Watford Community Housing Trust v Arthur J. Gallagher Insurance Brokers Limited [2025] EWHC 743 (Comm)

[2025] EWHC 743 (Comm)

Case No LM-2024-000312

IN THE HIGH COURT OF JUSTICE

BUSINESS AND PROPERTY COURTS

OF ENGLAND AND WALES

LONDON CIRCUIT COMMERCIAL COURT

Venue Royal Courts of Justice, Rolls Building, Fetter Lane, London, EC4A 1NL

Date 8 April 2025

Before

DAVID BAILEY K.C.

(sitting as a Deputy High Court Judge)

Between

WATFORD COMMUNITY HOUSING TRUSTClaimant

ARTHUR J. GALLAGHER INSURANCE BROKERS LIMITEDDefendant

MR TOM WEITZMAN K.C. and MS KATE HOLDERNESS (instructed by Devonshires) for Claimant

MR SIMON HOWARTH K.C. (instructed by Beale & Co) for Defendant

Hearing Hearing date: 17 December 2024

APPROVED JUDGMENT

This judgment was handed down remotely at 2.00 pm on 8 April 2025 by circulation to the parties or their representatives by email and by release to the National Archives.

David Bailey K.C. (sitting as a Deputy High Court Judge):

[1]This is the trial of a preliminary issue. It concerns a question of double (or, possibly, triple) insurance that arises in the context of a professional negligence claim by an insured against its broker.

[2]The essence of the dispute is as follows. The Claimant insured claims damages from the Defendant broker for failing to make (or advising the Claimant to make) a timely notification of a data breach to one of three available policies of insurance. The Defendant admits that it was negligent but contends that its breach of duty has not caused the Claimant any loss. This is on the basis that each of the three policies contained double insurance provisions (in the form of ‘other insurance clauses’) which, according to the Defendant, have the effect of limiting the total indemnity recoverable by the Claimant to a sum less than that which the relevant insurers have agreed to pay.

[3]In these circumstances, at a case management conference on 15 March 2024, Butcher J ordered the trial of the following preliminary issue:

“Whether, on a proper construction, the double insurance provisions in the Claimant’s insurance policies have the effect that the Claimant has suffered no loss by reason of the Defendant’s breach because it has already received a greater indemnity than it would have done if all insurers had been properly notified but had stood on their strict rights pursuant to those double insurance clauses.”

Factual Background

[4]I can take the factual background from a statement of facts that the parties have helpfully agreed for the purposes of this trial.

[5]On 23 March 2020, one of the Claimant’s employees sent an email to 3,167 recipients inadvertently disclosing personal data relating to 3,544 of the Claimant’s tenants and employees. This data breach gave rise to some 1,136 complaints of which the Claimant considered 1,050 amounted to valid claims that the Claimant has either settled or is attempting to settle.

[6]At the date of the data breach the Claimant was insured under the following three insurance policies each of which had been arranged by the Defendant and each of which provided cover in respect of losses arising out of such a data breach occurring within the period 1 April 2019 to 31 March 2020.a. A “Cyber Policy”, which was underwritten by PEN Underwriters on behalf of various Lloyd’s Syndicates (“Cyber Insurers”) and provided such cover subject to an aggregate limit of £1,000,000 (inclusive of defence costs) and an excess of £5,000 each and every claim;

b. A “Combined Policy”, which was underwritten by QBE and provided such cover subject to an aggregate sub-limit of £5,000,000 (inclusive of defence costs) and an excess of £500 any one occurrence; and

c. A “PI Policy”, which was underwritten by Hiscox and provided such cover subject to a limit of £5,000,000 any one claim (but with defence costs being in addition to that limit) and an excess of £5,000 each claim or loss.

[7]In accordance with advice given by the Defendant, the Claimant notified the Cyber Insurers of the data breach on 25 March 2020. However, the Defendant accepts that, in breach of contract and negligently, it failed to advise the Claimant to notify either QBE or Hiscox of the data breach (or itself to make such notifications), with the result that QBE and Hiscox were only notified of the data breach after the expiry of cover under their policies on (respectively) 19 June 2020 and 7 July 2020.

[8]In the above circumstances both QBE and Hiscox declined cover in respect of the data breach on the grounds that it had not been notified to them within the relevant policy period. QBE subsequently withdrew its declinature and agreed to indemnify the Claimant up to the limit of its policy. Hiscox has, however, maintained its declinature under the PI Policy and it is common ground between the parties that it is entitled to do so.

[9]The consequence of the above is that the total indemnity now available to the Claimant in respect of its liability and defence costs caused by the data breach is £6 million (£1 million under the Cyber Policy plus £5 million under the Combined Policy). While the Claimant has to date been indemnified in respect of its losses and defence costs by the Cyber Insurers (whose £1 million limit of cover has now been exhausted) and by QBE (whose £5 million of cover has now been substantially eroded), it anticipates that its costs and liability in respect of the claims which have already been made will ultimately exceed the £6 million of available cover. There is also the possibility of further claims being made against the Claimant given that the applicable limitation period for the making of such claims will not expire until 23 March 2026. The Other Insurance Clauses

[10]While I have had regard to the full terms of each policy, the following provisions are of particular relevance to the preliminary issue.

[11]Starting with the Cyber Policy underwritten by the Cyber Insurers, its cover was subject to the following other insurance clause and aggregation provision. “OTHER INSURANCE This insurance shall apply in excess of any other valid and collectible insurance available to You, including any excess or deductible portion thereof, unless such other insurance is written only as specific excess insurance over the limit of liability of this Policy.” “Claim means …. Multiple Claims arising from the same or a series of related or repeated acts, errors or omissions or continuing acts, errors, or omissions shall be considered a single Claim for the purposes of this policy, irrespective of the number of Claimants or You involved in the Claim. All such Claims shall be deemed to have been made at the time of the first such Claim was made or deemed made...”

[12]Turning to the Combined Policy underwritten by QBE, its cover was subject to the following other insurance clause and aggregation provision. “10.17 Non-Contribution If at the time of any claim under this policy there is any other valid and collectible insurance available to the insured... other than insurance that is specifically stated to be in excess of this policy... then the insurance afforded by this policy will be in excess of and will not contribute with such other insurance.” “11.15. Limit of indemnity Limit of Indemnity means: 11.15.1 the amount stated in the schedule which is the maximum amount of the insurer’s liability for any one (1) occurrence regardless of the number of... (c) claims against the insured or series of claims against the insured, or claims or series of claims made by the insured...”

[13]As for the PI Policy underwritten by Hiscox, its cover was subject to the following other insurance clause and aggregation provision. “Other insurance We will not make any payment under this policy where you would be entitled to be paid under any other insurance if this policy did not exist except in respect of any amount in excess of the amount that would have been payable under such other insurance had this policy not been effected.” “All claims and losses which arise from the same original cause, a single source or a repeated or continuing shortcoming in your work will be regarded as one claim. This includes such claims and losses arising after, as well as during, the period of insurance.”

[14]None of the policies contain a rateable proportion clause. The Rival Cases in Outline

[15]The Defendant’s primary case is that the preliminary issue should be answered in the affirmative. According to the Defendant, had it not been in breach of duty, the maximum total indemnity to which the Claimant would have been entitled under all three policies was £5 million. There are two limbs to its argument.

[16]The first limb of the Defendant’s argument is that, on a literal reading, the other insurance clauses in the three policies would make each contract of insurance an excess policy with the result that the Claimant would have no primary cover and none of the insurers would have been liable. Given that such an outcome would be either absurd or repugnant to the commercial purpose of the contracts, the other insurance clauses are to be construed as if they cancelled each other out leaving the Claimant with not just double but triple insurance providing a horizontal layer of primary cover for £1 million, £5 million and £5 million respectively.

[17]The second limb of the Defendant’s argument is that, had it not been negligent and all the insurers had stood on their strict legal rights, the maximum total indemnity to which the Claimant would have been entitled under all three polices was limited to £5 million even if its total loss exceeded that sum. In its original skeleton argument, the Defendant sought to justify this outcome on the basis that, in a case of double (or triple) insurance, a generally applicable principle of rateable contribution serves to limit the liability of the insurers to the insured. While not abandoning this contention, in its supplementary skeleton argument and oral submissions, the Defendant adopted a slightly different approach. It submitted that, as a matter of construction, the effect of the other insurance clauses was that where an insured had double insurance in the form of a horizontal layer of two or more primary liability policies, the maximum total indemnity recoverable by the insured could not exceed the highest limit of the horizontal layer. Either way, as a matter of general principle or construction, the Defendant submitted that all three insurers would have been liable to the Claimant for one third of the first £1 million of the loss, and QBE and Hiscox (who both underwrote policies with a limit of £5 million) would have been jointly liable to the Claimant in equal shares for the loss above £1 million but up to a maximum of £5 million. Therefore, even though the Claimant’s loss is likely to exceed the £6 million already provided by the Cyber Insurers and QBE, if the insurers all stood on their strict legal rights the maximum indemnity to which the Claimant would have been entitled under all three policies was limited to £5 million in total (i.e. £333,333.33 under the Cyber Policy and £2,333,333.33 under each of the PI and Combined Policies).

[18]It follows, according to the Defendant, that since the insured has already had the benefit of an indemnity of £6 million, the Claimant has suffered no loss as a result of the Defendant’s admitted breach of duty in failing timeously to notify (or advising the Claimant to notify) the data breach to the PI Policy underwritten by Hiscox.

[19]Finally, by way of a Rejoinder served after Butcher J had directed the trial of the preliminary issue, the Defendant advanced an alternative case to the effect that the preliminary issue could not be answered one way or the other at this juncture irrespective of the legal position. Given that the Claimant’s claim against the Defendant is for the loss of a chance of recovering under the PI Policy, even if the Claimant would have been legally entitled to a total indemnity of £10 or £11 million, the Defendant argued that it would still be necessary to have a further trial to assess the likelihood that the insurers would have honoured their legal obligations to the Claimant or whether the Claimant would have enforced them. In that regard, the Defendant’s case is that, had it not been in breach of duty, the insurers would have only offered the Claimant a total indemnity of £5 million as a matter of market practice and the Claimant would have accepted that sum.

[20]The Claimant’s case is that the preliminary issue should be answered in the negative. The Claimant contended that, but for the Defendant’s admitted breach of duty, it would have been entitled to a full indemnity for its losses up to £11 million or, alternatively, £10 million under the three insurance policies.

[21]Regarding the first limb of the Defendant’s primary case and the proper construction of the other insurance clauses, the Claimant submitted as follows. It accepted that, on their true construction, the other insurance clauses in the Combined Policy and the Cyber Policy cancelled each other out. However, by contrast, the wording of the other insurance clause in the PI Policy underwritten by Hiscox was in materially different terms. According to the Claimant, on its true construction, the other insurance clause in the PI Policy was effective and therefore that policy provided cover to the Claimant for losses (and defence costs) in excess of the amounts payable under the Cyber Policy and the Combined Policy. This meant that, but for the Defendant’s breach of duty, the Claimant would have been entitled to claim a total indemnity of up to £11 or £10 million (the difference depending on whether the second limb to the Defendant’s primary case is correct) plus additional cover from Hiscox for defence costs. In other words, although the Claimant would never be able to recover more than its total loss, if the Defendant had not been in breach of duty the Claimant would have had available a horizontal layer of primary cover for £1 million (under the Cyber Policy) and £5 million (under the Combined Policy) and a vertical layer of excess cover for £5 million plus defence costs (under the PI Policy).

[22]So far as the second limb of the Defendant’s primary case is concerned, the Claimant submitted that the Defendant’s analysis of the effect of double insurance was misconceived because it confused the Claimant’s right to an indemnity with the various insurers’ rights of contribution inter se. Accordingly, even if the other insurance clauses all cancelled each other out (as the Defendant contended) the effect is that the Claimant would have had primary insurance totalling £11 million (i.e. £1 million under the Cyber Policy, £5 million under the Combined Policy and £5 million under the PI Policy). It followed on the Claimant’s case that (if the Defendant had not been in breach of duty) it would have been able to claim under the policies in whichever order it wished and could have recovered its total loss up to a combined limit of £11 million plus defence costs. Moreover, there was nothing in the wording of the policies to displace the common law position. Insofar as the insurers had rights of contribution inter se, the Claimant submitted that, given the absence of a rateable proportion clause in any of the policies, this was irrelevant to the Claimant’s right to be indemnified for its full loss up to the limit of each policy.

[23]Further, by way of an amendment made to its Reply after Butcher J had directed the trial of the preliminary issue, the Claimant introduced a new argument concerning the effect of the aggregation provisions in the various policies. Although the aggregation clauses in the Cyber Policy and the PI Policy provided that all claims arising from the data breach are to be regarded as a single claim, the Claimant argued that the aggregation clause in the Combined Policy instead provides that those individual claims are subject to a single limit. As a result, according to the Claimant, the other insurance clause in the Combined Policy only applies to those individual claims for which the Claimant is indemnified under the Cyber or PI Policies and not to any other individual claims.

[24]Finally, in relation to the Defendant’s alternative case, the Claimant submitted that the Defendant’s ‘loss of a chance’ argument is outwith the scope of the preliminary issue and, in any event, is misconceived as a matter of law. The Issues

[25]As the arguments unfolded, it appeared to me that the resolution of the preliminary issue requires consideration of the following four key sub-issues.

[26]First, on the true construction of the contracts of insurance, was the other insurance clause in the PI Policy effective to make that policy a contract of excess insurance providing the Claimant with a vertical layer of excess cover for £5 million (plus defence costs) on top of a horizontal primary layer of double insurance consisting of the Cyber Policy and the Combined Policy?

[27]Secondly, if the other insurance clauses in all three policies cancel each other out so that the Claimant had available to it a horizontal layer of primary insurance for £1 million (under the Cyber Policy), £5 million (under the Combined Policy) and £5 million plus defence costs (under the PI Policy), does a general principle of rateable contribution or the wording of the policies limit the Claimant’s maximum indemnity to £5 million?

[28]Thirdly, does the difference in the wording of the various aggregation provisions affect the operation of the other insurance clause in the Combined Policy?

[29]Fourthly, does the fact that the Claimant’s claim is in the nature of a ‘loss of a chance’ mean that it is impossible to answer the preliminary issue without a further trial to determine the likelihood that the insurers would have honoured their legal obligations to the Claimant?

[30]For reasons I will endeavour to explain, I have come to the conclusion that the answer to the first, second and fourth questions is ‘no’ and that the third question does not necessitate a decision. Discussion and Analysis

[31]Double insurance arises where the same party is insured with two (or, as is said to be the position in this case, more) insurers in respect of the same interest on the same subject matter against the same risks. It is common ground that, subject to the meaning of the other insurance clause in the PI Policy, that is the case here. There is nothing improper, let alone illegal, about double insurance. Many people have multiple life insurance policies. Double insurance against property damage or liability can occur by design (typically as a hedge against insurer insolvency) or inadvertently (typically where composite covers overlap with dedicated cover). However, it can also be an instrument of fraud (in the form of ‘double dipping’) if an insured takes out multiple policies and purposefully engineers an accident in order to make multiple claims for the same incident of loss.

[32]By the middle of the eighteenth century, the common law had already developed a principled response to incidents of double insurance. First, the indemnity principle operated to limit the insured’s recovery to his or her actual (or agreed) loss and, secondly, an insurer who had paid a claim could seek contribution from other insurers who were liable for the same loss. As Lord Mansfield explained in Godin v London Assurance Co (1758) 1 Burr. 489 at 492:

“Where a man makes a double insurance of the same thing, in such a manner that he can clearly recover against several insurers in distinct policies, a double satisfaction, the law certainly says that he ought not to recover doubly for the same loss, but be content with one single satisfaction for it…. And if the whole should be recovered from one, he ought to stand in the place of the insured, to receive contribution from the other, who was equally liable to pay the whole.”

It is now settled that the right of contribution arises in equity and can be exercised by the insurer in his own name without resort to the doctrine of subrogation.

[33]The insurance industry developed its own response to the moral hazard presented in cases of double insurance by including what are known as ‘other insurance clauses’ in their policies. As Gavin Kealey QC, sitting as a judge of the Commercial Court, explained in The National Farmers Union Mutual Insurance Society Limited v HSBC Insurance (UK) Limited [2011] Lloyd’s Rep. 86 at [27]:

“There are in this context three main classes of policy provision that attempt to avoid or limit an indemnity in the event of other insurance covering the insured: (i) the first class covers those clauses that purport to exclude an indemnity altogether in the event of other insurance - provisions known in the United States as ‘escape’ provisions; (ii) the second class comprises those clauses that limit the insurer's liability to a rateable proportion of the loss in the event of other insurance – ‘rateable proportion’ provisions; and (iii) the third class comprises those clauses that provide that, in the event of other insurance, the subject policy operates as an excess policy and only responds if and when the insured loss exceeds the amount of coverage recovered or recoverable under the other policy – ‘excess’ provisions.”

In the present case, each of the three policies available to the Claimant included other insurance clauses of the type described by Mr Kealey as being in the third class providing that the subject policy would operate as an excess policy in the event of double insurance.

[34]The meaning and effect of an other insurance clause is a question of construction. There was no dispute between the parties as to the general principles of interpretation to be applied when construing a contract of insurance. An insurance policy, like any other contract, must be interpreted objectively by asking what a reasonable person, with all the background knowledge which would reasonably have been available to the parties when they entered into the contract, would have understood the language of the contract to mean: Wood v Capita Insurance Services Ltd

[2017] AC 1173

and Financial Conduct Authority v Arch Insurance (UK) Ltd

[2021] AC 649

at [47]. I remind myself that the reasonable person in this context is not a pedantic lawyer who would subject the wording of the policy to a minute textual analysis, but an ordinary policyholder who, on entering into the contract, is taken to have read through it conscientiously in order to understand what cover they were getting.

[35]Applying these principles to interpret an other insurance clause in isolation might well be thought to be a relatively straightforward exercise. Unfortunately, however, as this case illustrates, other insurance clauses are rarely encountered in isolation. Rather, such clauses are only implicated when two or more policies provide coverage for the same risk and, if (as is typically the case) two or more other insurance clauses are in play each pointing the proverbial finger at one another, the ordinary principles of interpretation can result in a circular game of ‘tag’ or ‘not it’. The question then becomes how to interpret and apply multiple other insurance clauses with respect to the same risk.

[36]This was the problem that confronted the court in Weddell v Road Transport and General Insurance Co. [1932] 2 K.B. 563. Laurens Weddell had an accident while driving his brother’s car, accidentally injuring a third party. He failed to give timely notice of the accident to his own insurers (the Cornhill) so he sought an indemnity against his liability to the third party from his brother’s insurers (the Road Transport and General Insurance Company) whose policy extended cover to relatives “provided (a) that such relative is not entitled to indemnity under any other policy.” The Cornhill policy contained a similar clause which insured Laurens Weddell while driving his brother’s car “…if no indemnity is afforded the insured by any other insurance.” The position, therefore, was that both policies provided cover for the loss but included other insurance clauses in the first class which purported to exclude liability in the event of double insurance. The problem was that if each clause was given its literal meaning, the outcome would be that neither policy responded which, on the face of it, might be thought to be unjust and repugnant to the commercial purpose of the insurance contracts.

[37]Rowlatt J concluded that this result could be avoided by interpreting each other insurance clause so as to exclude from its scope any other policy which contained a provision that sought to exclude liability by reason of the existence of other insurance. He explained (at 567-568) his reasoning as follows:

“In my judgment it is unreasonable to suppose that it was intended that clauses such as these should cancel each other (by neglecting in each case the proviso in the other policy) with the result that, on the ground in each case that the loss is covered elsewhere, it is covered nowhere. On the contrary the reasonable construction is to exclude from the category of co-existing cover any cover which is expressed to be itself cancelled by such co-existence, and to hold in such cases that both companies are liable, subject of course in both cases to any rateable proportion clause which there may be. In other words, it is true to say that the relative or friend is not ‘entitled to indemnity under any other policy’ within the meaning of the Road Transport policy, and not ‘afforded’ indemnity ‘by any other insurance’ within the meaning of the Cornhill policy, when the other policy negatives liability where there are two policies. At that point the process must cease. If one proceeds to apply the same argument to the other policy and lets that react upon the policy under construction, one would reach the absurd result that whichever policy one looks at it is always the other one which is effective.”

[38]The principle applied by Rowlatt J in Weddell is one of construction of insurance contracts. As Lord Woolf put it in Eagle Star Insurance Co. Ltd. v Provincial Insurance PLC [1994] 1 A.C. 130 at 141G:

“Weddell’s case was not dealing with any principle of contribution but a question of construction as to the liability of insurers when there are two policies, each of which excludes liability where there is another policy covering the same loss. Rowlatt J decided that the respective clauses in each policy cancelled each other.”

[39]In Weddell Rowlatt J was concerned with two policies that contained other insurance clauses in the first class by which the insurers sought to escape liability altogether. However, in the present case, it is common ground that the same principle can apply where the relevant policies contain other insurance clauses in the third class which provide that the subject policy would operate as excess cover in the event of other insurance. It is on this basis that the parties are agreed that the other insurance clause in the Combined Policy was to be read as excluding from its scope the Cyber Policy (because it also contained an excess clause) and the other insurance clause in the Cyber Policy was to be read as excluding from its scope the Combined Policy (because it too contained an excess clause). In effect, therefore, the two clauses cancel each other out. If that were not so, neither policy would provide the Claimant with primary cover.

[40]In support of the first limb of his primary case, Mr Simon Howarth K.C. submitted that the same analysis should be applied to the interpretation of the other insurance clause in the PI Policy. Accordingly, the words “any other insurance” in the other insurance clause in the PI Policy must be read as excluding from their scope both the Cyber Policy and the Combined Policy because they also contained ‘excess clauses’ which would be effective on account of the existence of the PI Policy. Likewise, the words “any other valid and collectible insurance” in the Cyber Policy and the Combined Policy are to be read as excluding from their scope the PI Policy because it too contained an ‘excess clause’ which would be effective on account of the existence of the Cyber and/or Combined Policies. Accordingly, Mr Howarth submitted, the other insurance clauses in all three policies effectively cancel each other out with the result that (but for the Defendant’s breach of duty) the Claimant would have had a horizontal layer of three contracts of insurance available to meet its losses caused by the data breach.

[41]On behalf of the Claimant, Mr Tom Weitzman K.C. submitted that this analysis was wrong because it failed to take proper account of the fact that the wording of the other insurance clause in the PI Policy is different to that in the Cyber Policy and Combined Policy and, in particular, provides that it would apply where there would be cover under another insurance policy “if this [i.e. the PI Policy] did not exist.” According to Mr Weitzman, these words are of critical significance because there would be primary cover under the Cyber and Combined Policies (given the other insurance clauses in those policies cancel each other out) if the PI Policy did not exist. Furthermore, because the other insurance clause in the PI Policy is effective, that policy does not constitute “other valid and collectible insurance” for the purposes of the other insurance clauses in either the Cyber or Combined Policies. In other words, the effect of the difference in language and the addition of the words “if this policy did not exist” in the PI Policy is that the other insurance clause in the PI Policy trumps the other insurance clauses in the Cyber and Combined Policies.

[42]I am unable to accept this submission. In my judgment, Mr Weitzman’s interpretation begs the question by requiring the other insurance clauses in the Cyber and Combined Policies to be construed on the assumption that the other insurance clause in the PI Policy is effective. Adopting the reasoning of Rowlatt J in Weddell, the reason why the PI Policy is not to be regarded as “other valid and collectible insurance” for the purposes of the other insurance clauses in the Combined and Cyber Policies is not because the PI Policy is an excess policy but because it purports to be an excess policy as a result of the existence of the Combined and Cyber Policies. The fact that the other insurance clause in the PI Policy seeks to achieve this objective by a drafting device that invites the reader to assume (contrary to the truth) that the PI Policy does not exist seems to me to make no difference. In my view, the principle of construction established in Weddell still applies. The reason why the other insurance clauses in the PI Policy (on the one hand) and the Cyber and Combined Policies (on the other) cancel each other out is because they all seek to deprive the Claimant of any primary cover on account of their co-existence.

[43]I have reached this conclusion based on the wording of the Claimant’s policies. However, in doing so, I take some comfort from the fact that the Inner House of the Court of Session and the Supreme Court of Canada have reached the conclusion (albeit by reference to clauses worded slightly differently to those present in the Claimant’s policies) that the inclusion of the words “or would but for the existence of this policy be insured” or “if this policy did not exist” in an ‘excess’ other insurance clause did not displace the application of the principle of construction established by Rowlatt J. in Weddell. I will examine each case in turn.

[44]In Steelclad Ltd v Iron Trades Mutual (1984) S.C. 71 the Inner House was tasked with interpreting an other insurance clause in the following terms:

“The Company shall not be liable for any loss or damage which at the time of the happening of such loss or damage is insured or would but for the existence of this policy be insured by any other policy… except in respect of any excess beyond the amount which would have been payable under such a policy or policies had this insurance not been effected.”

An other insurance clause in similar terms was contained in another policy under which the pursuers were insured against the same loss and damage. The submission of the insurers (which had been accepted by Lord Stott sitting in the Outer House) was that the crucial words in the clause “or would but for the existence of this policy be insured”, had been intended to exclude the result in Weddell. This submission was rejected by the Inner House. As Lord Hunter explained (80):

“It was argued on behalf of the defenders and respondents that the presence of the words ‘or would but for the existence of this policy be insured’ in condition 4 of the defenders’ policy took the present case outside the principle or rule of construction which, in my opinion, is derived from [Weddell]… It must, I think, be conceded that these words do create a difficulty, since on an absolutely literal construction, they might be read as catering for a situation such as that which has arisen in the present case. But, in my opinion, even with the addition of these words, the condition being considered in the present case falls within the principle or rule of construction which was applied by Rowlatt J in Weddell…”

[45]Lord Robertson was of the same opinion. He said (85-86):

“It is said by the defenders that the meaning of the words in condition 4 is clear, and that the phrase ‘or would but for the existence of this policy be insured’ specifically and directly cover the situation… I agree with your Lordship that this view should not be accepted, upon the principle set out in Weddell. If it is accepted that the exclusion condition in each policy excludes liability for the event which happened because of the existence of the other policy, this means that the relevant loss is not effectively covered by either policy. On that view the exclusion of the words ‘or would but for the existence of this policy be insured’ does not make any difference.”

[46]I wonder whether he did (or meant to) say “the inclusion” of the relevant words (rather than “exclusion”) in the last sentence I have just quoted but, either way, the thrust of Lord Robertson’s opinion was that they made no difference to the application of the principle established in Weddell and the proper interpretation of the clause. Finally, Lord Dunpark said (82):

“What then of the words ‘would but for the existence of this policy be insured by another policy’? I am of the opinion that they do not alter the position.”

[47]In Family Insurance Corporation v Lombard Canada Ltd [2002] 2 R.C.S. 695 a stable owner was sued by a customer who had fallen from a horse. The customer’s claim was for $500,000.00. The stable owner was insured by Family under a homeowner/residential policy which provided liability cover up to a limit of $1 million and also, through her membership of the Horse Council of British Columbia, by Lombard under a commercial general liability policy for up to $5 million. Both insurers accepted that the loss fell within the scope of cover provided by both policies but sought to deny liability on the basis that their policy contained an other insurance clause which turned their policy into an excess cover in the event of double insurance. These arguments created a similar conundrum to that faced by Rowlatt J in Weddell. The other insurance clause in the Family policy provided:

“If other insurance exists which applies to a loss or claim or would have applied if this policy did not exist, this policy will be considered excess insurance and the Insurer is not liable for any loss or claim until the amount of such other insurance is used up.”

The other insurance clause in the Lombard policy was phrased as follows:

“If other valid and collectible insurance is available to the Insured for a loss we cover… [t]his insurance is excess over other existing insurance if any...”

As in the present case, the competition was between a ‘valid and collectible’ clause in one policy and an ‘if this policy did not exist’ clause in the other.

[48]Applying Canadian case law that had adopted the principle of construction established in Weddell, McEwan J (at first instance) held that the difference in wording between the two clauses was immaterial and, as a consequence, both clauses cancelled each other out leaving the insured with the benefit of a horizontal layer of double insurance in the form of two primary policies which were both liable for the loss. He stated:

“Beyond a certain point I do not think it makes much sense to arbitrate what amounts to a kind of drafting ‘tag’”

. The Court of Appeal disagreed but the decision of McEwan J was restored on appeal to the Supreme Court. As Bastarache J said, at [35] and [37], in delivering the judgment of the court:

“In the present appeal, the intention of each insurer, as evidenced by the respective policies, is to limit its liability to excess coverage in the event that other insurance covering the same risk is available… To endorse the intentions of one insurer over another, where both parties have sought to limit their liability to contribute and where the offending clauses, on their face, are irreconcilable, does violence to the intentions of the insurers and does not respect the obligations of both insurers to contribute. The better approach is that endorsed by English and the majority of Canadian courts.”

[49]In my judgment, the principle of construction established by Rowlatt J in Weddell requires each policy to be construed independently and if each insurer would be liable as a primary insurer but for the existence of the other policy, then the ‘excess’ other insurance clauses are to be treated as cancelling each other out with the consequence that the insured has the benefit of double insurance in the form of a horizontal layer of primary cover. If the objective of the other insurance clause is to transform the policy from a primary insurance into an excess cover in the event of other insurance, it seems to me that the precise wording deployed to achieve this objective is unlikely to affect the result. This is consistent with the decisions in both Steelclad Ltd and Family Insurance Corporation. In my view, such an approach promotes certainty and reflects the fact that other insurance clauses are to be interpreted through the eyes of a reasonable policy holder rather than a pedantic lawyer subjecting each clause to a minute textual analysis.

[50]It follows, for all the reasons I have given, that the first limb of the Defendant’s primary case succeeds and that the answer to sub-issue one is no.

[51]This means, in my judgment, that on their proper construction, all three other insurance clauses cancel one another out such that, but for the Defendant’s breach of duty, the Claimant would have had the benefit of triple insurance against its losses from the data breach under a horizontal layer of primary insurance providing £1 million of cover under the Cyber Policy, £5 million of cover under the Combined Policy and a further £5 million of cover (plus defence costs) under the PI Policy.

[52]This brings me to what I regard as the central question in the case, namely the effect of double (or triple) insurance on the Claimant’s entitlement to an indemnity from each of its insurers. Subject to the indemnity principle (which prevents the Claimant from recovering more than its actual loss from the data breach), can the Claimant exhaust its primary policies in whichever order it chooses up to a maximum combined indemnity of £11 million (as Mr Weitzman contends) or is the Claimant’s entitlement limited (as Mr Howarth contends) to a maximum total indemnity of £5 million?

[53]I have no hesitation in rejecting as unsound the original way in which Mr Howarth put the second limb of the Defendant’s primary case. I agree with Mr Weitzman that, absent a specific provision within the four corners of the contract of insurance, there is no general principle or rule of law to the effect that, in a case of double (or multiple) insurance, a principle of rateable proportion serves to limit each insurer’s liability to its insured. On the contrary, in my judgment, the position at common law (which I recognise can be modified by an express provision to a contrary effect) is that, in the case of double or multiple insurance, an insured is at liberty to claim against its insurers in whichever order it wishes and if it fails to recover the whole loss from one insurer, it can recover the balance from one or more of the others. See: MacGillivray on Insurance Law (15th Edition 2024, Sweet & Maxwell, paragraph 23-001) where the editors summarise the position as follows:

“Apart from express condition, both double insurance and over-insurance are perfectly lawful; one may insure with as many insurers as one pleases and up to the full amount of one’s interest with each one. If a loss occurs, the insured may, in the absence of a pro rata contribution clause, select any one or more insurers and recover from him or them the total amount of the loss. If he fails to recover his whole loss from those against whom he has proceeded in the first instance, he may recover the balance from any one or more of the others.”

[54]I accept Mr Weitzman’s submission that the fallacy in Mr Howarth’s argument (which is based on various dicta in cases involving claims between insurers) is that it incorrectly elides the rights of contribution between insurers inter se with the rights of an insured against its insurers.

[55]In my judgment, the legal position is correctly stated in MacGillivray (in the passage I have quoted) and by the editors of Colinvaux’s Law of Insurance (13th Edition 2024, Sweet & Maxwell) at paragraph 12-130:

“The fact that there is double insurance does not necessarily mean that the assured can recover separately under each policy, for the common law principle of indemnity provides that an assured can recover in the aggregate at most only an amount representing his actual—or, in the case of a valued policy, his agreed—loss, so that in the case of over-insurance by way of double insurance, part of the total sum insured will not be recoverable. However, the common law allows the assured a free choice of the manner in which he makes up his indemnity, so that, subject to the indemnity cap, he is permitted to pursue the insurers in such order and for such proportions of his loss as he thinks fit. That rule was obviously essential to the original function of double insurance, the fear of underwriter insolvency.”

[56]In support of the proposition of law expounded in the penultimate sentence of that passage the learned editors cite the cases of Newby v Reed (1762) 1 Wm. Bl. 416, Bousfield v Barnes (1815) 4 Camp. 228 and Bruce v Jones (1863) 1 H. & C. 769. In Newby v Reed, Lord Mansfield ruled that in a case of double insurance the insured was entitled to recover a full indemnity from either insurer leaving the paying insurer at liberty to seek a contribution from the other insurer if he thought fit to do so. In Bruce v Jones the insured had taken out four policies of insurance on a vessel each of which had a different agreed value. Having recovered an aggregate sum of £3126 under the first three policies, the court found that the insured could recover the balance of its loss under the fourth policy but only up to a maximum of £3200 (i.e. a further £74) being the agreed value of the vessel in that policy. More pertinently for present purposes, in Bousfield v Barnes the insured had the benefit of double insurance on a vessel worth in excess of £8000. The first policy provided cover up to £6000 and the second policy provided cover up to £600. Having recovered £6000 on the first policy the insured sued the underwriters on the second policy who refused to pay on the grounds that the insured had already received the maximum sum to which he was entitled. Lord Ellenborough disagreed ruling that the insured was entitled to exhaust the first policy and then claim the balance of his loss under the second policy. He said:

“I will likewise take care that the assured do not recover upon the whole more than the real value of the subject matter insured. But I think it is not enough for the underwriters on a particular policy to shew that the assured has received from another quarter the amount of the valuation in that policy, unless this amounts in point of fact to a complete indemnity. In the present case the ship insured is proved to have been worth above £8000. The plaintiff has received only £6000 from the London Assurance. He has therefore an interest of £2000 to which he may apply the policy on which the action is brought. That policy is only subscribed for £600. Therefore, when the whole of that sum has been paid, he will still be a loser to the amount of £1400 by the total loss of his vessel.”

[57]I recognise that these cases are of some antiquity and were concerned with claims for first party property damage under contracts of marine insurance. However, in my judgment, they are authority for the statements of principle that I have quoted from MacGillivray and Colinvaux. Moreover, dicta from more modern authorities, including cases dealing with liability insurance, support the existence of the same general principle.

[58]For example, in Weddell itself the only reason the Road Transport company was not liable to the insured for the entire loss was because of the presence of a rateable proportion clause in the policy. Further, in Family Insurance Corporation v Lombard Canada Ltd while the court was concerned with rights of contribution between insurers, Bastarache J noted [39] that the effect of the other insurance clauses cancelling each other out was that “… the insurance policies of both the appellant and the respondent provide the insured with primary coverage. As a result, each insurer is independently liable to the insured for the full loss, as if the other insurer did not exist.” More recently, in Sobrany v UAB Transtira [2016] Lloyd’s Rep. I.R. 266 the insured’s total liability for hire charges and legal costs exceeded the limit of indemnity under each of the two policies of insurance (but not the combined limit) and it was held that he was entitled to be indemnified in respect of the whole of his loss under the two policies. Having found that the other insurance clauses in the two policies cancelled each other out in accordance with the principles established by Weddell, Christopher Clark LJ said at [47-48]:

“Further, since there are two policies with a limit of £100,000, Mr Sobrany is entitled to recover £101,382.22 and is not limited to £100,000. Counsel’s concession that the claimant could only recover up to the £100,000 limit was plainly made on the basis that there was only one policy. It is not applicable in circumstances where the judge has permitted the defendant to assert that there were two and has found that to be the case. I would accordingly allow the appeal and enter judgment for Mr Sobrany in the sum of £101,382.22 together with interest…”

[59]Mr Weitzman also relied upon the decisions at first instance [1977] 1 Lloyd’s Rep. 1 at 2 to 8 and of the Court of Appeal in Commercial Union v Hayden

[1977] QB 804

where Donaldson J (as he then was) and Cairns LJ expressly acknowledged that, where the insured had a horizontal layer of primary liability insurance (a Lloyd’s policy with a limit of £10,000 and a Commercial Union policy with a limit of £100,000) and the insured’s loss exceeded the limit of indemnity under one or both policies, the insured was entitled to be indemnified under both policies in respect of the whole of its loss up to the combined limit of indemnity under the two policies. Hence, Donaldson J said (at 7):

“… I should have thought that it was clear that [the insured] can recover £110,000 on the two policies if they suffer so large a loss” and Cairns LJ said (at 815F to 816B): “The documents to be construed are policies, the parties to each of which are an assured and an insurer. It is not to be supposed that when either policy is issued the insurer knows that there is, or is going to be, another policy covering the same risk. Each limit of liability and each premium may be taken to be fixed without knowledge of the limit under any other policy that may have been, or is going to be, issued. It is difficult to suppose that when a limit of £10,000 was fixed by the defendant, it could have been intended that if there happened to be another policy with a limit of £100,000, the defendant should be liable for only one-eleventh of any claim, however small. The independent liability basis is much more realistic in its results. In the case of these two policies, any loss up to £10,000 would be shared equally, and it is only with larger losses that the proportion of the plaintiff's share to the defendant's share steadily increases until, with a loss of £110,000 or more, 10/11 of the liability falls on the plaintiffs. The obvious purpose of having a limit of liability under an insurance policy is to protect the insurer from the effect of exceptionally large claims: it seems to me artificial to use the limits under two policies to adjust liability in respect of claims which are within the limits of either policy.” [Emphasis supplied].

[60]The only dicta in any of the cases to which I was referred which might be thought to suggest otherwise appear in the judgment of Templeman LJ (as he then was) in National Employers Mutual General Insurance Association Ltd v Haydon [1980] 2 Lloyd’s Rep. 149. That was a case involving a claim between insurers for contribution. The insured solicitors had already been fully indemnified by the plaintiff insurers and were not involved in the proceedings. However, at the end of his judgment (at 156), Templeman LJ said:

“In the present case the plaintiff insurance company insured the claim which was made. They can only diminish liability if there is another policy under which the solicitors are entitled to indemnity. The defendant underwriters never did insure the claim which was made. They cannot be made liable wholly or partly for a risk which they did not insure. If the solicitors sued the plaintiff insurance company, the plaintiff insurance company could not argue that they were not liable. They must accept liability, but plead that the solicitors cannot recover more than 50 per cent because they are also insured by the defendant underwriters. If, however, the solicitors sued the defendant underwriters the defence would be that the Master Policy did not insure the claim at all and that the notice dated 11th August 1976 was ineffective against the underwriters and misconceived. In my judgment an action against the plaintiff insurance company would succeed for the whole claim and an action against the defendant underwriters would be dismissed. In short, the plaintiff insurance company can only limit their liability if there was double insurance – and there was no double insurance. I would allow the appeal accordingly.”

[61]This passage was plainly obiter and it might be thought that the suggestion that the plaintiff insurers could have limited their liability to the insured solicitors to 50% of their claim if there had been double insurance was based on the assumption that the plaintiff’s insurance policy included a rateable proportion clause. However, we know from Stephenson LJ’s judgment (at 152) that neither of the relevant policies contained a rateable proportion clause. In those circumstances, the basis for Templeman LJ’s suggestion is unclear. However, if it was intended to imply that a general principle of rateable proportion applies which limits the insured’s right of recovery in cases of double insurance, I would respectfully disagree. In my judgment, the existence of any such principle is inconsistent with the authorities and treatises to which I have already referred.

[62]It seems to me that if an insured has paid more than one premium for more than one primary policy against liability incurred above a specified attachment point and up to a specified limit, absent an express contractual provision that provides otherwise, as a matter of general principle the insured should be able to recover the whole of its loss under one or more of the policies up to a maximum of the combined limits. Contribution, if it arises, is a matter for the insurers inter se and absent a rateable proportion clause in the policy is of no concern to the insured. To my mind this analysis respects both the integrity of the indemnity principle and the commercial purpose of the contracts of insurance. I appreciate that consequential issues of some complexity may arise from this approach in cases where an insured has both a horizontal layer of two or more primary policies combined with a vertical tower of one or more excess polices (such as whether the whole of the primary layer must be exhausted before the excess policies attach) which have vexed and divided the American courts, but since no such issues arise in this case I need not attempt to resolve them here. They are better addressed if and when they arise.

[63]I do, however, need to address Mr Howarth’s submission that the terms of the other insurance clauses in the Cyber, Combined and PI Policies displace the ordinary position and serve to limit the Claimant’s entitlement to an indemnity from each of its insurers to a proportion of £5 million and to a total indemnity of £5 million in the aggregate. I accept, as a general proposition, that it is possible for the parties to modify the common law position by contract but whether or not that is the case will depend upon the proper construction of the policies. As I understood it from Mr Howarth’s supplemental skeleton argument and his oral submissions, the argument in this case is that the other insurance clauses cancel each other out as a result of a rule of law (rather than as a matter of construction) but they still exist as terms of the polices with the dual consequence that none of the insurers agreed to provide primary coverage where another primary policy existed and the maximum limit of cover available under all the policies taken together is £5 million. In my judgment, this argument is misconceived. It is clear from the reasoning of Rowlatt J, and from the subsequent authorities, that the principle established in Weddell is a principle of construction. The reason each policy responds to the Claimant’s loss as a primary policy up to its individual limit (rather than as an excess policy) is not a solution imposed by operation of law but because, on the true construction of the policies, that is what the insurers agreed. Further, and in any event, in my view the other insurance clauses are not inconsistent with the general principles of common law that I have previously identified but, if anything, support their application. In particular, in each case the clauses contemplate that the policy may respond (albeit vertically rather than horizontally) when another policy which covers the same loss has been exhausted. Ultimately, however, in my judgment there is nothing in the wording of the other insurance clauses that can properly be said to reduce the combined or total limit of the Claimant’s insurances from £11 million to £5 million. Given the absence of any rateable proportion clauses in any of the policies, each insurer is liable to the Claimant for the whole of its loss up to the limit of their policy. The Claimant has paid premium for a total of £11 million of coverage and, in my view, there is no legitimate basis on which its entitlement to an indemnity should or can be reduced to a total of £5 million.

[64]For all these reasons, it follows that the second limb of the Defendant’s primary case fails and the answer to the second sub-issue is no. Subject to the Defendant’s alternative case and the fourth sub-issue, the above analysis is, in my judgment, sufficient to dispose of the preliminary issue and there is no need for me to decide the third sub-issue.

[65]I can deal with the Defendant’s new alternative case pleaded in its Rejoinder and sub-issue four much more shortly. I agree with Mr Howarth that the Claimant’s claim in professional negligence against the Defendant is in the nature of a loss of the chance of recovering an indemnity under the PI Policy. However, I do not accept that it is necessary to investigate whether or not the insurers would have complied with their legal obligations to the Claimant (whether as a matter of market practice or otherwise) or the likelihood of the Claimant successfully suing the insurers to judgment in order to answer the preliminary issue. Given that I have found that, but for the Defendant’s breach of duty, the insurers were (had they stood on their strict legal rights) legally obliged to indemnify the Claimant for its losses caused by the data breach up to a combined total of £11 million, no such enquiry arises.

[66]I consider that this is clear from the judgment of Diplock LJ (as he then was) in the leading case of Fraser v B.N. Furman (Productions) Ltd [1967] 1 W.L.R. 898. That case concerned a professional negligence claim against a firm of brokers for failing to place insurance with Eagle Star. The relevant passage (for present purposes) in Diplock LJ’s judgment is at 904D:

“What damage they have suffered does not depend upon whether Eagle Star would have been entitled as a matter of law to repudiate liability under their standard policy, but whether as a matter of business they would have been likely to do so. What the employers have lost is the chance of recovering indemnity from the insurers. If Eagle Star would not have been entitled to repudiate liability in law, cadit quaestio; the damages recoverable would amount to a full indemnity. Even if they would have been entitled in law, however, to repudiate liability, it does not in my view follow that the employers would be entitled to no damages. The court must next consider in that event, what were the chances that an insurance company of the highest standing and reputation, such as Eagle Star, notwithstanding their strict legal rights, would, as a matter of business, have paid up under the policy.”

[67]Within that passage, the key sentence is:

“If Eagle Star would not have been entitled to repudiate liability in law, cadit quaestio; the damages recoverable would amount to a full indemnity.”

In other words, if the insurers would have been legally obliged to indemnify the insured that is (to deploy English in place of the Latin) ‘the end of the matter’ and the insured is entitled to recover damages from the brokers in an amount equivalent to that which the insurers would have been legally liable to pay to the insured. The factual and counter-factual enquiries as to what would or might have happened only arise for consideration if the insurer’s legal obligations to the insured are in doubt. This is because, if it is clear that the insurer would have been legally liable to the insured but for the broker’s negligence, there is no need to apply any discount to reflect any uncertainty in recovery. There is no risk of insolvency or the like in this case and none has been suggested. Conclusion

[68]For the reasons I have set out, the Defendant’s no loss defence fails and the preliminary issue is to be answered in the negative.

[69]This means that, but for the Defendant’s negligence, the Claimant would have been legally entitled to recover an indemnity under the three policies in respect of the whole of its loss caused by the data breach up to a combined limit of £11 million. In my judgment, therefore, the Claimant is entitled to damages from the Defendant in an amount equivalent to the losses that the insurers would have been legally liable to pay over and above the £6 million that the Claimant has already recovered from QBE and the Cyber Insurers.

[70]I should be grateful if the parties could draw up an order which reflects the decisions I have made. Submissions about costs and any consequential matters can be made in writing and, if and in so far as they are not agreed, any issues will be determined on paper without a hearing, unless I consider that one is necessary.