Key Points:
- Federal court in Illinois follows state Supreme Court in finding that “advertising injury” coverage applies to BIPA liability
- Court rejects applicability of three exclusions invoked by insurance companies, finding exclusionary language ambiguous
- Court applies broad “duty to defend” standard favoring insurance coverage for claims alleging violation of biometric privacy laws
In a March 1 decision from the United States District Court for the Northern District of Illinois, Judge John F. Kness continued the trend of policyholder victories in suits seeking insurance coverage for alleged violations of Illinois’ Biometric Information and Privacy Act (BIPA) and other state biometric privacy laws. Companies around the country – both those currently using biometrics and those that may use them in the future – should pay special attention to these policyholder victories and the policy language that courts look to in resolving biometric coverage claims.
Insurance Companies Have a Duty to Defend BIPA Lawsuits.
Citizens Insurance Company of America v. Thermoflex Waukegan, LLC, 20-cv-05980 (N.D. Ill. March 1, 2022), stemmed from Thermoflex’s assertion that Citizens Insurance Company of America and Hanover Insurance Company were obligated to defend Thermoflex in a class-action lawsuit alleging that Thermoflex violated BIPA. After denying coverage, the insurance companies filed suit against Thermoflex, seeking declaratory judgment confirming their denial.
Thermoflex’s commercial lines insurance policy provided coverage for “personal and advertising injuries,” which included injuries arising out of “oral or written publication, in any matter, of material that violates a person’s right of privacy.” The insurance companies asserted that three separate exclusions applied to bar coverage: an employment related practices exclusion; a recording and distribution exclusion; and an access or disclosure exclusion. The court rejected all three arguments, denying the insurance companies’ motion and granting judgment to Thermoflex on the pleadings.
To prove its entitlement to a defense under Illinois law, Thermoflex only needed to show that the underlying litigation was “potentially or arguably” within the scope of coverage. See Pipefitters Welfare Educ. Fund, 976 F.2d 1037, 1039 (7th Cir. 1992). Thermoflex argued that by alleging BIPA violations, the underlying litigation involved an injury arising out of the publication of material that allegedly violated the privacy rights of the putative class, and those allegations fell within, or at least potentially fell within, the coverage for personal or advertising injuries under the policy. The insurance companies conceded that Thermoflex thereby met its initial burden but then argued that the three exclusions applied and barred coverage.
As the Illinois Supreme Court explained in Rosenbach v. Six Flags Ent. Corp., BIPA codified the standard that individuals possess a right to privacy in and control over their biometric identifiers and biometric information. 129 N.E.3d 1197, 1206 (Ill. 2019). Applying Rosenbach, the Thermoflex court determined that the underlying litigation, alleging Thermoflex violated BIPA, arose out of an alleged “personal or advertising injury,” and rejected the insurance companies’ arguments that any of the three exclusions barred coverage.
The Three Exclusions Did Not Preclude Coverage for BIPA Claims.
First, the court found that the employment related practices exclusion did not bar coverage because it found ambiguity as to whether or not the conduct at issue in the underlying litigation (the collection of employee’s handprints) was an employment-related practice. Ultimately, the court found that reading the exclusion as barring any employment related practices that “can” cause harm to an employee would potentially preclude coverage of any claim against an employer. Specifically, the court found, “it is unclear whether the conduct at issue in the Gates Lawsuit (collection of employees’ handprints) is an employment-related practice like coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation, discrimination or malicious prosecution,” the practices specified in the exclusion (Decision, pg. 10).
Because policy exclusions are to be read narrowly and applied only where clear, definite, and specific, the court found that interpreting the policy to exclude collection of biometric identifiers as an “employment related practice,” would create an exception that “swallows the rule.” And because the underlying lawsuit did not unambiguously fit into the language in the employment-related practices exclusion, the court denied the Insurance Companies’ motion for judgment on the pleadings, and granted Thermoflex’s motion for judgment on the pleadings.
Second, the court rejected the insurance companies’ argument that an exclusion barring coverage for “personal injuries” under certain laws restricted coverage. This exclusion limits recovery from personal injury arising directly or indirectly out of any action or omission that violates or is alleged to violate: (1) the Telephone Consumer Protection Act; (2) the CAN-SPAM Act of 2003; (3) the Fair Credit Reporting Act; and (4) any other statute, ordinance, or regulation that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating, or distributing of material or information. Citing the Illinois Supreme Court’s decision in W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., the Thermoflex court applied the doctrine of ejusdem generis – stating that when a general word or phrase follows a list of specifics, the general word or phrase will be interpreted to include only items of the same class as those listed. N.E.3d, 2021 WL 2005464, at 1* (Ill. 2021).
In Krishna, the court held – under a very similar exclusion – that BIPA was not excluded from coverage because BIPA is not a statute of the same kind as the TCPA, FCRA, or the CAN-SPAM Act, as BIPA does not regulate methods of communication like the other statutes. In Thermoflex, the Insurance Companies attempted to distinguish Krishna, arguing that the language in their policies is broader and should encompass BIPA. The court disagreed and found that, on its face, BIPA is not a statute of the same kind as the TCPA, the CAN-SPAM Act, or the FCRA, and, at best, it is unclear whether BIPA is sufficiently similar to those other statutes. Thus the exclusion must be construed in favor of finding coverage for Thermoflex.
Finally, the court rejected the insurance companies’ claim that a third exclusion, barring specific types of claims, limited coverage. The policy contained an access or disclosure exclusion that prevented coverage for any personal or advertising injury arising out of any access to or disclosure of any person’s or organization’s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information, or any other type of nonpublic information. Applying the doctrine of noscitur a sociis – the meaning of an unclear word or phrase, especially one in a list, should be determined by the words immediately surrounding it – the court found that handprints do not share the same attributes as patents, trade secrets, processing methods, customer lists, financial information, credit card information, or health information. While the court admitted that BIPA identifies certain biometric data as confidential and sensitive information, it explained that BIPA expressly distinguishes between “biometric identifiers” and “confidential and sensitive information,” and regards biometrics as unlike other unique identifiers. Ultimately, the court denied the insurance companies’ motion for judgment on the pleadings as to this exclusion, finding that it was at best unclear, requiring ruling in favor of the policyholder.
The Thermoflex ruling is another well-reasoned decision in favor of insurance coverage for alleged violation of laws intended to protect the use of biometric information. But insurance companies likely will continue to assert exclusions and other defenses to coverage, and policyholders would be wise to review their existing policy terms and be wary of any effort by insurance companies to limit coverage for these claims going forward.
Cort T. Malone is a shareholder in the New York and Stamford, Connecticut, offices of Anderson Kill and practices in the Insurance Recovery and the Corporate and Commercial Litigation departments. He is an experienced litigator, focusing on insurance coverage litigation and dispute resolution, with an emphasis on commercial general liability, directors and officers, employment practices liability, advertising injury, and property insurance issues.
cmalone@andersonkill.com
(212) 278-1382
Jade W. Sobh is an attorney in Anderson Kill's New York office. Jade focuses his practice on insurance recovery, exclusively on behalf of policyholders, as well as regulatory and complex commercial litigation matters.
jsobh@andersonkill.com
(212) 278-1035