Since Illinois passed its Biometric Information Privacy Act (BIPA) in 2008, there has been a proliferation of class action lawsuits filed pursuant to the statute. BIPA generally bars private entities from collecting, capturing, purchasing, receiving, or otherwise obtaining a person’s biometric information without obtaining that person’s advance, informed consent (see 740 ILCS 14/15(b)), and grants a private right of action to individuals who are “aggrieved” by a violation of the statute, entitling them to recover liquidated or actual damages as well as attorneys’ fees and costs (see 740 ILCS 14/20).
The Illinois courts are sorting out the question of the availability of insurance coverage for such BIPA suits under Commercial General Liability (CGL) policies. Of course, the standard CGL definition of covered “personal and advertising injury” includes “oral or written publication of material that violates a person’s right of privacy.” In May of 2021, an Illinois Supreme Court case, West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 183 N.E.3d 47 (2021), addressed the threshold question of whether BIPA claims fall within this basic definition. The court agreed that the gravamen of such claims is invasion of privacy, and that the purpose of the statute is to prevent such invasions. Krishna also rejected the insurer’s argument that the policyholder’s alleged conduct did not constitute an “oral or written publication” because biometric data was merely collected and given to a single third party (a service provider for the policyholder). The court ruled that even providing the information to one other party is a “publication”; the dissemination need not be widespread.
The Krishna case also construed an exclusion for “Violation of Statutes that Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or Information.” Variations on this type of exclusion are commonly found in CGL policies, and typically bar coverage for claims under the Telephone Consumer Privacy Act, the CAN-SPAM Act, and a catchall for “[a]ny statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.” The court found that this exclusion was intended to be narrow in scope, and could not be stretched so broadly as to bar coverage for BIPA claims. In a spate of decisions issued in the first quarter of 2022, the Northern District of Illinois has repeatedly followed this state supreme court guidance, finding that this exclusion and highly similar exclusions do not apply to BIPA claims. See, e.g., Am. Family Mut. Ins. Co. v. Caremel, Inc., 2022 WL 79868 (N.D. Ill. Jan. 7, 2022); Citizens Ins. Co. of Am. v. Thermoflex Waukegan, LLC, 2022 WL 602534 (N.D. Ill. Mar. 1, 2022); Citizens Ins. Co. of Am. v. Wynndalco Enterprises, LLC, 2022 WL 952534 (N.D. Ill. Mar. 30, 2022); Am. Family Mut. Ins. Co. v. Carnagio Enterprises, Inc., 2022 WL 952533 (N.D. Ill. Mar. 30, 2022).
Of course, there are other exclusions often deployed in CGL policies, which could potentially apply to BIPA claims, as well. One of these has been addressed in a number of the above-cited Northern District of Illinois cases: the exclusion for “Access Or Disclosure Of Confidential Or Personal Information,” which typically bars coverage for “liability arising out of any access to or disclosure of any person’s or organization’s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information, or any other type of nonpublic information.” The Caremel and Thermoflex cases found the exclusion did not apply to BIPA claims, concluding that a person’s biometric data did not fall within any of the categories of information enumerated in the exclusion.
The Carnagio decision, however, reached the opposite conclusion, finding that biometric data qualified as a person’s “confidential or personal” information and that the arguable lack of similarity between biometric data and the other examples set forth in the exclusion did not render it inapplicable to biometric information. It is worth noting, however, that the exclusion at issue in Carnagio seems to have contained a clear exception for claims alleging “personal and advertising injury,” and therefore the case outcome is hard to square with the policy language at issue. (While policy language appears to have been quoted correctly in the factual recitation portion of the opinion, it appears to have been misquoted in the legal discussion section of the decision.)
Another area of disagreement within the Northern District of Illinois is whether Employment-Related Practices (ERP) exclusions apply to such claims when they are brought by employees against their employers (as in circumstances where employers require fingerprinting). The ERP exclusion bars coverage for “…‘personal and advertising injury’ to: …A person arising out of any: …Employment-related practices, policies, acts or omissions, such as coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation or discrimination directed at that person….” In the Thermoflex and Carnagio cases, the Northern District found that the ERP exclusion did not apply, concluding that the collection of employee finger or handprints was not an “employment-related practice” on par with “evaluation, reassignment, discipline,” etc. See also State Auto. Mut. Ins. Co. v. Tony’s Finer Foods Enterprises, Inc., 2022 WL 683688 (Mar. 8, 2022). The Caremel case, however, reached the opposite conclusion, finding that collection of handprints in violation of BIPA was “a practice that can cause individual harm to an employee,” just like the other types of conduct enumerated in the exclusion.
The recent cases show that Illinois courts are trending in favor of finding coverage for BIPA claims under CGL policies. At the same time, areas of confusion and conflicting decisions remain. Future appeals in these and other cases will likely bring additional clarity to the coverage picture.