This is one installment in a series of presentations prepared by ThinkRisk Underwriting Agency discussing the converging media and technology-related risks faced by various industry segments. This installment discusses risks faced by law firms, accounting firms, real estate and insurance professionals, and other professional firms.

The Convergence Phenomenon:

Digital technology is a powerful tool that has changed the way professional firms and other businesses operate. Digital technology has unleashed corporate creativity, leading to new products and services, new ways to manage and store data, and new ways to interact and communicate with clients and other constituencies. At the same time, digitization and the way it permits companies to gather, create, distribute and store information and media content has altered the risks of doing business for professional firms in a fundamental way, and exposes inadequacies in the current insurance response to these new risks.

Content:

Professional firms create and use media content in a variety of ways. First, like other industries, firms increasingly use trademarks and other intellectual property to create and build brands, which is critical to attracting new clients. Law firm, accounting firm and other professional firm trademarks can become extremely valuable assets, and firms will guard them zealously. Second, professional firms that have historically shied away from traditional advertising are starting to embrace it. Most firms now engage in a variety of advertising and marketing techniques, ranging from traditional advertising, to newsletters and other publishing activities, to more cutting-edge marketing campaigns including interactive websites, social networking and viral marketing. All of this activity involves content creation, and carries all the exposures of any media outlet. For instance, copyright and trademark infringement can arise from the unlicensed use of articles, artwork, slogans, music or any other expressive element. Moreover, because technology allows firms to create and distribute content easily and inexpensively, and because many professional firms pride themselves on competence and independence, many firms engage in these marketing and content-development activities in-house, without the help of advertising or marketing firms, legal review or other risk management.

As a result, there are many examples of media and intellectual property claims involving professional firms, including the following:

• In August 2010, the Southeastern Pennsylvania Transportation Authority (SEPTA) sued Mednick Mezyk & Kredo, a local personal injury firm, for using SEPTA’s trademark in the firm’s advertising. The firm represented plaintiffs that were injured in transportation-related accidents. According to the Complaint, the firm infringed SEPTA’s intellectual property by, among other things, operating a website called www.myseptalawyer.com and displaying a picture of a bus bearing the SEPTA logo.
• Des Moines-based Principle Financial Group is suing Las Vegas-based Principle Financial Resources for trademark infringement. Principle Financial Group was formed in 1985 and went public in 2001, operates in several countries and has around 14,400 employees. Principle Financial Resources was named in 2009 after being part of the accounting firm Deloitte & Touche from 1994-1998. In the lawsuit, Principle Financial Group says that it has invested close to $1 billion in advertising, marketing and trademarking its intellectual property.
• A photographer in Minneapolis sued a real estate and mortgage services firm in 2006 for using two of his photographs without his permission in advertisements in a local phone directory. The photographer won a verdict in his favor in federal court. It didn’t end there: After the photographer posted a summary of the case on his website, the firm sued for defamation, and the photographer brought his own suit for malicious prosecution.

Data Security and Data Privacy:

Perhaps even more so than most other commercial businesses, data is the lifeblood of most professional firms. They collect and store massive quantities of detailed information about clients, often including the most sensitive personal and financial information. An insurance agency, for example, maintains extensive personal and financial information about its personal lines and benefits customers. A law firm, likewise, has voluminous information about clients, particularly if it represents individuals or does class action work. This data can be a powerful business tool, but carries the responsibility to avoid a breach of security. In the event of a data breach, state laws in most jurisdictions require the company to notify all potentially impacted persons of the breach, the cost of which can be astronomical. Moreover, many types of professional firms have ethical obligations to keep certain client information confidential. If data security is breached and the information is used in a way that is damaging, the company could face liability claims, and its reputation and professional standing in the marketplace may be seriously damaged. Despite these risks, professional firms’ data security practices are often not state-of-the-art, either because the firm lacks the resources or expertise, or because it is fully occupied with its day-to-day professional activities.

There are many examples of data breaches involving professional firms. Many breaches are the result of intrusions from hackers and thieves, but the simple loss of a laptop is also a frequent cause of incidents. Some breaches in this industry segment include:

• In March 2011, computers and hard drives went missing at Wheeler & Associates, an accounting firm in Florida. This missing data included names, social security numbers and addresses.
• In July 2008, sheriff’s deputies uncovered boxes of files in a dumpster at the Houston office of the Weber Law Firm. The boxes contained personal financial records, social security numbers and individual medical files.
• In December 2010, an unauthorized person obtained login information at California law firm Samuels, Green and Steel, and gained access to individual consumer credit reports. An unknown number of records were compromised.
• In 2009, a computer was stolen from the offices of Freeney Insurance Agency, compromising an unknown number of records. The data included names, dates of birth, and social security numbers. The agency reported the incident to the Maryland Attorney General’s office.
• In October 2007, a computer tape went missing after being shipped from the office of the West Virginia Public Employees Insurance Agency. The tape held names, addresses and social security numbers of approximately 200,000 individuals. After an extensive search, the tape was not located and all 200,000 people were notified of the breach.
• ACS: Law is a United Kingdom law firm that, among other things, tracks down illegal file-sharers of adult videos. In 2010, the law firm’s database was compromised, resulting in disclosure of confidential personal and financial client information, including most notably the names of thousands of individuals whom the law firm had accused of downloading unauthorized copies of adult movies. The list of names was subsequently posted on the Web.

Coverages in the Standard Insurance Marketplace:

Although most firms purchase Commercial General Liability (“CGL”) coverage, typical CGL policies provide limited coverage for media and data security claims. Intellectual property claims are largely excluded, except for copyright in “advertisements,” which is narrowly defined. The result is that trademark and other intellectual property infringement (including copyright claims outside of traditional “advertising”) will likely not be covered by the CGL. Similarly, website content is generally not covered, unless the content is considered “advertising.” Chat rooms, bulletin boards and other interactive media are often excluded. Data breaches and the attendant costs are generally outside the scope of the CGL. Even when such coverage can be found, it is generally not robust, and the carrier may not have the necessary legal expertise to deal with highly specialized or technical claims.

The Converging Risk Liability Policy from ThinkRisk addresses these unique and emerging exposures, and fills the gaps left by traditional policies. The policy is “modular” and can therefore be customized to meet the needs of the particular institution. Coverage Part A of the Policy provides coverage for claims arising out of the distribution of content, whether by print, electronic or any other means, including social networking techniques. Coverage Parts C and D provide data security coverage, both for liability claims brought against the firm (Part C) and for certain costs incurred by the firm in responding to a breach (Part D), such as the cost of notifying impacted persons.

For questions or to obtain a quote , please contact Momentous Insurance Brokerage at 818.933.2700.

Source: ThinkRisk Underwriting Agency

Disclaimer: The above content is a general overview which is provided for discussion purposes only and is not in any way meant as providing recommendations or legal counsel. It is not intended to apply to each circumstance. Because the facts and circumstances of every matter differ and the terms, conditions, exclusions and limitations contained in insurance policies vary, you should review your policy carefully and seek any legal counsel that may be necessary or appropriate.  Momentous is not responsible for any losses or damage resulting from reliance on the information contained herein.