Now that I have your attention -- given how popular cyber coverage issues are these days -- the recent Pennsylvania trial court decision in Penn-America Ins. Co. v. Toni Tomei t/a Sunkissed Tanning & Spa, No. 3917 of 2012 (Pa. Ct. Comm. Pl., Westmoreland Cty. Feb. 19, 2015) is worthy of discussion. On its face, the case has nothing to do with cyber coverage. But, in fact, it does.

At issue in Sunkissed Tanning was coverage for a tanning salon for claims brought against it by female patrons who were surreptitiously videotaped while unclothed during tanning sessions. The videos were subsequently posted on the internet for public viewing. Plaintiffs alleged humiliation, embarrassment, shame, mental anguish and mental trauma as a result of discovering images of themselves nude on the internet. The plaintiffs essentially alleged that the defendants were negligent in failing to prevent what happened.

Sunkissed Tanning was insured under commercial general liability policies issued to it by several insurers during the time period in question. At issue, at the outset, was trigger of coverage and whether the plaintiffs sustained bodily injury.

The court disposed of the trigger issue with ease – concluding that the triggered policy for each plaintiff was the one on the risk at the time that she discovered the publication of the offending videotape on the internet. That is when each plaintiff manifested an injury. Using this analysis, one of the insurers was not triggered for any plaintiff as its policy was off the risk before any plaintiff manifested an injury. Another insurer was on the risk when nine plaintiffs learned of the positing of the video and for a third insurer the trigger test was satisfied for 28 plaintiffs.

However, even for the two insurers whose policies were on the risk at the time of manifestation, the court held that no coverage was owed because none of the plaintiffs alleged that they sustained bodily injury, as none alleged “physical manifestations attendant to or symptomatic of the claims for emotional or mental distress.” The law in Pennsylvania, on the issue whether emotional injury qualifies as bodily injury, is on the confusing side. Given how Pennsylvania-based this issue is, and with the real objective here to address the case’s relevance to cyber coverage, I’ll skip it.

Now, speaking of cyber, the court, as you would expect, addressed the potential for coverage under Part B of the policies for invasion of privacy, more specifically: “injury, including consequential ‘bodily injury,’ arising out of one or more of the following offenses: e. oral or written publication, in any manner, of material that violates a person’s right of privacy.”

The court held that no coverage was owed because “[t]he publishing of videotapes and photographs are not publications that would be generally defined as either ‘oral’ or ‘written’ under the plain meaning of those terms.” [The court also held that, even if “oral or written publication” includes videotapes or photographs, an exclusion for violation of a statute, prohibiting the distribution of material or information, served to preclude coverage.]

So “oral or written publication” does not include videotapes or photographs. If this is so, it certainly closes the door to commercial general liability coverage for some potential consequences of a hacking incident [to the extent that door was open in the first place.] After all, hackers often seek maximum exposure for their handiwork -- and posting to the internet is of course how that is achieved. And not ever cyber attack is for purposes of gaining access to personally identifiable information, credit card numbers or medical records. [Just ask some Hollywood celebrities who’ve learned this recently.] So if an insured is hacked, and it results in the posting on the internet of videotapes or photographs, Coverage B would not be triggered for claims brought against it (to the extent it was otherwise triggered). This being so, a determination that “oral or written publication” does not include videotapes or photographs is not without potential consequences for the availability of coverage.

True, a trial court decision, from Westmoreland County, Pennsylvania, may not carry a lot of weight. But these days, with the lines for cyber coverage still being drawn, all decisions that could have an implication are worthy of note.

[In the interest of full disclosure, Penn-America Ins. Co. was represented by my White and Williams colleagues Gale White and David Edwards.]