The Bakery With One Policy and Three Problems
Sunrise Bakery carries a businessowners policy with $2 million general liability, $500,000 on the building, $150,000 business personal property, and a $10,000 deductible. It has no other commercial coverage. In a single month: (1) an employee delivering a wedding cake in her personal auto rear-ends a minivan, injuring two people, and the injured driver sues the bakery; (2) a customer with a severe tree-nut allergy is hospitalized after eating a muffin labeled "nut-free" and demands $60,000; (3) a departing bookkeeper's credentials are used to delete three years of order and payroll records, and the bakery pays $22,000 for data recovery before learning that customer card numbers were posted online.
1. For each of the three events, state whether the BOP responds and identify the gap and the coverage that would fill it.
Read the worked answer
(1) Auto accident. The BOP's general liability excludes bodily injury arising out of the use of an auto. The employee's personal auto policy excludes delivery for a fee, so both policies are likely to deny. Gap: commercial auto, or hired and non-owned auto liability added to the BOP. Highest frequency exposure of the three.
(2) Allergic reaction. Products-completed operations coverage under the GL section responds to bodily injury arising from the bakery's product away from the premises. Baking is not a "professional service," so that exclusion does not apply. Expect coverage subject to the deductible, with a possible recall/withdrawal expense question if the muffins were pulled from shelves.
(3) Data loss and breach. BOP property forms typically limit or exclude electronic data as covered property, and there is no coverage for privacy liability, notification costs, or regulatory defense. Gap: cyber liability with data restoration, breach response, and network security/privacy liability.
A weak answer stops at "excluded"; a strong one names the missing line of coverage.
2. Rank the three exposures by urgency and explain the reasoning.
Read the worked answer
Rank by frequency plus severity plus legal deadline, not by dollar size alone.
- Auto/valet-type exposure (highest frequency): delivery happens daily, one incident already produced two injuries, and there is no coverage anywhere in the program. It is also the cheapest to fix.
- Cyber (hard deadlines): the data is already public. State breach-notification statutes impose short clocks (often 30–60 days from discovery), and card-brand rules impose separate obligations. Every day of delay adds regulatory and contractual exposure that no policy can undo.
- Products liability (covered but serious): the claim is large in human terms but the BOP's $2 million limit is available, so it is a claims-management problem rather than a coverage gap.
The advice to the owner: tender claim (2) to the carrier, do not admit liability to the customer, preserve the labeling records, and engage breach counsel for (3) before notifying anyone.
3. The bakery owner asks whether the $22,000 recovery bill and the customer notification costs will be reimbursed. What do you advise?
Read the worked answer
Advise that reimbursement is unlikely under the current program and cannot be created after the fact.
- Electronic data is usually excluded or sub-limited under BOP property coverage, and voluntary breach response costs are not "direct physical loss" to covered property.
- Retroactive cyber coverage is not available for a known incident; buying a cyber policy now will not cover this event, and misrepresenting the discovery date on a new application would be application fraud.
- Mitigation is the right move regardless: preserve logs, contain the exposure, document costs (they may be recoverable from the vendor whose credentials were misused), and consult counsel on notification duties.
The forward-looking advice: bind cyber coverage with an effective date going forward, and add hired/non-owned auto, before the next delivery run.