Assume that Alice is getting a quote from an insurance company, but something goes wrong in the company's system while processing her quote. The company logs a defect and assigns it to Bob, one of their software developers. In order to analyze the defect so that he knows how to fix it, Bob retrieves the logs from Alice's quote. While Bob is looking at the logs to find out why the problem occurred, he also writes down Alice's personal information (name, address, social security number, etc.), which he later uses to commit identity theft. Assume that due to the nature of the defect, Bob needed to be able to see the complete log of the quote as it went through the insurance company's system. Is the insurance company at fault for Bob stealing Alice's identity? How are things different if Bob doesn't work directly for the insurance company, but rather for a separate company that has a contract with them?
A principal is strictly liable for the acts and omissions of their agents; including employees. Whether an independent contractor rises to the level of "agent" depends on a number of factors, however, if the cause of action is for an act or omission directly in line with what the principal was contracted to do by the customer, it will likely be the case. For example, if the principal is hired to fix a fridge and subcontracts that work and the fridge isn't fixed properly by the subcontractor, the principal will be responsible for the spoiled food; if the door comes off and injures a 3rd party, the principal will likely not be liable for the injury.
However, there is an exception where the agent is on a "frolic of their own"; that is, they were not performing the task the principal set for them. Criminal acts are not, in and of themselves, "frolics"; for example, a courier who criminally breaches traffic law is still acting within the scope of their agency and the principal is still vicariously liable. However, if that same courier, during work hours in the principal's vehicle, robs a bank, they are on a frolic and the principal is not liable.
So, for your example, Bob's criminal act in stealing Alice's identity is likely a frolic and the insurance company is not vicariously liable.
The insurance company is possibly liable in negligence in its own right.
Most jurisdictions say that there are four elements to a negligence action:
- duty: the defendant has a duty to others, including the plaintiff, to exercise reasonable care,
- breach: the defendant breaches that duty through an act or culpable omission,
- damages: as a result of that act or omission, the plaintiff suffers an injury, and
- causation: the injury to the plaintiff is a reasonably foreseeable consequence of the defendant's act or omission.
1, 2, and 3 are pretty much all givens in this circumstance. So the question is what measures did the insurance company put in place to prevent/detect/mitigate this foreseeable risk and do those meet the duty laid on a reasonable insurance company?
Is the insurance company at fault for Bob stealing Alice's identity?
The company will certainly be required to have security measures - outlined by local, state laws, as well as federal laws - in place to prevent data theft, contracts signed by employees that require they keep data secure, and company insurance for when data leaks or thefts happen. The actual laws will vary by jurisdiction, and data theft or loss could be civil infractions or crimes.
How are things different if Bob doesn't work directly for the insurance company, but rather for a separate company that has a contract with them?
Contractors who come into contract with personal data will more than likely be required to sign contracts to safeguard that data, and will be required to carry their own liability insurance for data leaks. The actual local and state laws will vary by jurisdiction, but there will be federal codes that cover. See Insurance regulatory law - Wikipedia