St. Paul Fire & Marine Ins. Co. v. Rosen Millennium, Inc.

337 F. Supp. 3d 1176

• Court: District Court, M.D. Florida
• Decided: September 28, 2018
• Docket: Case No: 6:17-cv-540-Orl-41GJK
• Status: Published

Opinion

CARLOS E. MENDOZA, UNITED STATES DISTRICT JUDGE

THIS CAUSE is before the Court on Defendants' Motion for Partial Judgment on the Pleadings (Doc. 38), to which Plaintiff filed a Response (Doc. 46). Also before the Court is Defendants' Motion for Judicial Notice (Doc. 40) and Plaintiff's Response (Doc. 45) as well as Defendants' Amended Motion for Judicial Notice (Doc. 47) and Plaintiff's Response (Doc. 48). In addition, this cause is before the Court on Plaintiff's Motion for Summary Judgment (Doc. 72), to which Defendants filed a Response (Doc. 78), Plaintiff filed a Reply (Doc. 82), and Defendants filed a Sur-reply (Doc. 92). Lastly, before the Court is Plaintiff's Motion in Limine (Doc. 94) and Defendants' Response (Doc. 98). For the reasons stated herein, Plaintiff's Motion for Summary Judgment will be granted in part, and all other motions will be denied as moot.

I. BACKGROUND

This is a declaratory judgment action brought by Plaintiff, St. Paul Fire and Marine Insurance Company, against its insured, Rosen Millennium, Inc. ("Millennium"), and Rosen Hotels & Resorts, Inc. ("RHR"),¹ seeking a declaratory judgment that Plaintiff does not have a duty to defend Millennium against a claim made by RHR. (See generally Am. Compl., Doc. 32). Plaintiff issued Millennium two consecutive commercial general liability insurance policies (the "CGL Policies"), which were in effect during the relevant time period. (2014 Insurance Policy, Doc. 32-1, at 10; 2015 Insurance Policy, Doc. 32-2, at 10).² The CGL Policies require Plaintiff to defend Millennium against claims of bodily injury or property damage to which the insurance applies. (See Doc. 32-1, at 78-79; Doc. 32-2, at 78-79).

Millennium provided data security services for RHR. (See Santos Dep., Doc. 68-1, at 21:22-24). In February 2016, RHR became aware of a potential credit card breach at one of their hotels. (Id. at 20:7-17). Soon after, RHR hired a forensic investigator to determine whether a data breach occurred and, if so, to discover its source. (RHR's Answers to Pl.'s Interrogs., Doc. 72-1, at 8). The forensic investigator found malware installed on the payment network, (see id. ; Flores Dep., Doc. 69-1, at 30:18-31:5), and determined that customers' cards used between September 2014 and February 2016 may have been affected, (Doc. 72-1 at 8; Jan. 11, 2017 E-mail, Doc. 72-2, at 2). On March 4, 2016, RHR disclosed the data breach to potentially *1181affected customers. (RHR Release, Doc. 72-3, at 2-3).

On December 29, 2016, Millennium submitted a Notice of Claim, (Doc. 72-10, at 1), to Plaintiff in response to an e-mail Millennium received from RHR, indicating that RHR believed that the data breach was caused by Millennium's negligence and inquiring as to whether Millennium had insurance to cover such a loss, (Dec. 24, 2016 E-mail, Doc. 72-11, at 2). On March 2, 2017, Plaintiff issued a reservation of rights, indicating that there was no coverage for the claim, but inviting Millennium to provide additional information. (Mar. 2, 2017 Letter, Doc. 72-14, at 1, 9-10). Plaintiff did not provide additional information. Later that month, Plaintiff initiated this action, seeking a declaratory judgment as to its duty to defend Millennium against RHR's claim (See generally Compl., Doc. 1). On June 8, 2018, Plaintiff received a demand letter from Millennium, in which RHR alleged that it was entitled to payment from Millennium as a result of the data breach. (June 5, 2017 Letter, Doc. 72-15, at 2). Although RHR has not filed suit against Millennium, Plaintiff contends that the demand letter from RHR combined with Millennium's Notice of Claim sufficiently creates a case and controversy with regard to Plaintiff's duty to defend Millennium under the CGL Policies. Now, Plaintiff moves for summary judgment.

II. LEGAL STANDARD

Summary judgment is appropriate when the moving party demonstrates "that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56(a). A dispute is genuine "if the evidence is such that a reasonable jury could return a verdict for the nonmoving party." Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). A fact is material if it may "affect the outcome of the suit under the governing law." Id. "The moving party bears the initial burden of showing the court, by reference to materials on file, that there are no genuine issues of material fact that should be decided at trial." Allen v. Bd. of Pub. Educ. , 495 F.3d 1306, 1313-14 (11th Cir. 2007). Stated differently, the moving party discharges its burden by showing "that there is an absence of evidence to support the nonmoving party's case." Celotex Corp. v. Catrett , 477 U.S. 317, 325, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986).

However, once the moving party has discharged its burden, the nonmoving party must "go beyond the pleadings and by her own affidavits, or by the depositions, answers to interrogatories, and admissions on file, designate specific facts showing that there is a genuine issue for trial." Id. at 324, 106 S.Ct. 2548 (quotation omitted). The nonmoving party may not rely solely on "conclusory allegations without specific supporting facts." Evers v. Gen. Motors Corp. , 770 F.2d 984, 986 (11th Cir. 1985). Nevertheless, "[i]f there is a conflict between the parties' allegations or evidence, the [nonmoving] party's evidence is presumed to be true and all reasonable inferences must be drawn in the [nonmoving] party's favor." Allen , 495 F.3d at 1314.

III. ANALYSIS

A. Declaratory Judgment

"The federal courts are confined by Article III of the Constitution to adjudicating only actual 'cases' and 'controversies.' " Malowney v. Fed. Collection Deposit Grp. , 193 F.3d 1342, 1346 (11th Cir. 1999) (quoting Allen v. Wright , 468 U.S. 737, 750, 104 S.Ct. 3315, 82 L.Ed.2d 556 (1984) ). "[T]he Declaratory Judgment Act ... does not broaden federal jurisdiction." Gulf States Paper Corp. v. Ingram , 811 F.2d 1464, 1467 (11th Cir. 1987), abrogated on other grounds by *1182King v. St. Vincent's Hosp. , 502 U.S. 215, 112 S.Ct. 570, 116 L.Ed.2d 578 (1991). Indeed, Congress explicitly "limited federal jurisdiction under the Declaratory Judgment Act to actual controversies, in statutory recognition of" the Article III limitations on federal judicial power. Atlanta Gas Light Co. v. Aetna Cas. & Sur. Co. , 68 F.3d 409, 414 (11th Cir. 1995) (quotation omitted). Accordingly, if a declaratory judgment action fails to meet the Article III case and controversy requirement-including the requirement that the action be ripe for review-it must be dismissed for want of jurisdiction. See Digital Props., Inc. v. City of Plantation , 121 F.3d 586, 589 (11th Cir. 1997) ("Article III ... limits the jurisdiction of the federal courts to cases and controversies of sufficient concreteness to evidence a ripeness for review." (citation omitted) ). "The ripeness doctrine" also "involves consideration of ... prudential concerns.... Even when the constitutional minimum has been met ... prudential considerations may still counsel judicial restraint." Id. (quotation omitted). Moreover, parties do not have a right to a declaratory judgment, and district courts have the discretion to abstain from exercising jurisdiction over such a claim. Ameritas Variable Life Ins. Co. v. Roach , 411 F.3d 1328, 1330 (11th Cir. 2005) (per curiam) ("The Declaratory Judgment Act is 'an enabling Act, which confers a discretion on courts rather than an absolute right upon the litigant.' It only gives the federal courts competence to make a declaration of rights; it does not impose a duty to do so." (quoting Wilton v. Seven Falls Co. , 515 U.S. 277, 287, 115 S.Ct. 2137, 132 L.Ed.2d 214 (1995) ) ).

Here, Plaintiff asserts that it has no duty to defend Millennium based on the allegations encompassed by the Notice of Claim and the demand letter. Specifically, the language in the demand letter tracks the language in the "personal injury" provisions of the CGL policies, and Plaintiff argues that those provisions do not cover the alleged actions. Defendants disagree, arguing that the personal injury provisions apply. Defendants also advance two additional theories of coverage under the CGL policies: (1) the customers' loss of the use of their credit cards, and the inevitable replacement of those cards, is covered as "property damage"; and (2) the costs incurred by RHR in complying with notification statutes are covered under the policies.

However, when determining whether an insurer has a duty to defend, the Court must confine its analysis to the allegations in the underlying claim. Lime Tree Vill. Cmty. Club Ass'n v. State Farm Gen. Ins. Co. , 980 F.2d 1402, 1405 (11th Cir. 1993) ; see also Goldberg v. Nat'l Union Fire Ins. Co. of Pittsburgh, PA. , 143 F.Supp.3d 1283, 1293 (S.D. Fla. 2015) ("[A]n insurer's duty to defend its insured against legal action depends solely on the facts and legal theories alleged in the pleadings and the claims against the insured." (citing Lawyers Title Ins. Corp. v. JDC (Am.) Corp. , 52 F.3d 1575, 1580 (11th Cir. 1995) ) ); Evanston Ins. Co. v. Haven S. Beach, LLC , 152 F.Supp.3d 1370, 1374 (S.D. Fla. 2015) ("To determine whether [the insurer] had a duty to defend [the insured], the Court looks only to the allegations in the Underlying Complaint and the terms of the Policy." (citing Jones v. Fla. Ins. Guar. Ass'n , 908 So.2d 435, 442-43 (Fla. 2005) ) ).

Because there is no underlying litigation here, the Court must look at RHR's Notice of Claim and demand letter. The Notice of Claim is devoid of any substantive information other than the fact that a "[c]redit card systems breach" occurred and the relevant dates of the breach. (Doc. 72-10 at 2). The detail set forth in the demand letter is also quite *1183sparse, but it does specifically state that Millennium "made private information known to third parties that violated a credit card holder's right of privacy." (Doc. 72-15 at 2). As noted this language tracks the language in the personal injury provision of the CGL policy. Conversely, the demand letter makes no mention of, let alone a claim for, property damage or the costs incurred from complying with notification statutes. Instead, the Court would be addressing Plaintiff's duty to defend a hypothetical claim. Thus, because Defendants have not made such claims, the issue of whether the CGL Policies would cover those claims is not ripe. See Selective Ins. Co. of Se. v. William P. White Racing Stables, Inc. , 718 F. App'x 864, 868 (11th Cir. 2017) (determining that the district court "erred in finding a duty to defend based upon a theory of liability which has not been pled." (quotation omitted) ). Therefore, the Court will only address Plaintiff's duty to defend under the personal injury provisions of the CGL policies.

B. Duty to Defend

"An insurer's duty to defend is distinct from and broader than the duty to indemnify." Lime Tree Vill. Cmty. Club Ass'n , 980 F.2d at 1405 (quotation omitted). As noted, whether an insurer has a duty to defend "is determined by examining the allegations in the [underlying claim] filed against the insured." Id. When the underlying claim "alleges facts which fairly and potentially bring the suit within policy coverage," the insurer must defend the suit on behalf of the insured. Id. "If the allegations of the complaint leave any doubt as to the duty to defend, the question must be resolved in favor of the insured." Id. However, "if the pleadings show that there is no coverage or that a policy exclusion applies to bar coverage, the insurer has no duty to defend." Goldberg , 143 F.Supp.3d at 1293-94 (citing Md. Cas. Co. v. Fla. Atl. Orthopedics, P.L. , 771 F.Supp.2d 1328, 1332 (S.D. Fla. 2011), aff'd , 469 F. App'x 722 (11th Cir. 2012) ).

1. Waiver

As a preliminary matter, Defendants contend that Plaintiff has waived its ability to deny coverage. According to Defendants, Plaintiff admitted that RHR's claim against Millennium is covered under the policies. Defendants point to language in Plaintiff's June 16, 2017 coverage letter, stating that a "claim for 'making known ... covered material that violates a person's right to privacy,' could potentially fall within the policy's definition of 'personal injury.' " (June 16, 2017 Letter, Doc. 32-5, at 9). However, Defendants neglected to include the second half of that same sentence, which provides that "the June 5, 2017 demand letter provides no facts to support RHR's conclusion that Millennium made known RHR's customers' private information to third parties." (Id. ). No where in the June 16, 2017 coverage letter does Plaintiff admit the existence of coverage. Thus, the Court finds that Plaintiff has not admitted that RHR's claim is covered under the policies.

Defendants also argue that Plaintiff waived its ability to deny coverage because it failed to include the relevant coverage defenses it in its coverage letters. Under Florida law, an insurer "shall not be permitted to deny coverage based on a particular coverage defense unless ... [w]ithin 30 days after the liability insurer knew or should have known of the coverage defense, written notice of reservation of rights to assert a coverage defense is given to the named insured." Fla. Stat. § 627.426(2). The Florida Supreme Court has held that noncompliance with the notice requirements in section 627.426(2) does not preclude an insurer from denying *1184coverage where coverage was excluded under the policy. AIU Ins. Co. v. Block Marina Inv., Inc. , 544 So.2d 998, 1000 (Fla. 1989). Stated differently, " section 627.426 does not create or extend nonexistent coverage." Doe v. Allstate Ins. Co. , 653 So.2d 371, 374 (Fla. 1995). Here, Plaintiff is not asserting a coverage defense but rather that RHR's claim is not covered under the CGL Policies. Therefore, Plaintiff is not barred from arguing that RHR's claim is excluded from coverage.

2. Contract Interpretation

Finally, Plaintiff asserts that it has no duty to defend Millennium because RHR's claim is not covered under the personal injury provisions of the CGL Policies, which is a matter of contract interpretation. It is undisputed that Florida law governs the interpretation of the CGL Policies. In Florida, "[s]ummary judgment is appropriate in declaratory judgment actions seeking a declaration of coverage when the insurer's duty, if any, rests solely on the applicability of the insurance policy, the construction and effect of which is a matter of law." Northland Cas. Co. v. HBE Corp. , 160 F.Supp.2d 1348, 1358 (M.D. Fla. 2001) ; see also Gas Kwick, Inc. v. United Pac. Ins. Co. , 58 F.3d 1536, 1538-39 (11th Cir. 1995) ("Under Florida law, interpretation of an insurance contract is a matter of law to be decided by the court."). "Florida law provides that insurance contracts are construed in accordance with the plain language of the policies as bargained for by the parties." Westport Ins. Corp. v. VN Hotel Grp., LLC , No. 6:10-cv-222-ORL-28KRS, 2011 WL 4804896, at *2 (M.D. Fla. Oct. 11, 2011), aff'd , 513 F. App'x 927 (11th Cir. 2013) (quotation omitted). "The scope and extent of insurance coverage is determined by the language and terms of the policy." Id. (quotation omitted).

"[T]he Florida Supreme Court has made clear that the language of the policy is the most important factor." James River Ins. Co. v. Ground Down Eng'g, Inc. , 540 F.3d 1270, 1274 (11th Cir. 2008) (quotation omitted). Additionally, "insurance contracts are construed according to their plain meaning." Id. at 1274 (quoting Taurus Holdings, Inc. v. U.S. Fid. & Guar. Co. , 913 So.2d 528, 532 (Fla. 2005) ). "[I]f a policy provision is clear and unambiguous, it should be enforced according to its terms whether it is a basic policy provision or an exclusionary provision." Taurus Holdings, Inc. , 913 So.2d at 532 (quotation omitted).

Where the "relevant policy language is susceptible to more than one reasonable interpretation, one providing coverage and the [other] limiting coverage, the insurance policy is considered ambiguous." Westport Ins. Corp. , 2011 WL 4804896, at *2 (quoting Auto-Owners Ins. Co. v. Anderson , 756 So.2d 29, 34 (Fla. 2000) ). In order for an insurance contract to be found ambiguous, "[t]here must be a genuine inconsistency, uncertainty, or ambiguity in meaning that remains after resort to the ordinary rules of construction." Valiant Ins. Co. v. Evonosky , 864 F.Supp. 1189, 1191 (11th Cir. 1994) (quotation omitted). "[A] court may not rewrite the policy or add meaning to create an ambiguity." Id. Additionally, the mere fact that policy language requires interpretation does not render the language ambiguous. Id. "Ambiguous policy provisions are interpreted liberally in favor of the insured and strictly against the drafter who prepared the policy." Westport Ins. Corp. , 2011 WL 4804896, at *2 (quoting Auto-Owners Ins. Co. , 756 So.2d at 34 ). Moreover, "[e]xclusionary clauses are construed even more strictly against the insurer than coverage clauses," and the insurer has the burden of *1185demonstrating that an exclusion in a policy applies. Id. (quotation omitted).

The CGL Policies provide coverage for "personal injury," which is defined as an "injury, other than bodily injury or advertising injury, that's caused by a personal injury offense." (Doc. 32-1 at 77; Doc. 32-2 at 77). A "personal injury offense" includes, inter alia , "[m]aking known to any person or organization covered material that violates a person's right of privacy." (Id. ). The parties do not dispute that the credit card information that was released as a result of the data breach constitutes covered material. Instead, the parties dispute whether the "making known" requirement has been met. While the term "making known" is not defined in the policies, both parties agree that the term is synonymous with "publication."³

In support of its argument that third-party data breaches are not covered under the policies, Plaintiff relies on Innovak International, Inc. v. Hanover Insurance Company , 280 F.Supp.3d 1340 (M.D. Fla. 2017). In Innovak , several individuals' private personal information was released as a result of a data breach. 280 F.Supp.3d at 1342. The individuals sued the company responsible for managing the payroll software that was breached under a theory of negligence. Id. In turn, the company notified its insurer of the incident and demanded that the insurer put on a defense in the underlying suit. Id. The insurance policy covered claims of personal and advertising injury, which was defined as including injury arising out of "[o]ral or written publication, in any manner, of material that violates a person's right of privacy." Id. at 1343. The insurer denied coverage, in part, because "third party hackers, not the [i]nsured, caused the data breach." Id. The court, applying South Carolina law, held that "the only plausible interpretation of [the insurance policy] is that it requires the insured to be the publisher of the [private information]." Id. at 1348 (noting that "construing the policy to include the acts of third parties 'would be expanding coverage beyond what the insurance carriers were ... knowingly entering into.' " (quoting Zurich Am. Ins. v. Sony Corp. of Am. , No. 651982/2011, 2014 WL 8382554 at *, 2014 N.Y. Misc. LEXIS 5141 at *71 (N.Y. Sup. Ct. Feb. 21, 2014) ) ). Here, the policies define "personal injury" in a similar fashion, and therefore, the Court finds Innovak to be persuasive.⁴ Moreover, the CGL Policies require covered personal injuries *1186to "result[ ] from [the insured's] business activities." (Doc. 32-1 at 77; Doc. 32-2 at 77). RHR's alleged injuries did not result from Millennium's business activities but rather the actions of third parties.

Defendants point to several cases involving data breaches where courts have found a duty to defend. However, none of those involve data breaches perpetrated by third parties. See, e.g., Travelers Indem. Co. of Am. v. Portal Healthcare Sols., LLC , 35 F.Supp.3d 765, 768 (E.D. Va. 2014), aff'd , 644 F. App'x 245 (4th Cir. 2016) (insured posted patient records on the internet); Evanston Ins. Co. v. Gene by Gene, Ltd. , 155 F.Supp.3d 706, 708 (S.D. Tex. 2016) (insured published DNA test results on its website without the individual's consent); Am. Econ. Ins. Co. v. Aspen Way Enters., Inc. , No. CV14-09-BLG-SPW, 2015 WL 5680134, at *1 (D. Mont. Sept. 25, 2015) (insured installed spyware and accessed private information contained on leased laptops).⁵ Therefore, the Court finds that RHR's personal injury claim is not covered under the CGL Policies. Because Defendants have not asserted any claims subject to coverage under the CGL Policies, Plaintiff has no duty to defend, and its Motion for Summary Judgment will be granted in part.

IV. CONCLUSION

Accordingly, it is ORDERED and ADJUDGED as follows:

1. Plaintiff's Motion for Summary Judgment (Doc. 72) is GRANTED in part .

2. The Clerk is directed to enter a declaratory Judgment in favor of Plaintiff, providing that Plaintiff has no duty to defend Millennium regarding the claim brought by RHR under the personal injury provisions of the CGL policies.

3. Defendants' Motion for Partial Judgment on the Pleadings (Doc. 38) is DENIED as moot .

4. Defendants' Motion for Judicial Notice (Doc. 40) is DENIED as moot .

5. Defendants' Amended Motion for Judicial Notice (Doc. 47) is DENIED as moot .

6. Plaintiff's Motion in Limine (Doc. 94) is DENIED as moot .

7. The Clerk is directed to close this case.

DONE and ORDERED in Orlando, Florida on September 28, 2018.

1 Millennium is a wholly-owned subsidiary of RHR. (Flores Dep., Doc. 69-1, at 21:11-13).

2 The two policies contain identical provisions, with the only salient difference being their effective dates.

3 Several courts addressing the issue have held that the term "making known" is more restrictive than "publication." See, e.g., Melrose Hotel Co. v. St. Paul Fire & Marine Ins. Co. , 432 F.Supp.2d 488, 503 (E.D. Pa. 2006) (" 'Making known to any person or organization' implies a disclosure to a third party or divulging of a secret. This stands in contrast with the term 'publication,' which can include the simple act of issuing or proclaiming." (citing Hooters of Augusta, Inc. v. Am. Glob. Ins. Co. , 157 F. App'x 201, 208 (11th Cir. 2005) ) ); St. Paul Fire & Marine Ins. Co. v. Brother Int'l Corp. , No. 06-2759 (FLW), 2007 WL 2571960, at *10 (D.N.J. Aug. 31, 2007) (noting that the term "making known" requires "disclosure of private content to a third party"). For purposes of this Order, the distinction between the two is immaterial as neither party disputes that the breached data was disclosed to third parties.

4 Defendants contend that Florida law differs regarding liability coverage for injuries caused by third parties. However, neither case cited by Defendants squarely addresses the issue in this matter. See Aetna Ins. Co. v. Webb , 251 So.2d 321, 322 (Fla. 1st DCA 1971) (addressing "whether the negligent act of a third party eliminates the character of 'accident' from a particular act"); Penzer v. Transp. Ins. Co. , 29 So.3d 1000, 1002 (Fla. 2010) (addressing "whether, under Florida law, the sending of an unsolicited advertisement by fax, in violation of the federal Telephone Consumer Protection Act ... is covered by a particular insurance policy provision").

5 Defendants' citation to Atlantic Specialty Insurance Company v. Premera Blue Cross , No. 2:15-cv-1927-TSZ (W.D. Wash.) is unavailing-the order denying summary judgment is under seal, and therefore, Defendants' argument regarding the court's reasoning is pure speculation.