IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON DIVISION ONE
T-MOBILE USA, INC., No. 82704-9-I
Respondent,
v. UNPUBLISHED OPINION STEADFAST INSURANCE COMPANY; and ZURICH AMERICAN INSURANCE COMPANY,
Petitioners.
BOWMAN, J. — Zurich American Insurance Company and its subsidiary
Steadfast Insurance Company (collectively Steadfast) insured T-Mobile USA Inc.
for loss from data privacy breaches. Under the policy, T-Mobile self-insured the
first $10 million of any loss from a data privacy breach under a “Self-Insured
Retention” (SIR) provision and Steadfast insured the next $15 million in loss. T-
Mobile incurred about $17.3 million in loss after one of its vendors, Experian
Information Solutions Inc., suffered a data privacy breach. T-Mobile later
recovered $10.75 million from Experian as indemnification for its loss. Steadfast
refused to pay T-Mobile’s claim for $17.3 million, asserting that the policy’s
definition of “loss” excludes T-Mobile’s recovery from Experian, so T-Mobile did
not satisfy the SIR. T-Mobile sued. Now, on certified question from the trial
court, we must determine the scope of coverage under T-Mobile’s policy. We
Citations and pin cites are based on the Westlaw online version of the cited material. No. 82704-9-I/2
conclude that Steadfast must provide coverage under the policy because T-
Mobile incurred $17.3 million in loss as defined by the policy, a loss exceeding its
SIR obligation. We affirm and remand to the trial court for further proceedings.
FACTS
Steadfast insured T-Mobile for data privacy breach losses. The policy
covered up to $15 million subject to an SIR, which required T-Mobile to self-
insure the first $10 million in loss from a data breach. That is, after a data
privacy breach, T-Mobile had to bear the risk of the first $10 million in loss before
Steadfast would cover the next $15 million in loss.
In September 2015, Experian, a T-Mobile vendor, suffered a data privacy
breach. T-Mobile notified Steadfast of the breach in October 2015 and tendered
a claim for coverage. In the following months, T-Mobile faced multiple individual
and class action lawsuits. T-Mobile also faced inquiries from the Federal
Communications Commission, the Federal Trade Commission, and state
attorneys general. In total, T-Mobile incurred $17.3 million in costs and expenses
related to the data privacy breach.1 T-Mobile sought indemnity from Experian by
filing an arbitration demand to which Experian counterclaimed. Ultimately, in July
2017, Experian agreed to pay T-Mobile $10.75 million to settle.
T-Mobile provided Steadfast documentation of its losses, but Steadfast
denied coverage. Steadfast acknowledged that T-Mobile submitted invoices
totaling about $17.3 million, but because T-Mobile recovered $10.75 million from
1 T-Mobile documented $17,264,498.20 in loss. We refer to that amount as $17.3 million.
2 No. 82704-9-I/3
Experian, Steadfast concluded T-Mobile’s loss was less than the $10 million SIR
“as defined in the Steadfast policy.”
In March 2019, T-Mobile sued Steadfast. It sought declaratory judgment
and asserted claims of breach of contract, insurance bad faith, violation of the
Washington Insurance Fair Conduct Act, RCW 48.30.010 to .015, and violation of
the Washington State Consumer Protection Act, chapter 19.86 RCW. Steadfast
and T-Mobile cross-moved for summary judgment. Steadfast sought summary
judgment in whole, arguing that T-Mobile did not satisfy the SIR because it
recovered from Experian $10.75 million of the $17.3 million loss, leaving “T-
Mobile’s actual out of pocket losses . . . less than $10 million.” T-Mobile sought
partial summary judgment, arguing that the policy does not allow Steadfast to set
off the Experian recovery against its payment obligation. The trial court granted
T-Mobile’s motion and denied Steadfast’s motion.
The parties then stipulated to stay the proceedings and moved to certify
the trial court's summary judgment rulings for discretionary review in this court
under RAP 2.3(b)(4). The trial court granted the motion, finding that “coverage in
this insurance case presents ‘a controlling question of law as to which there is
substantial ground for a difference of opinion,’ ”2 certifying for discretionary
review its summary judgment orders, and staying the proceedings pending our
review. A commissioner of this court accepted the certification and granted
review.
2 RAP 2.3(b)(4).
3 No. 82704-9-I/4
ANALYSIS
Steadfast and T-Mobile dispute whether the entire $17.3 million in costs
and expenses T-Mobile incurred from the Experian data breach amounts to a
covered loss under the policy.
We review rulings on summary judgment de novo, performing the same
inquiry as the trial court. Ellis v. City of Seattle, 142 Wn.2d 450, 458, 13 P.3d
1065 (2000). Summary judgment is appropriate only where “there is no genuine
issue as to any material fact and . . . the moving party is entitled to a judgment as
a matter of law.” CR 56(c). By cross moving for summary judgment, the parties
concede there are no material issues of fact. Hobbs v. Hankerson, 21 Wn. App.
2d 628, 632, 507 P.3d 422, review denied, 200 Wn.2d 1003, 516 P.3d 376
(2022). We will grant summary judgment only if, from all the evidence,
reasonable persons could reach but one conclusion. Ellis, 142 Wn.2d at 458.
Interpretation of an insurance policy is a question of law we review de
novo. Bordeaux, Inc. v. Am. Safety Ins. Co., 145 Wn. App. 687, 693, 186 P.3d
1188 (2008). Determining whether coverage exists is a two-step process.
Schwindt v. Underwriters at Lloyd’s of London, 81 Wn. App. 293, 298, 914 P.2d
119 (1996). The insured must first show the loss falls within the scope of the
policy’s coverage. Id. If the insured shows coverage, the insurer must then
show specific policy language that excludes the loss. Id. We liberally construe
insurance policies to provide coverage wherever possible. Bordeaux, 145 Wn.
App. at 694.
4 No. 82704-9-I/5
We interpret insurance policy language as an average person would
understand it and in a manner that gives effect to each provision.3 McDonald v.
State Farm Fire & Cas. Co., 119 Wn.2d 724, 733-34, 837 P.2d 1000 (1992). If a
policy defines a term, we interpret the term “ ‘in accordance with that policy
definition.’ ” Bordeaux, 145 Wn. App. at 694 (quoting Kitsap County v. Allstate
Ins. Co., 136 Wn.2d 567, 576, 964 P.2d 1173 (1998)). But if a policy does not
define a term, we give it its plain and ordinary meaning and may look to a
standard English dictionary. Id.; Boeing Co. v. Aetna Cas. & Sur. Co., 113
Wn.2d 869, 877, 784 P.2d 507 (1990). We must give any remaining ambiguity a
meaning and construction most favorable to the insured. Bordeaux, 145 Wn.
App. at 694. That is because coverage exclusions “ ‘are contrary to the
fundamental protective purpose of insurance and will not be extended beyond
Free access — add to your briefcase to read the full text and ask questions with AI
IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON DIVISION ONE
T-MOBILE USA, INC., No. 82704-9-I
Respondent,
v. UNPUBLISHED OPINION STEADFAST INSURANCE COMPANY; and ZURICH AMERICAN INSURANCE COMPANY,
Petitioners.
BOWMAN, J. — Zurich American Insurance Company and its subsidiary
Steadfast Insurance Company (collectively Steadfast) insured T-Mobile USA Inc.
for loss from data privacy breaches. Under the policy, T-Mobile self-insured the
first $10 million of any loss from a data privacy breach under a “Self-Insured
Retention” (SIR) provision and Steadfast insured the next $15 million in loss. T-
Mobile incurred about $17.3 million in loss after one of its vendors, Experian
Information Solutions Inc., suffered a data privacy breach. T-Mobile later
recovered $10.75 million from Experian as indemnification for its loss. Steadfast
refused to pay T-Mobile’s claim for $17.3 million, asserting that the policy’s
definition of “loss” excludes T-Mobile’s recovery from Experian, so T-Mobile did
not satisfy the SIR. T-Mobile sued. Now, on certified question from the trial
court, we must determine the scope of coverage under T-Mobile’s policy. We
Citations and pin cites are based on the Westlaw online version of the cited material. No. 82704-9-I/2
conclude that Steadfast must provide coverage under the policy because T-
Mobile incurred $17.3 million in loss as defined by the policy, a loss exceeding its
SIR obligation. We affirm and remand to the trial court for further proceedings.
FACTS
Steadfast insured T-Mobile for data privacy breach losses. The policy
covered up to $15 million subject to an SIR, which required T-Mobile to self-
insure the first $10 million in loss from a data breach. That is, after a data
privacy breach, T-Mobile had to bear the risk of the first $10 million in loss before
Steadfast would cover the next $15 million in loss.
In September 2015, Experian, a T-Mobile vendor, suffered a data privacy
breach. T-Mobile notified Steadfast of the breach in October 2015 and tendered
a claim for coverage. In the following months, T-Mobile faced multiple individual
and class action lawsuits. T-Mobile also faced inquiries from the Federal
Communications Commission, the Federal Trade Commission, and state
attorneys general. In total, T-Mobile incurred $17.3 million in costs and expenses
related to the data privacy breach.1 T-Mobile sought indemnity from Experian by
filing an arbitration demand to which Experian counterclaimed. Ultimately, in July
2017, Experian agreed to pay T-Mobile $10.75 million to settle.
T-Mobile provided Steadfast documentation of its losses, but Steadfast
denied coverage. Steadfast acknowledged that T-Mobile submitted invoices
totaling about $17.3 million, but because T-Mobile recovered $10.75 million from
1 T-Mobile documented $17,264,498.20 in loss. We refer to that amount as $17.3 million.
2 No. 82704-9-I/3
Experian, Steadfast concluded T-Mobile’s loss was less than the $10 million SIR
“as defined in the Steadfast policy.”
In March 2019, T-Mobile sued Steadfast. It sought declaratory judgment
and asserted claims of breach of contract, insurance bad faith, violation of the
Washington Insurance Fair Conduct Act, RCW 48.30.010 to .015, and violation of
the Washington State Consumer Protection Act, chapter 19.86 RCW. Steadfast
and T-Mobile cross-moved for summary judgment. Steadfast sought summary
judgment in whole, arguing that T-Mobile did not satisfy the SIR because it
recovered from Experian $10.75 million of the $17.3 million loss, leaving “T-
Mobile’s actual out of pocket losses . . . less than $10 million.” T-Mobile sought
partial summary judgment, arguing that the policy does not allow Steadfast to set
off the Experian recovery against its payment obligation. The trial court granted
T-Mobile’s motion and denied Steadfast’s motion.
The parties then stipulated to stay the proceedings and moved to certify
the trial court's summary judgment rulings for discretionary review in this court
under RAP 2.3(b)(4). The trial court granted the motion, finding that “coverage in
this insurance case presents ‘a controlling question of law as to which there is
substantial ground for a difference of opinion,’ ”2 certifying for discretionary
review its summary judgment orders, and staying the proceedings pending our
review. A commissioner of this court accepted the certification and granted
review.
2 RAP 2.3(b)(4).
3 No. 82704-9-I/4
ANALYSIS
Steadfast and T-Mobile dispute whether the entire $17.3 million in costs
and expenses T-Mobile incurred from the Experian data breach amounts to a
covered loss under the policy.
We review rulings on summary judgment de novo, performing the same
inquiry as the trial court. Ellis v. City of Seattle, 142 Wn.2d 450, 458, 13 P.3d
1065 (2000). Summary judgment is appropriate only where “there is no genuine
issue as to any material fact and . . . the moving party is entitled to a judgment as
a matter of law.” CR 56(c). By cross moving for summary judgment, the parties
concede there are no material issues of fact. Hobbs v. Hankerson, 21 Wn. App.
2d 628, 632, 507 P.3d 422, review denied, 200 Wn.2d 1003, 516 P.3d 376
(2022). We will grant summary judgment only if, from all the evidence,
reasonable persons could reach but one conclusion. Ellis, 142 Wn.2d at 458.
Interpretation of an insurance policy is a question of law we review de
novo. Bordeaux, Inc. v. Am. Safety Ins. Co., 145 Wn. App. 687, 693, 186 P.3d
1188 (2008). Determining whether coverage exists is a two-step process.
Schwindt v. Underwriters at Lloyd’s of London, 81 Wn. App. 293, 298, 914 P.2d
119 (1996). The insured must first show the loss falls within the scope of the
policy’s coverage. Id. If the insured shows coverage, the insurer must then
show specific policy language that excludes the loss. Id. We liberally construe
insurance policies to provide coverage wherever possible. Bordeaux, 145 Wn.
App. at 694.
4 No. 82704-9-I/5
We interpret insurance policy language as an average person would
understand it and in a manner that gives effect to each provision.3 McDonald v.
State Farm Fire & Cas. Co., 119 Wn.2d 724, 733-34, 837 P.2d 1000 (1992). If a
policy defines a term, we interpret the term “ ‘in accordance with that policy
definition.’ ” Bordeaux, 145 Wn. App. at 694 (quoting Kitsap County v. Allstate
Ins. Co., 136 Wn.2d 567, 576, 964 P.2d 1173 (1998)). But if a policy does not
define a term, we give it its plain and ordinary meaning and may look to a
standard English dictionary. Id.; Boeing Co. v. Aetna Cas. & Sur. Co., 113
Wn.2d 869, 877, 784 P.2d 507 (1990). We must give any remaining ambiguity a
meaning and construction most favorable to the insured. Bordeaux, 145 Wn.
App. at 694. That is because coverage exclusions “ ‘are contrary to the
fundamental protective purpose of insurance and will not be extended beyond
their clear and unequivocal meaning’ ”; coverage exclusions “ ‘should also be
strictly construed against the insurer.’ ” Id. (quoting Stuart v. Am. States Ins. Co.,
134 Wn.2d 814, 818-19, 953 P.2d 462 (1998)).
Covered Loss
T-Mobile argues that its covered loss amounts to $17.3 million. The policy
defines “loss” as
the total amount which the Insureds become legally obligated to pay on account of each Claim and for all Claims in each Policy Period . . . made against them for Wrongful Acts for which coverage applies, including but not limited to damages, judgments,
3 This is true even if the parties are corporations. Boeing Co. v. Aetna Cas. & Sur. Co., 113 Wn.2d 869, 882, 784 P.2d 507 (1990).
5 No. 82704-9-I/6
pre-judgment and post-judgment interest, settlements and Defense Costs.
“Loss” includes “punitive, exemplary, or multiple damages, or . . . civil fines,
sanctions, or penalties imposed pursuant to Privacy Regulations or resulting
from a Regulatory Proceeding . . . ; and . . . Consumer Redress Funds.”
Coverage also includes reimbursement for “Privacy Breach Costs,” which the
policy defines as “the reasonable and necessary fees, costs, charges and
expenses incurred . . . for the purposes of retaining an accountant, attorney,
public relations consultant or other third party” to investigate the cause,
determine indemnification obligations, effect compliance with privacy regulations,
notify affected individuals, manage public relations, and procure credit monitoring
services.
The record shows T-Mobile incurred $17.3 million in costs and expenses
because of the Experian data breach. A declaration from T-Mobile’s attorney
states that those expenses included “costs tied to responding to government
regulatory agencies, defending itself in numerous underlying lawsuits, defending
itself against Experian, and prosecuting its indemnification claim in the Experian
arbitration” after the data breach. Because those are all costs T-Mobile had to
pay on account of the data breach, they are a covered loss under the policy.
Exclusion from Covered Loss
Steadfast argues that we should exclude the $10.75 million T-Mobile
recovered from Experian from T-Mobile’s covered loss. According to Steadfast,
that recovery “absolved” T-Mobile from paying $10.75 million because Experian
indemnified T-Mobile for costs it incurred as a result of the breach.
6 No. 82704-9-I/7
The policy excludes from its definition of “loss” “any amount for which the
Insureds are absolved from payment.” The policy does not define the word
“absolve.” But the dictionary defines “absolve” as “to set free or release from
some obligation, debt, or responsibility.” W EBSTER’S THIRD NEW INTERNATIONAL
DICTIONARY 7 (2002). But the Experian recovery did not “absolve” T-Mobile from
payment because it did not set free or release T-Mobile from its obligation to pay
the costs and expenses it incurred from the data breach. T-Mobile remained
directly liable for those obligations and paid them in full. Experian then
reimbursed T-Mobile for some of those data-breach-related costs and expenses
T-Mobile already paid. We conclude that the policy does not exclude as a
covered loss the $10.75 million T-Mobile recovered from Experian.4
Allocation of the Covered Loss
Under the policy, T-Mobile agreed to self-insure the first $10 million of any
privacy breach claim “at their own risk.”5 So, according to the policy, Steadfast’s
“liability for Loss” on the $17.3 million claim applies to only that part of the loss
4 Steadfast argues our interpretation renders the “absolution exception superfluous to the definition of ‘loss’ ” because “loss” means the amount for which the insureds “become legally obligated to pay.” But the exception retains independent meaning because it includes amounts an insured is obligated to pay but is later released from paying by the obligor or by court order. For example, the insured may be legally obligated to pay a judgment but then absolved of that obligation following a successful appeal. 5 Steadfast argues that including the Experian recovery as a covered loss defeats the parties’ intent that T-Mobile would incur “at their own risk” the first $10 million of loss under the SIR. But T-Mobile did bear a $10 million risk under the SIR. It incurred a total loss of $17.3 million, the first $10 million of which it is responsible for. Had T-Mobile not successfully sued Experian for indemnification, it would have suffered an out-of-pocket loss of $10 million.
7 No. 82704-9-I/8
greater than $10 million. As a result, the policy allocates the first $10 million of
the loss to T-Mobile and the remaining $7.3 million to Steadfast.
Allocation of the Experian Settlement
We can best characterize Steadfast’s effort to benefit from the $10.75
million payment to T-Mobile as seeking a “setoff.” A “setoff” refers to an insurer’s
claim to sums a third party has already paid the insured. Winters v. State Farm
Mut. Auto. Ins. Co., 144 Wn.2d 869, 876, 31 P.3d 1164 (2001). But an insurer
may not set off any third-party payment to the insured unless “(1) the [policy]
itself authorizes it and (2) the insured is fully compensated by the relevant
‘applicable measure of damages.’ ”6 Sherry v. Fin. Indem. Co., 160 Wn.2d 611,
618-19, 160 P.3d 31 (2007) (quoting Barney v. Safeco Ins. Co. of Am., 73 Wn.
App. 426, 429, 869 P.2d 1093 (1994), abrogated on other grounds by Price v.
Farmers Ins. Co. of Wash., 133 Wn.2d 490, 946 P.2d 388 (1997)); Grp. Health
Coop. v. Coon, 193 Wn.2d 841, 852, 447 P.3d 139 (2019). Nothing in T-Mobile’s
policy authorized Steadfast to set off the $10.75 million Experian recovery.7
Because T-Mobile incurred a loss of $17.3 million and the policy does not
authorize Steadfast to set off the $10.75 million recovery from Experian, the trial
court properly granted partial summary judgment for T-Mobile. We affirm and
6 The same rule applies to offsets and reimbursement. Winters, 144 Wn.2d at 876. An offset clause permits “a credit to which an insurer is entitled for payments made under one coverage against claims made under another coverage within the same policy.” Id. And a reimbursement clause “permits an insurer to be reimbursed by its insured from proceeds that the insured collects directly from the party at-fault.” Id. But Steadfast points to no offset or reimbursement clause in its policy. 7 We note, however, that insureds are never entitled to double recovery. See Sherry, 160 Wn.2d at 618.
8 No. 82704-9-I/9
remand to the trial court for further proceedings.8
WE CONCUR:
8 T-Mobile seeks appellate attorney fees. Because this is an interlocutory decision, we decline to award attorney fees and reserve the issue for the trial court after final disposition. See RAP 18.1(i).