance brokers, in-state carriers like The Standard, and Associated Oregon Industries was going to again spell defeat for this common-sense measure.  Hopefully proponents will succeed in pulling out a victory in the coming days.

HB 3160 :: Oregon Legislature Bill Tracker - Your Government - The Oregonian:

'via Blog this'

Speaker of Oregon House Signs SB 814, Amending Oregon Environmental Insurance Claims Law

SB 814 :: Oregon Legislature Bill Tracker - Your Government - The Oregonian:

Now all that remains is for the Governor to sign, and the largest change in Oregon insurance law (in potential dollar value) in recent memory will kick in.  Check back for a full analysis of the potential ramifications of this new law on policyholders, particularly those involved in the Portland Harbor Superfund Site.
'via Blog this'