Court File and Parties

COURT FILE NO.: CV-19-622016 & CV-19-614174 & CV-18-592861 DATE: 20200508 SUPERIOR COURT OF JUSTICE - ONTARIO

RE: Laridae Communications Inc., Applicants AND: Co-operators General Insurance Company, Respondents

AND: Family and Children Services of Lanark, Leeds and Grenville, Applicants AND: Co-operators General Insurance Company, Respondents

AND: Co-operators General Insurance Company, Applicants AND: Laridae Communications Inc., Respondents

BEFORE: Pollak J.

COUNSEL: Brian Chung, for the Applicant Laridae Communications Inc. Ken Gerry, for the Respondents Co-operators General Insurance Company David Boghosian, for the Applicants FCSLLG

HEARD: February 10, 2020

Endorsement

Overview

[1] Three Applications are being heard together. One Applicant, Laridae Communications Inc. (“Laridae”), brings an Application for a declaration that the Respondent, Co-Operators General Insurance Company (“Co-Operators”), owes it a duty to defend it in proceedings in Court File No. CV-18-00598677-0000 (the “Third Party Claim”). Co-Operators denies that it owes Laridae a duty to defend based on two “data exclusion” clauses contained in two insurance policies, covering Laridae.

[2] Co-operators did not dispute that the relevant proceedings are covered under the coverage clauses of the two insurance policies but relies on the “data exclusion” provisions to deny a duty to defend. The parties agree that there is no jurisprudence on the proper interpretation of data exclusion clauses.

[3] Laridae is insured under two Policies of insurance by Co-Operators - a Commercial General Liability policy (Policy No. 6376113) (the “CGL Policy”); and a Professional Liability/Errors & Omissions policy (Policy No. 6402620) (the “E&O Policy”), (the “Policies”).

[4] Under the CGL Policy, Co-Operators agreed to provide coverage to Laridae for sums that it becomes legally obligated to pay as compensatory damages because of “personal injury” to defend Laridae in any “Proceeding” seeking such compensatory damages.

[5] The term “personal injury” under the CGL Policy means injury other than “bodily injury”, arising out of one or more of the following offences:

a. “False arrest, detention or imprisonment; b. Malicious prosecution; c. Wrongful entry into, or eviction of a person from, a room, dwelling or premises that the person occupies; d. Oral or written publication of material that libels or slanders a person or organization or disparages a person’s or organization’s goods, products or services; or e. Oral or written publication of material that violates a person’s right to privacy.”

[6] Under the E&O Policy, Co-Operators provides coverage to Laridae for sums that it is legally obligated to pay as compensatory damages resulting from “Claims” by reason of liability for any error, omission or negligent act in the course of providing “Professional Services” and Co-Operators agreed to defend Laridae in any Proceedings or arbitrations for compensatory damages payable under the terms of the policy.

[7] Co-Operators denies that it has any duty to defend Laridae under either insurance policy based on the “data exclusion” clauses which eliminate coverage.

[8] Another Applicant, Family and Children’s Services of Lanark, Leeds and Grenville (FCS) brings an Application pursuant to Rule 14.05(d) of the Rules of Civil Procedure against the Co-operators for:

a. “A declaration that the Co-operators is obligated to defend it in Proceeding No. CV-16-55724400CP at Toronto (“the Main Proceeding”), pursuant to its Commercial General Liability Policy of Insurance issued in favour of FSC (Policy No. 006376113 (“the Policy”)); b. A declaration that FCS can retain and instruct counsel of its choice to be paid by Co-operators and that such counsel does not have to report to the Co-operators; c. An Order requiring the Co-operators to reimburse it for all defence costs incurred to date in defending the Proceeding”.

[9] Laridae was retained by FCS to “recommend and implement communication” strategies. Its mandate was to “review and refresh” FCS’s website to ensure that the new website and its components are compliant with privacy and other legislative requirements. Laridae advised FCS on issues relating to the design and security of its website.

[10] Co-operators issued the CGL policy to Laridae as the primary insured and FCS as an additional insured. FCS is an additional insured on Laridae’s CGL Policy.

[11] FCS requested Co-operators to defend and indemnify it in a Class Proceeding against it. Co-operators refused to defend based on the “data exclusion clause” which excludes “any liability arising from the display or distribution of data on the Internet or any system or device intended for electronic communication”.

[12] Co-operators also brings an Application asking for an Order declaring that it does not have a duty to defend nor indemnify Laridae in the claim brought by FCS in Court File No. CV-19-614174, under either of the two insurance policies.

The Litigation

[13] In 2016, an unauthorized party accessed documents from a secured section of FCS’s website in which documents for authorized users and accessible only with passwords were uploaded. After this unauthorized act, Laridae advised FCS that it had implemented additional security features for the secured section of the website and advised FCS to do nothing to remove any of those confidential documents.

[14] That unauthorized user accessed the documents again and downloaded a file containing a written report (the “Report”) which was posted on various internet sites and accessible to the public. This report allegedly contained personal information about 285 persons who had been subjects of FCS’s investigations between April and November 2015.

[15] A class Proceeding was brought against FCS seeking general, special and punitive damages for $75 Million (“the Class Proceeding”). In the Class Proceeding, the representative plaintiff alleges breaches of privacy rights as a result of the alleged publication of a defamatory and untrue report containing personal information. The Proceeding claims that FCS’s failure to properly secure its website caused the personal information of the Class Members to be available to the public. The Statement of Claim is broadly worded alleging several Proceedings against the Applicant as a result of the Report being published on the Internet by the unauthorized user, including but not limited to negligence, defamation, negligent misrepresentation, intrusion upon seclusion, breach of confidence and breach of fiduciary duty.

[16] In the Third-Party Claim, FCS alleges that Laridae breached its contractual obligations and was negligent in providing services to it under their Communications Services Contract.

[17] FSC’s Proceeding against Laridae claims contribution and indemnity from Laridae for damages FCS will suffer. The Class Proceeding includes allegations for damages against FCS arising from the publication of such information. Laridae and FSC argue that damages claimed are not limited to damages arising from electronic distribution through the internet but are broad enough to include damages arising from physical distribution.

[18] In its Third-Party Claim against Laridae, FCS does not limit its claim to contribution and indemnity in respect of the Class Proceeding claims, but also makes claims for general and special damages. FCS claims that Laridae provided inaccurate advice; made negligent misrepresentations; and breached contractual obligations to prevent unauthorized users from accessing private documents and pleads independent claims for damages arising from such alleged negligence.

[19] The Third-Party Claim seeks contribution and indemnity in respect of the Class Proceeding, but also advances independent claims and allegations that go beyond such claims. In particular, the Third-Party Claim seeks both general damages and special damages. The claims and allegations in this regard are not limited to the events in the Class Proceeding. They are based on Laridae’s contractual obligations and duty of care to FCS. In particular, FCS alleges that:

a. Laridae breached the standard of care as a result of inaccurate advice provided; b. Laridae made negligent representations to FCS regarding the security of its website following an incident in February 2016 when the alleged hacker accessed non-public documents. The Class Proceeding relates only to the later April 2016 incident when the non-public documents were allegedly made publicly available. This allegation is unique to the Third-Party Claim; and c. Laridae failed to take necessary steps to prevent unauthorized internet users from accessing non-public documents.

[20] Laridae submits that the allegations in the Claims are covered under the Policies as:

a. under the CGL Policy, coverage is available for “personal injury”, which includes injuries arising out of oral or written publication of material that libels or slanders a person, and that violates a person’s right to privacy; and b. under the E&O Policy, coverage is available for liability resulting from errors, omissions or negligent acts “in the course of providing professional services.”

[21] Laridae submits that the Third-Party Claim is pleaded broadly and appears to include additional claims and allegations which are covered under the Policies and can not possibly be excluded by the Data Exclusion Clauses relied on by Co-operators. For example, FCS’s claim for special damages may include costs for retaining contractors to rectify errors allegedly made by Laridae. Co-Operators would be obligated to defend Laridae in respect of those claims.

[22] It submits that as the Claims fall within the coverage provided by the Policies, the onus shifts to Co-Operators to demonstrate that the Claims fall within an exclusion clause contained in the Policies. I agree.

Data Exclusion Clauses

[23] The “data exclusion” clause contained in the E&O Policy provides as follows:

Data Exclusion

There shall be no coverage under this policy in connection with any claim based on, attributable to or arising directly, or indirectly from the distribution or display of “data” by means of an Internet Website, the Internet, an Intranet, Extranet, or similar device or system designed or intended for electronic communication of “data”.

[24] The “data exclusion” clause contained in the CGL Policy (wherein Laridae is the primary insured and FCS is an additional insured) states:

Data

a. Liability for:

1. erasure, disruption, corruption, misappropriation, misinterpretation of “data”;
2. erroneously creating, amending, entering, deleting or using “data”; Including any loss of use therefrom; b. “Personal injury” arising out of the distribution or display of “data” by means of an Internet Website, the Internet, an intranet, extranet, or similar device or system designed or intended for electronic communication of “data”.

(the “Data Exclusion Clauses”)

[25] The definition of “data” under both Policies is defined as “representations of information or concepts, in any form.”

Law

[26] The parties are agreed on the law to be considered on these Applications. It is important to note that these are “duty to defend” and not “duty to indemnify” proceedings. Our Courts have held that even where only some claims are covered under an insurance policy, the insurer has a duty to defend the insured for the whole claim.

[27] The Ontario Court of Appeal in Tedford v. TD Insurance Meloche Monnex, 2012 ONCA 429, has held that if there is any possibility that a claim falls within liability coverage of an insurance policy, the insurer must defend the insured. The Court outlined the following principles:

a. “an insurer has a duty to defend if the pleadings filed against the insured allege facts, which if true, would require the insurer to indemnify the insured; b. if there is any possibility that the claim falls within the liability coverage, the insurer must defend; c. the court must try and ascertain the substance and true nature of the claims; d. if the pleadings are not sufficiently precise to determine whether the claims would be covered by the policy, the insurer’s obligation to defend will be triggered where, on a reasonable reading of the pleadings, a claim within coverage can be inferred; and e. in determining whether the policy would cover the claim, the usual principles governing the construction of insurance contracts apply, namely: the contra proferentem rule and the principle that coverage clauses should be construed broadly and exclusion clauses narrowly.”

[28] The Claims in these Applications are broad and comprehensive and not limited to the distribution of the Report on the internet. The Claims do include damages for non-electronic distribution (i.e. physical distribution) of the report or other private information. Paragraph 19 of the Statement of Claim in the Class Proceeding asserts that “the personal information of the class members can be accessed by any unauthorized third party who accessed the information, bought the information, or found the information posted on the internet…”

[29] If this Court finds that the Policies cover at least some of the allegations in the litigation, Co-Operators has a duty to defend on all of the Claims. The insurance policies contain an unqualified obligation to defend for these claims. The Policies have no provision limiting the application of Co-Operators’ duty to defend in respect of “mixed” claims.

[30] In Hanis v. University of Western Ontario, 2008 ONCA 678, the Ontario Court of Appeal has held that if some but not all of the claims are covered by an insurance policy, and there is an unqualified obligation in the policy to defend, the insurer must pay all reasonable costs associated with the entire defence.

[31] As mentioned above, there is no dispute that the allegations in the litigation are covered by the insurance policies as coverage is provided for oral and written publication of materials that is defamatory or a violation of a person’s right of privacy. The only issue on these applications is whether the “Data Exclusion” clauses clearly negate the duty to defend.

[32] Co-Operators has the burden of proving that the substance of the claims in this litigation clearly fall within the data exclusion clauses. The insureds make submissions regarding the enforceability of these data exclusion clauses. They rely on the argument that the courts will not enforce exclusion clauses which have the effect of nullifying the insurance which the insurer undertook to provide. They submit that Co-operators should not provide general coverage but rely on broadly worded exclusions which would have the effect of eliminating the coverage which it contracted to provide. It is submitted that this is an important issue on these Applications and that a court should not determine this issue in a “duty to defend” application, where such data exclusion clauses have not yet been judicially considered by our courts. I agree that such a novel interpretive issue should be considered on a full record and not in these Applications.

[33] The insureds submit that the interpretation of the exclusionary clause, as emphasized by Co-operators, is not conclusive in determining whether Co-operators has a duty to defend. As a result of imbalance of negotiating power as between insureds and insurers, interpretive principles have been developed to protect consumers of insurance policies. One of these most fundamental principles is that literal meanings of the policy should not be applied if it would render an unrealistic result wherein coverage provided by the insurance is virtually nullified or would be contrary to the reasonable expectations of the parties at the time the policy was concluded. Courts are to examine the terms of the policy considering the surrounding circumstances in order to determine the intent of the parties and the scope of their understanding.

[34] Further, the insureds submit that exclusion clauses should not be enforced, if enforcement would be inconsistent with the main purpose of the insurance coverage, and where it would be contrary to the reasonable expectations of the ordinary person who purchased coverage. The Data Exclusion Clauses would nullify coverage for a significant portion of the services provided by Laridae. The insureds argue that Laridae’s business is to create and handle “data” as that term is defined in the Policies. Such data is routinely “distributed” or “displayed” using the internet or similar forms of technology. It would not make commercial sense that Co-Operators be permitted to sell comprehensive insurance policies and rely on “Data Exclusion” clauses that are so broad that they have the effect of nullifying virtually all the coverage which the insurer contracted to provide.

[35] Most importantly, it is argued that it can not be that such an effect would have been within the parties’ reasonable expectations.

[36] I agree that until the courts have had an opportunity to adjudicate the complex issues raised by these broadly worded data exclusion clauses, it would be improper for this court, having regard to present jurisprudence to uphold Co-operators’ denial of a duty to defend. Further, I can not find on these Applications that Co-operators has shown that there is no possibility of coverage. I find that Co-Operators has not discharged its onus of establishing that the substance of the Claims clearly fall within the Data Exclusion Clauses and that there is no possibility of coverage under the Policies. Rather, in addition to the issue of the interpretation of the data exclusion clauses, it is apparent that there are claims and allegations in the Class Proceeding and the Third-Party Claim that would not excluded by the Data Exclusion Clauses. As there is at least some possibility that the Claims are covered under the Policies, I find that Co-Operators owes a duty to defend Laridae and FCS.

[37] The Applications of Laridae and FCS are therefore granted, with the Court declaring that Co-operators has a duty to defend Laridae in the Third-Party Claim and a duty to defend FCS in the Class Proceeding. With that duty to defend, if there is a conflict of interest, due to competing interests as between the insureds Laridae and FCS, Co-operators must fund each defence with independent counsel, which does not report to Co-operators. The Court declares that Co-operators has the obligation to reimburse these Applicants for all their reasonable defence fees incurred after the date that their demand for a defence was made. There was no evidence presented or submissions made, on the amount of these costs. Co-operators Application is therefore dismissed.

Costs

[38] The parties have reached an agreement on costs to be awarded on a partial indemnity basis to the successful party on these Applications. The successful parties, the Applicants Laridae and FCS, are therefore each awarded their costs on a partial indemnity basis equal to $30,000 in accordance with the agreement of the parties.

[39] Notwithstanding Rule 59.05, this Order is effective from the date it is made, and if enforceable without any need for entry and filing. In accordance with Rules 77.07(6) and 1.04, no formal Order need be entered and filed unless an appeal or a motion for leave to appeal is brought to an appellate court. Any party to this Order may submit a formal Order for original signing, entry and filing when the Court returns to regular operations.

Pollak J. Date: May 08, 2020