Steadfast Ins. Co. & Zurich American Ins. Co., V. T-mobile Usa, Inc.

Opinion

IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON DIVISION ONE

T-MOBILE USA, INC., No. 82704-9-I Respondent,

v.

UNPUBLISHED OPINION

STEADFAST INSURANCE COMPANY; and ZURICH AMERICAN INSURANCE COMPANY,

Petitioners.

BOWMAN, J. — Zurich American Insurance Company and its subsidiary Steadfast Insurance Company (collectively Steadfast) insured T-Mobile USA Inc. for loss from data privacy breaches. Under the policy, T-Mobile self-insured the first $10 million of any loss from a data privacy breach under a “Self-Insured Retention” (SIR) provision and Steadfast insured the next $15 million in loss. T- Mobile incurred about $17.3 million in loss after one of its vendors, Experian Information Solutions Inc., suffered a data privacy breach. T-Mobile later recovered $10.75 million from Experian as indemnification for its loss. Steadfast refused to pay T-Mobile’s claim for $17.3 million, asserting that the policy’s definition of “loss” excludes T-Mobile’s recovery from Experian, so T-Mobile did not satisfy the SIR. T-Mobile sued. Now, on certified question from the trial court, we must determine the scope of coverage under T-Mobile’s policy. We

Citations and pin cites are based on the Westlaw online version of the cited material.

conclude that Steadfast must provide coverage under the policy because T- Mobile incurred $17.3 million in loss as defined by the policy, a loss exceeding its SIR obligation. We affirm and remand to the trial court for further proceedings.

FACTS

Steadfast insured T-Mobile for data privacy breach losses. The policy covered up to $15 million subject to an SIR, which required T-Mobile to self- insure the first $10 million in loss from a data breach. That is, after a data privacy breach, T-Mobile had to bear the risk of the first $10 million in loss before Steadfast would cover the next $15 million in loss.

In September 2015, Experian, a T-Mobile vendor, suffered a data privacy breach. T-Mobile notified Steadfast of the breach in October 2015 and tendered a claim for coverage. In the following months, T-Mobile faced multiple individual and class action lawsuits. T-Mobile also faced inquiries from the Federal Communications Commission, the Federal Trade Commission, and state attorneys general. In total, T-Mobile incurred $17.3 million in costs and expenses related to the data privacy breach.1 T-Mobile sought indemnity from Experian by filing an arbitration demand to which Experian counterclaimed. Ultimately, in July 2017, Experian agreed to pay T-Mobile $10.75 million to settle.

T-Mobile provided Steadfast documentation of its losses, but Steadfast denied coverage. Steadfast acknowledged that T-Mobile submitted invoices totaling about $17.3 million, but because T-Mobile recovered $10.75 million from

1 T-Mobile documented $17,264,498.20 in loss. We refer to that amount as $17.3 million.

3

Experian, Steadfast concluded T-Mobile’s loss was less than the $10 million SIR “as defined in the Steadfast policy.”

In March 2019, T-Mobile sued Steadfast. It sought declaratory judgment and asserted claims of breach of contract, insurance bad faith, violation of the Washington Insurance Fair Conduct Act, RCW 48.30.010 to .015, and violation of the Washington State Consumer Protection Act, chapter 19.86 RCW. Steadfast and T-Mobile cross-moved for summary judgment. Steadfast sought summary judgment in whole, arguing that T-Mobile did not satisfy the SIR because it recovered from Experian $10.75 million of the $17.3 million loss, leaving “T- Mobile’s actual out of pocket losses . . . less than $10 million.” T-Mobile sought partial summary judgment, arguing that the policy does not allow Steadfast to set off the Experian recovery against its payment obligation. The trial court granted T-Mobile’s motion and denied Steadfast’s motion.

The parties then stipulated to stay the proceedings and moved to certify the trial court's summary judgment rulings for discretionary review in this court under RAP 2.3(b)(4). The trial court granted the motion, finding that “coverage in this insurance case presents ‘a controlling question of law as to which there is substantial ground for a difference of opinion,’ ”2 certifying for discretionary review its summary judgment orders, and staying the proceedings pending our review. A commissioner of this court accepted the certification and granted review.

2 RAP 2.3(b)(4).

4

ANALYSIS

Steadfast and T-Mobile dispute whether the entire $17.3 million in costs and expenses T-Mobile incurred from the Experian data breach amounts to a covered loss under the policy.

We review rulings on summary judgment de novo, performing the same inquiry as the trial court. Ellis v. City of Seattle, 142 Wn.2d 450, 458, 13 P.3d 1065 (2000). Summary judgment is appropriate only where “there is no genuine issue as to any material fact and . . . the moving party is entitled to a judgment as a matter of law.” CR 56(c). By cross moving for summary judgment, the parties concede there are no material issues of fact. Hobbs v. Hankerson, 21 Wn. App. 2d 628, 632, 507 P.3d 422, review denied, 200 Wn.2d 1003, 516 P.3d 376 (2022). We will grant summary judgment only if, from all the evidence, reasonable persons could reach but one conclusion. Ellis, 142 Wn.2d at 458.

Interpretation of an insurance policy is a question of law we review de novo. Bordeaux, Inc. v. Am. Safety Ins. Co., 145 Wn. App. 687, 693, 186 P.3d 1188 (2008). Determining whether coverage exists is a two-step process. Schwindt v. Underwriters at Lloyd’s of London, 81 Wn. App. 293, 298, 914 P.2d 119 (1996). The insured must first show the loss falls within the scope of the policy’s coverage. Id. If the insured shows coverage, the insurer must then show specific policy language that excludes the loss. Id. We liberally construe insurance policies to provide coverage wherever possible. Bordeaux, 145 Wn. App. at 694.

5

We interpret insurance policy language as an average person would understand it and in a manner that gives effect to each provision.3 McDonald v. State Farm Fire & Cas. Co., 119 Wn.2d 724, 733-34, 837 P.2d 1000 (1992). If a policy defines a term, we interpret the term “ ‘in accordance with that policy definition.’ ” Bordeaux, 145 Wn. App. at 694 (quoting Kitsap County v. Allstate Ins. Co., 136 Wn.2d 567, 576, 964 P.2d 1173 (1998)). But if a policy does not define a term, we give it its plain and ordinary meaning and may look to a standard English dictionary. Id.; Boeing Co. v. Aetna Cas. & Sur. Co., 113 Wn.2d 869, 877, 784 P.2d 507 (1990). We must give any remaining ambiguity a meaning and construction most favorable to the insured. Bordeaux, 145 Wn. App. at 694. That is because coverage exclusions “ ‘are contrary to the fundamental protective purpose of insurance and will not be extended beyond their clear and unequivocal meaning’ ”; coverage exclusions “ ‘should also be strictly construed against the insurer.’ ” Id. (quoting Stuart v. Am. States Ins. Co., 134 Wn.2d 814, 818-19, 953 P.2d 462 (1998)). Covered Loss T-Mobile argues that its covered loss amounts to $17.3 million. The policy defines “loss” as

the total amount which the Insureds become legally obligated to pay on account of each Claim and for all Claims in each Policy Period . . . made against them for Wrongful Acts for which coverage applies, including but not limited to damages, judgments,

3 This is true even if the parties are corporations. Boeing Co. v. Aetna Cas. & Sur. Co., 113 Wn.2d 869, 882, 784 P.2d 507 (1990).

6

pre-judgment and post-judgment interest, settlements and Defense Costs.

“Loss” includes “punitive, exemplary, or multiple damages, or . . . civil fines, sanctions, or penalties imposed pursuant to Privacy Regulations or resulting from a Regulatory Proceeding . . . ; and . . . Consumer Redress Funds.” Coverage also includes reimbursement for “Privacy Breach Costs,” which the policy defines as “the reasonable and necessary fees, costs, charges and expenses incurred . . . for the purposes of retaining an accountant, attorney, public relations consultant or other third party” to investigate the cause, determine indemnification obligations, effect compliance with privacy regulations, notify affected individuals, manage public relations, and procure credit monitoring services.

The record shows T-Mobile incurred $17.3 million in costs and expenses because of the Experian data breach. A declaration from T-Mobile’s attorney states that those expenses included “costs tied to responding to government regulatory agencies, defending itself in numerous underlying lawsuits, defending itself against Experian, and prosecuting its indemnification claim in the Experian arbitration” after the data breach. Because those are all costs T-Mobile had to pay on account of the data breach, they are a covered loss under the policy. Exclusion from Covered Loss Steadfast argues that we should exclude the $10.75 million T-Mobile recovered from Experian from T-Mobile’s covered loss. According to Steadfast, that recovery “absolved” T-Mobile from paying $10.75 million because Experian indemnified T-Mobile for costs it incurred as a result of the breach.

7

The policy excludes from its definition of “loss” “any amount for which the Insureds are absolved from payment.” The policy does not define the word “absolve.” But the dictionary defines “absolve” as “to set free or release from some obligation, debt, or responsibility.” W EBSTER’S THIRD NEW INTERNATIONAL DICTIONARY 7 (2002). But the Experian recovery did not “absolve” T-Mobile from payment because it did not set free or release T-Mobile from its obligation to pay the costs and expenses it incurred from the data breach. T-Mobile remained directly liable for those obligations and paid them in full. Experian then reimbursed T-Mobile for some of those data-breach-related costs and expenses T-Mobile already paid. We conclude that the policy does not exclude as a covered loss the $10.75 million T-Mobile recovered from Experian.4 Allocation of the Covered Loss Under the policy, T-Mobile agreed to self-insure the first $10 million of any privacy breach claim “at their own risk.”5 So, according to the policy, Steadfast’s “liability for Loss” on the $17.3 million claim applies to only that part of the loss

4 Steadfast argues our interpretation renders the “absolution exception superfluous to the definition of ‘loss’ ” because “loss” means the amount for which the insureds “become legally obligated to pay.” But the exception retains independent meaning because it includes amounts an insured is obligated to pay but is later released from paying by the obligor or by court order. For example, the insured may be legally obligated to pay a judgment but then absolved of that obligation following a successful appeal.

5 Steadfast argues that including the Experian recovery as a covered loss defeats the parties’ intent that T-Mobile would incur “at their own risk” the first $10 million of loss under the SIR. But T-Mobile did bear a $10 million risk under the SIR. It incurred a total loss of $17.3 million, the first $10 million of which it is responsible for. Had T-Mobile not successfully sued Experian for indemnification, it would have suffered an out-of-pocket loss of $10 million.

8

greater than $10 million. As a result, the policy allocates the first $10 million of the loss to T-Mobile and the remaining $7.3 million to Steadfast. Allocation of the Experian Settlement We can best characterize Steadfast’s effort to benefit from the $10.75 million payment to T-Mobile as seeking a “setoff.” A “setoff” refers to an insurer’s claim to sums a third party has already paid the insured. Winters v. State Farm Mut. Auto. Ins. Co., 144 Wn.2d 869, 876, 31 P.3d 1164 (2001). But an insurer may not set off any third-party payment to the insured unless “(1) the [policy] itself authorizes it and (2) the insured is fully compensated by the relevant ‘applicable measure of damages.’ ”6 Sherry v. Fin. Indem. Co., 160 Wn.2d 611, 618-19, 160 P.3d 31 (2007) (quoting Barney v. Safeco Ins. Co. of Am., 73 Wn. App. 426, 429, 869 P.2d 1093 (1994), abrogated on other grounds by Price v. Farmers Ins. Co. of Wash., 133 Wn.2d 490, 946 P.2d 388 (1997)); Grp. Health Coop. v. Coon, 193 Wn.2d 841, 852, 447 P.3d 139 (2019). Nothing in T-Mobile’s policy authorized Steadfast to set off the $10.75 million Experian recovery.7 Because T-Mobile incurred a loss of $17.3 million and the policy does not authorize Steadfast to set off the $10.75 million recovery from Experian, the trial court properly granted partial summary judgment for T-Mobile. We affirm and

6 The same rule applies to offsets and reimbursement. Winters, 144 Wn.2d at 876. An offset clause permits “a credit to which an insurer is entitled for payments made under one coverage against claims made under another coverage within the same policy.” Id. And a reimbursement clause “permits an insurer to be reimbursed by its insured from proceeds that the insured collects directly from the party at-fault.” Id. But Steadfast points to no offset or reimbursement clause in its policy.

7 We note, however, that insureds are never entitled to double recovery. See Sherry, 160 Wn.2d at 618.

9

remand to the trial court for further proceedings.8

WE CONCUR:

8 T-Mobile seeks appellate attorney fees. Because this is an interlocutory decision, we decline to award attorney fees and reserve the issue for the trial court after final disposition. See RAP 18.1(i).