The Florida Supreme Court recently held that a commercial general liability (“CGL”) insurance policy that provides coverage for an “advertising injury” covers a violation of the Telephone Consumer Protection Act (“TCPA”). The definition of “advertising injury” in the CGL policy at issue provided coverage for an “injury arising out of” the “[o]ral or written publication of material that violates a person’s right of privacy.” In finding that coverage existed, the court noted that the TCPA protects the privacy right to seclusion.

On May 9, 2008, Iowa Governor Chester Culver signed legislation (SF 2308) requiring any person who owns or licenses computerized data that includes a consumer’s personal information to give notice of a breach of security. The law does not require notification if, after an appropriate investigation or after consultation with the relevant federal, state, or local agencies responsible for law enforcement, the person determined that no reasonable likelihood of financial harm to the consumers whose personal information has been acquired has resulted or will result from the breach. Following is an updated list of the 43 state security breach notification laws (plus District of Columbia and Puerto Rico).

Virginia, West Virginia, and South Carolina are the latest states to pass data breach notification laws, bringing to 42 the total number of states with such laws on the books (including the one state with a law that applies only to public entities, Oklahoma). Listed below are the 41 states with laws that apply to private entities (plus the District of Columbia and Puerto Rico).