A landmark High Court judgment has laid bare the cost of professional negligence in insurance broking and clarified the application of “double” and “triple” insurance provisions, handing significant implications for brokers, insurers, and risk managers across the UK.
In a closely watched ruling, Deputy High Court Judge David Bailey KC found that Arthur J. Gallagher Insurance Brokers Limited was liable to Watford Community Housing Trust (WCH) for failing to ensure timely notification of a data breach to all relevant insurers - a breach of duty that deprived the claimant of up to £5 million in potential indemnity.
While Gallagher admitted negligence, it had argued that the loss was nullified by the complex web of insurance policies in place. The court, however, disagreed - a decision that exposes the broker to potentially millions in damages and redraws the boundaries of how layered insurance coverages interact when notification failures occur.
The origins of the dispute date back to March 2020, when a WCH staffer accidentally emailed a spreadsheet containing sensitive personal data - including sexual orientation and ethnicity - of over 3,500 tenants and employees. The fallout was immediate, prompting more than 1,100 complaints and triggering potential legal liabilities that now extend beyond £6 million.
At the time of the breach, WCH was insured under three separate policies, all arranged by Gallagher:
Gallagher advised WCH to notify only the cyber insurers. By the time the PI and combined insurers were informed, the coverage periods had expired. Hiscox refused coverage, while QBE eventually agreed to indemnify under its policy.
Gallagher’s key argument - that the other insurance clauses in the policies effectively “cancelled each other out,” rendering no additional liability even if Hiscox had been timely notified - was rejected.
Judge Bailey ruled that all three “other insurance” clauses were ineffective when read together, creating a "horizontal" stack of coverage rather than limiting the payout to the highest individual policy limit. In lay terms, this meant that WCH was entitled to the full £11 million aggregate indemnity (Cyber: £1M + Combined: £5M + PI: £5M), not a cap of £5 million as Gallagher asserted.
Significantly, the court reaffirmed a policyholder’s right under common law to choose the order and extent of indemnity claims across multiple policies, absent a “rateable proportion” clause — which none of the three policies contained.
For brokers, this ruling underscores a critical risk: negligent failure to advise on or execute timely notifications can trigger full indemnity liability, particularly in scenarios involving layered or overlapping coverage.
Despite Gallagher’s assertion that insurers may not have honoured all policies in practice, the court cited Fraser v B.N. Furman to confirm that where a policyholder was legally entitled to an indemnity, “the damages recoverable would amount to a full indemnity.”
The outcome shifts greater emphasis on to the timely orchestration of notifications across all relevant policies. Brokers should be mindful that even informal interpretations of “other insurance” clauses may not shield them from liability if a mishandled claim leads to loss of indemnity access.
The judgment has implications well beyond Gallagher and WCH. It is likely to:
Insurance carriers may respond by tightening clause language or introducing new provisions to mitigate their own risk exposure in multi-policy scenarios.
WCH is now entitled to pursue Gallagher for the difference between the £6 million it has recovered and the full £11 million coverage it should have accessed - a potentially £5 million exposure for the broker.
With the limitation period for additional claims running until March 2026, and lawyers keenly advertising for clients, Gallagher’s liability may still grow, pending any future claims relating to the original data breach.
The parties have been directed to submit costs and consequential matters in writing, with any remaining issues to be determined on paper.
