JOHN E. OTT, Magistrate Judge.
The plaintiff in this action, Camp's Grocery, Inc. ("Camp's"), seeks a declaratory judgment that its insurer, defendant State Farm Fire & Casualty Company ("State Farm"), is obliged to defend and indemnify Camp's in connection with an underlying lawsuit brought against it in Alabama state court. (Doc
The objective material facts of this case are undisputed. Camp's operates a grocery store in Hokes Bluff, Alabama. It has been sued, along with its franchisor, Piggly Wiggly, LLC, and fictitiously identified defendants, in a lawsuit filed in the Circuit Court of Etowah County, Alabama. (Doc. 1-1). The plaintiffs in that underlying suit are three credit unions (the "Credit Unions"). They allege that Camp's computer network was hacked, compromising confidential data on its customers, including their credit card, debit card, and check card information. That breach, the Credit Unions claim, caused them to suffer losses on their cardholder accounts, including for reissuance of cards, reimbursement of their customers for fraud losses, lost interest and transaction fees, lost customers, diminished good will, and administrative expenses associated with investigating, correcting, and preventing fraud. The Credit Unions maintain that Camp's is liable for such damage on the theory that the data breach was caused by Camp's failure to provide adequate computer systems and employee training and/or to maintain adequate encryption and intrusion detection and prevention systems. Based on such allegations, the Credit Unions raise claims against Camp's under Alabama law claims for negligence, wantonness, misrepresentation, and breach of contract, as well as under federal law for violation of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq. Camp's, in turn, has filed the instant action against State Farm, demanding a declaratory judgment under 28 U.S.C. § 2201(a) establishing that State Farm must defend and indemnify Camp's in the underlying action. This court has subject-matter jurisdiction pursuant to 28 U.S.C. § 1332.
The State Farm policy under which Camp's seeks coverage (Doc. 11-3, the "Policy")) contains two principal sections, which are respectively captioned, "Section I — Property" and "Section II — Liability." (Doc. 11-3 at 54-55). The general insuring clause of Section I contains a promise by State Farm to "pay for accidental direct physical loss to ... Covered Property," encompassing "Buildings" ("Coverage A") and "Business Personal Property" ("Coverage B"), to the extent provided in the Declarations. (Id. at 56). "Business Personal Property" is defined to include "Property, used in your business, that you own, lease from others or rent from others, or that is loaned to you," as well as "Property of others that is in your care, custody or control ...." (Id., Coverage B — Business Personal Property, ¶¶ 1, 2). However, "Covered Property" expressly does not include "electronic data." (Id. at 57, Property Not Covered ¶ 9; see also id. at 75, Section I — Definitions ¶ 5). Similarly, the term "Accident" is defined as not including "any defect, programming error, programming limitation, computer virus, malicious code, loss of `electronic data', loss of access, loss of use, loss of functionality or other condition within or involving `electronic data' of any kind." (Id. at 74, Section I — Definitions ¶ 1).
Turning to Section II of the Policy, the "Liability" insurance embodied therein includes a "Coverage L" for "Business Liability." (Id. at 76). The general insuring clause of that section states in relevant part:
(Id. at 76, Coverage L ¶ 1). Section II also contains provisions specifically addressing computers and electronic data. First, the term "property damage" as used in Section II is limited to liability for harm to "tangible property," which is defined not to include "electronic data." (Id. at 89, Section II — Definitions ¶ 21). And expressly excluded from liability coverage under Section II are "damages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data." (Id. at 81-82, Section II — Exclusions ¶ 18).
Camp's claim against State Farm, however, does not rely upon the provisions of either Section I or Section II of the Policy read in isolation. Instead, Camp's theory that State Farm owes it a defense and indemnity is based primarily upon two forms or endorsements attached to the Policy, one entitled, "FE-8743 Inland Marine Computer Property Form" (Doc. 11-3 at 43-46 ("IMCPF")), and the other, "FE-8739 Inland Marine Conditions." (Id. at 40-42 ("IMC")) (collectively the "Inland Marine endorsements"). Together, these contain terms and conditions of "Inland Marine" coverage. Indeed, the only provisions of the Policy that Camp's expressly references in, or attaches to, its complaint are the Inland Marine endorsements. (See Doc. 1 ¶¶ 16, 17; Doc. 1-2).
The IMCPF contains a general insuring provision stating in relevant part as follows:
(Doc. 11-3 at 43). The extension of coverage referenced above, in turn, provides in relevant part:
(Doc. 11-3 at 44). The above-referenced "optional Loss of Income and Extra Expense coverage" in the IMCPF provides in relevant part:
(Doc. 11-3 at 45).
The IMC then outlines certain conditions generally applicable to coverage and claims under IMCPF, including the following:
The following Conditions also apply:
(Doc. 11-3 at 40).
The parties have now filed cross-motions for summary judgment on Camp's claim seeking a declaratory judgment, with each side relying upon the provisions of the Policy and the Credit Unions' complaint in the underlying suit. State Farm filed its motion first. (Doc. 11). Camp's cross-motion followed as part of Camp's response in opposition to State Farm's motion. (Doc. 12). The motions have been fully briefed
Pursuant to Rule 56 of the FEDERAL RULES OF CIVIL PROCEDURE, a party is authorized to move for summary judgment on a claim or defense asserted by or against the movant. Under that rule, the "court shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." FED. R. CIV. PROC. 56(a). "Disposition of a summary judgment motion in a declaratory judgment action is governed by the same basic principles that generally rule the grant or denial of such a motion." Bingham, Ltd. v. United States, 724 F.2d 921, 924 (11th Cir. 1984).
The party moving for summary judgment "always bears the initial responsibility of informing the district court of the basis for its motion," relying on submissions "which it believes demonstrate the absence of a genuine issue of material fact." Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986); see also Clark v. Coats & Clark, Inc., 929 F.2d 604, 608 (11th Cir. 1991); Adickes v. S.H. Kress & Co., 398 U.S. 144 (1970). Where the movant will not bear the burden of proof on a claim or issue at trial, the movant can satisfy that burden by pointing to specific portions of the materials on file that either negate an essential element of the non-movant's claim or that affirmatively indicate "that the party bearing the burden of proof at trial will not be able to meet that burden." Clark, 929 F.2d at 608; see also Four Parcels, 941 F.2d at 1438 & n.19. By contrast, when the moving party has the burden of proof at trial, it must support its motion with credible evidence that would entitle it to a directed verdict if not controverted at trial. Four Parcels, 941 F.2d at 1438. "In other words, the moving party must show that, on all the essential elements of its case on which it bears the burden of proof at trial, no reasonable jury could find for the nonmoving party." Id.
Once the moving party has met its initial burden, the nonmoving party must "go beyond the pleadings" and refer the court to evidence demonstrating that there is a genuine issue for trial. Celotex Corp., 477 U.S. at 324. In its review of the evidence, a court must credit the evidence of the non-movant and draw all justifiable inferences in the non-movant's favor. Stewart v. Booker T. Washington Ins., 232 F.3d 844, 848 (11th Cir. 2000). At summary judgment, "the judge's function is not himself to weigh the evidence and determine the truth of the matter but to determine whether there is a genuine issue for trial." Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 249 (1986).
The fact that each party has filed a motion for summary judgment does not alter the Rule 56 standards applicable to each one. "Cross-motions for summary judgment will not, in themselves, warrant the court in granting summary judgment unless one of the parties is entitled to judgment as a matter of law on facts that are not genuinely disputed." United States v. Oakley, 744 F.2d 1553, 1555 (11th Cir. 1984) (citation omitted); see also Busby v. JRHBW Realty, Inc. d/b/a RealtySouth, 642 F.Supp.2d 1283, 1289 (N.D. Ala. 2009) ("The fact that both parties simultaneously are arguing that there is no genuine issue of fact, however, does not establish that a trial is unnecessary thereby empowering the court to enter judgment as it sees fit," citing Wright, Miller & Kane, Federal Practice and Procedure § 2720, at 327-28 (3d ed. 1998)). "When both parties move for summary judgment, the court must evaluate each motion on its own merits, resolving all reasonable inferences against the party whose motion is under consideration." Muzzy Products, Corp. v. Sullivan Indus., Inc., 194 F.Supp.2d 1360, 1378 (N.D. Ga. 2002) (quoting Gart v. Logitech, Inc., 254 F.3d 1334, 1338-39 (Fed. Cir. 2001)).
In support of its motion for summary judgment, State Farm argues that it has no duty to either defend or indemnify Camp's in the underlying action. First, State Farm asserts that, to the extent Camp's relies upon the IMCPF, that document cannot be read to provide for a defense or indemnity for legal claims brought against the insured by a third party for damage stemming from lost or compromised electronic data. That is so because the IMCPF, State Farm contends, is a "first-party insuring agreement," meaning that it covers losses sustained directly by the insured itself. As such, State Farm insists, the IMCPF is not a "third-party insuring agreement" that may afford a defense and indemnity where the insured is sued to redress a loss suffered by another party, which is what Camp's has demanded. On the other hand, State Farm acknowledges that Coverage L for "Business Liability" in Section II of the Policy does contain a third-party insuring agreement. State Farm maintains, however, that for Coverage L to apply, the third party's claim for damages must be based on allegations that the insured's misconduct caused the third party to suffer "bodily injury," "property damage," or "personal and advertising injury," as those terms are defined in the Policy. And the Credit Unions' claims in underlying suit, State Farm says, do not qualify. For the reasons explained below, the court agrees with State Farm.
The Alabama Supreme Court
Colony Ins. Co. v. Georgia-Pac., LLC, 27 So.3d 1210, 1214-15 (Ala. 2009) (quoting Great Northern Ins. Co. v. Mount Vernon Fire Ins. Co., 708 N.E.2d 167, 170-71 (N.Y. 1999)); see also Aetna Cas. & Sur. Ins. Co. v. State ex rel. Eagerton, 414 So.2d 455, 457 (Ala. 1982) ("[F]irst party claims are those by a policyholder for damage to his property. Third party claims are those of a person contending that a policyholder is liable to him for damage to him."); Toffel v. Nationwide Mut. Ins. Co., No. 2:15-cv-01669-KOB, 2016 WL 4271837, at *7 n. 3 (N.D. Ala. Aug. 15, 2016) ("`First-party' insurance claims involve personal or property insurance," while "`[t]hird-party ... claims involve liability insurance").
To establish that State Farm owes a defense and indemnity, Camp's relies primarily upon the Inland Marine endorsements. (See Doc. 1 ¶¶ 16, 17; Doc. 1-2). However, there is no language in either the IMCPF or the IMC whereby State Farm promises to "defend" or "indemnify" the insured, whether in regard to claims involving computer equipment, electronic data, or anything else, for that matter. Rather, the general insuring agreement of the IMCPF provides: "[W]e will pay for accidental direct physical loss to ... 1. Computer equipment [and] 2. Removable data storage media." (Doc. 11-3 at 43 (emphasis added)). Similarly, the "Extensions of Coverage" in the IMCPF states: "We will pay for accidental direct loss to ... (1). ... (a) `Computer programs used in your business operations; (b) The `electronic data' that exists in `computer' memory or on `computer' storage media, used in your business operations; (2) That portion of your customer' `electronic data' that is supplied to you for processing or other use in your business operations." (Id. at 44 (emphasis added)). Such promises to pay the insured's "direct loss" unambiguously afford first-party coverage only and do not impose a duty to defend or indemnify the insured against legal claims for harm allegedly suffered by others, as in third-party coverage. See RVST Holdings, LLC v. Main St. Am. Assur. Co., 136 A.D.3d 1196, 1198, 25 N.Y.S.3d 712, 714 (N.Y. App. Div. 2016); Butler v. Clarendon Am. Ins. Co., 494 F.Supp.2d 1112, 1129 (N.D. Cal. 2007), aff'd, 317 F. App'x 648 (9th Cir. 2009); Power Eng'g Co. v. Royal Ins. Co. of Amer., 105 F.Supp.2d 1196, 1207 (D. Colo. 2000); Shell Oil Co. v. Winterthur Swiss Ins. Co., 12 Cal.App.4th 715, 765, 15 Cal.Rptr.2d 815, 848 (1993), reh'g denied and opinion modified (Feb. 22, 1993); Edward J. Gerrits, Inc. v. National Union Fire Ins. Co. of Pittsburgh, Penn., 634 So.2d 712, 713 (Fla. Dist. Ct. App. 1994). Therefore, the terms of the IMCPF itself impose no obligation on State Farm to either defend or indemnify Camp's in the underlying action.
Camp's highlights, however, that the IMC provides that, in the event of a covered loss, "[State Farm] may elect to defend [the insured], at [State Farm's] expense, against suits arising from claims of owners of property." (Doc. 11-3 at 40, ¶ 4(d)). Camp's reads such language to mean that State Farm has assumed a duty to defend the insured. The court disagrees. On its face, a policy provision that the insurer "may elect to defend" an insured unambiguously gives the insurer a discretionary choice or right to defend; it does not create a duty, that is a nondiscretionary legal obligation, to do so. See Omega Demolition Corp. v. Travelers Prop. Cas. of Am., No. 14-CV-01288, 2015 WL 3857341, at *4 (N.D. Ill. June 19, 2015); Genaeya Corp. v. Harco Nat'l Ins. Co., 991 A.2d 342, 349 (Pa. Super. Ct. 2010); Stadium Lincoln-Mercury, Inc. v. Heritage Transport, 826 N.E.2d 332, 337 (Ohio Ct. App. 2005); Nourishad v. SCPIE Indem. Co., No. G035218, 2006 WL 1015756, at *11 (Cal. Ct. App. Apr. 19, 2006); see also Stephen E. Goldman & John W. Steinmetz, Property Insurers' Rights and Obligations Under Policy Provisions That Provide Coverage for Personal Property of Others, 32 Tort & Ins. L.J. 787, 798 (1997) ("[T]he ISO Businessowners Standard Property Coverage Form provides that the insurer `may elect to defend [its insured] against suits arising from claims of owners of property.' Under the law of most states, this language does not create an obligation to defend; it merely gives the insurer the right to defend actions filed against its insureds.").
Camp's replies that the IMC language providing that State Farm "may elect to defend" is nonetheless ambiguous in light of other provisions of the Policy. (See Doc. 12 at 11-13). More specifically, Camp's seems to claim that, even if the Inland Marine endorsements themselves do not create or acknowledge a duty to defend, it is undisputed that Coverage L in Section II of the Policy provides liability insurance under which State Farm has assumed a duty to defend and indemnify. According to Camp's, the Inland Marine endorsements expand the scope of liability insurance under Coverage L such that State Farm must render a defense and indemnity for claims based on losses involving computers and electronic data. Again, the court disagrees.
It is true that Coverage L supplies business liability insurance by which State Farm has assumed a duty to defend and indemnify Camp's against certain enumerated legal claims. However, as State Farm argues, Coverage L does not apply to any of the claims in the underlying suit. Coverage L's is triggered where the insured becomes legally obligated to pay damages because of "bodily injury," "property damage," or "personal and advertising injury." (Doc. 11-3 at 76, Coverage L — Business Liability ¶ 1). The underlying suit is brought by incorporated entities who claim purely economic loss as a result of alleged cyber attacks on Camp's computer network that compromised the security of electronic data, specifically, the debit and credit card information of their shared customers. Although State Farm clearly raises arguments that the underlying action does not involve either "bodily injury" or "personal and advertising injury" (Doc. 11 at 16, 20-22), Camp's does not respond to those arguments in its summary judgment brief. Accordingly, Camp's has abandoned those theories as a basis of recovery.
Camp's does argue, however, that the underlying suit seeks damages for "property damage," insofar as the Credit Unions allege that they suffered "losses for replacement customer debit and credit cards." (Doc. 12 at 9 (internal quotation marks omitted); see also Doc. 1-1 at 6, ¶ 8 ("Plaintiffs have incurred significant losses associated with credit and debit card reissuance"); id. at 11, ¶ 36 ("Plaintiffs had to protect their customers and avoid fraud losses; Cards they had issued, and reissue Cards with new account numbers and magnetic stripe information to customers."); id. ¶ 37 ("The cancellation and reissuance of cards resulted in damages and losses to Plaintiffs."). Camp's acknowledges that, for purposes of Coverage L, "property damage" is limited to "tangible property" and that "electronic data is not tangible property." (See Doc. 11-3 at 89, ¶ 21). Camp's suggests, however, that, since "the physical debit cards are not only `electronic data,' but are [also] tangible property that can be touched and handled," (Doc. 12 at 9), the Credit Unions' claimed losses connected with replacing the cards is covered "property damage."
But even if credit and debit cards are tangible property, Camp's argument is fatally flawed. The Credit Unions do not assert that Camp's acts or omissions caused physical harm or damage to any cards as tangible property. Rather, the Credit Unions assert that Camp's lax computer network security allowed the intangible electronic data contained on the cards to be compromised such that the magnetically encoded card numbers could no longer be used, causing purely economic loss flowing from the need to issue replacement cards with new electronic data. Moreover, Coverage L is subject to an exclusion for "damages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data." (Id. at 81-82, Section II — Exclusions ¶ 18). As a result, the Credit Unions' claims for damages arising out of Camp's allegedly unlawful handling of electronic data on the credit cards are not claims for "property damage" under the Policy and are excluded from coverage. See RVST Holdings, 136 A.D.3d at 1198, 25 N.Y.S.3d at 714; see also American States Ins. Co. v. Martin, 662 So.2d 245, 249 (Ala. 1995) (insureds' purely economic loss was not covered as "property damage" under liability policy); Carole Basri, Mary Mack, eDiscovery for Corporate Counsel § 17:7 ("[C]ase law reveals that organizations may have a difficult time obtaining coverage under a CGL policy for claims arising from a cyber-breach.").
Nor do the provisions of Coverage L render the Inland Marine Endorsements ambiguous as it relates to a duty to defend. In essence, Camp's agues that, even if neither Coverage L nor the Inland Marine endorsements by their own terms apply to the Credit Unions' claims in the underlying action, if one takes the duty to defend from the third-party coverage of former and the first-party coverage for electronic data loss from the latter, read together they form an amalgamation providing liability insurance against claims for electronic data loss. That, however, is simply not what the Policy provides. Camp's suggests that it is merely interpreting the different coverages of the Policy as an integrated whole. But what Camp's is actually doing is selectively reading the Policy in a piecemeal fashion, picking and choosing parts of different coverages while conveniently ignoring other terms from those same coverages that would preclude or exclude their application to the Credit Unions' claims. Moreover, it is clear that, contrary to Camp's assertion, the provisions of the Inland Marine endorsements stand distinctly separate and apart from the business liability insurance afforded by Coverage L and do not expand it. Rather,
AJC Int'l, Inc. v. Triple-S Propiedad, 790 F.3d 1, 9 (1st Cir. 2015). In the end, the Inland Marine endorsements afford only first-party coverage for certain computer equipment and electronic data, as specified in the IMCPF. Those endorsements do not create, recognize, or assume the existence of a duty to defend or indemnify against claims brought by third parties. As such, the Inland Marine endorsements are properly read as expanding or otherwise modifying not the third-party liability insurance of Coverage L in Section II of the Policy but rather the first-party property insurance of Section I, which, like the IMCPF, contains promises by State Farm to pay the insured's "direct loss" to enumerated property. (See Doc. 11-3 at 56 ("[W]e will pay for accidental direct physical loss to ... Covered Property")). The court concludes that the language of the Policy is unambiguous and does not impose a duty on State Farm to defend or indemnify Camp's in the underlying action.
Based on the foregoing, State Farm's motion for summary judgment (doc. 11) is due to be
Flowers also does not aid Camp's cause. There the issue was whether a general commercial liability (GCL) policy permitted the insurer to terminate its duty to defend at such time as the policy limit of $25,000 is exhausted through the expenditure of attorney's fees and costs. See 761 S.E.2d at 792. Ultimately, the court determined that the provisions in the "GCL coverage and [a] supplementary payments parts of the policy ... regarding the duty to defend" were "contradictory to [an] endorsement" and that such "contradictory and confusing provisions creat[ed] significant ambiguity in the entire policy." Id. at 796. Construing such ambiguity in favor of the insured, the court held that the policy did not allow the insurer to terminate its duty to defend through expenditure of policy limits on attorney's fees and costs. Id. But again, in the case sub judice, there simply are not "contradictory" provisions as it might relate to State Farm's duty to defend the claims in the underlying action. To the contrary it is clear that State Farm has no duty to defend either under the Inland Marine endorsements, which afford only first-party coverage, or under the business liability provisions of Coverage L, which do not reach or otherwise exclude coverage for the Credit Unions' claims based on allegedly deficient cyber-security.