Broker found at fault over Lloyd’s, Hiscox, QBE policy mess up
Insurance Business Magazine reports:
A landmark High Court judgment has laid bare the cost of professional negligence in insurance broking and clarified the application of “double” and “triple” insurance provisions, handing significant implications for brokers, insurers, and risk managers across the UK.
In a closely watched ruling, Deputy High Court Judge David Bailey KC found that Arthur J. Gallagher Insurance Brokers Limited was liable to Watford Community Housing Trust (WCH) for failing to ensure timely notification of a data breach to all relevant insurers – a breach of duty that deprived the claimant of up to £5 million in potential indemnity.
While Gallagher admitted negligence, it had argued that the loss was nullified by the complex web of insurance policies in place. The court, however, disagreed – a decision that exposes the broker to potentially millions in damages and redraws the boundaries of how layered insurance coverages interact when notification failures occur.
The origins of the dispute date back to March 2020, when a WCH staffer accidentally emailed a spreadsheet containing sensitive personal data – including sexual orientation and ethnicity – of over 3,500 tenants and employees. The fallout was immediate, prompting more than 1,100 complaints and triggering potential legal liabilities that now extend beyond £6 million.
At the time of the breach, WCH was insured under three separate policies, all arranged by Gallagher:
- Cyber policy: £1 million limit, underwritten by PEN/Lloyd’s syndicates
- Combined policy: £5 million limit, underwritten by QBE
- Professional indemnity (PI) policy: £5 million limit plus defence costs, underwritten by Hiscox
Gallagher advised WCH to notify only the cyber insurers. By the time the PI and combined insurers were informed, the coverage periods had expired. Hiscox refused coverage, while QBE eventually agreed to indemnify under its policy.
Gallagher’s key argument – that the other insurance clauses in the policies effectively “cancelled each other out,” rendering no additional liability even if Hiscox had been timely notified – was rejected.
Judge Bailey ruled that all three “other insurance” clauses were ineffective when read together, creating a “horizontal” stack of coverage rather than limiting the payout to the highest individual policy limit. In lay terms, this meant that WCH was entitled to the full £11 million aggregate indemnity (Cyber: £1M + Combined: £5M + PI: £5M), not a cap of £5 million as Gallagher asserted.
Read more at Insurance Business Magazine.
