The use of biometric information is becoming more frequent in our society. Whether it is logging on to your phone with your face or fingerprint, or shopping online with a virtual try-on tool, technology is enabling access to information that was not common a decade ago. With the sharing of a person's biometric information to facilitate this access, there is a growing concern as to what protections are available to safeguard that data. Currently, there are more privacy laws being enacted at the federal and state level. While there are many laws addressing biometric information, one of the most frequently cited is the Illinois Biometric Information Protection Act (BIPA). All the latest developments have led to more litigation and, in turn, more requests for coverage for the defense of these claims. Insurers are making decisions, consciously or not, as to whether they want or intend to afford coverage for these biometric privacy claims. This has prompted the filing of many coverage litigation suits. This is an evolving area of the law, as reflected in recent 2024 decisions.
There are several coverage disputes focused on not only whether the Commercial General Liability (CGL) policy's insuring agreement is triggered in the first instance but, more frequently, whether an exclusion is applicable precluding coverage for a lawsuit alleging a violation of biometric privacy. One recent decision on December 2, 2024, Ohio Sec. Ins. Co. v. Wexford Home Corp., in the Appellate Court of Illinois, First District (1-23-2311), involved the court's interpretation of a policy's “Recording and Distribution of Material or Information In Violation of Law” exclusion. The Ohio Security case examined coverage for the underlying litigation, claiming that the insured violated BIPA through its biometric employee timekeeping policy by collecting and discussing its employees' biometric information without providing written notice, obtaining consent, or implementing any of the requisite guidelines regarding destroying, retaining, or disseminating the data to third parties. The court found that while the underlying complaint may involve “personal and advertising injury,” the policy's recording and distribution exclusion was applicable. As part of the recording and distribution exclusion, the policy precludes coverage for violations of “[a]ny federal, state or local statute, ordinance or regulation, other than the TCPA [Telephone Consumer Protection Act], CAN-SPAM Act or FCRA [Fair Credit Reporting Act] and their amendments and additions, that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.”
The court in Ohio Security focused on what was distinguishable from West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978 (May 20, 2021), where the Illinois Supreme Court rejected the application of a similar, but not identical, exclusion to BIPA claims. The court found that the exclusion evaluated in Krishna included not only the TCPA and CAN-SPAM Act, “but also the FCRA and FACTA [Fair and Accurate Credit Transactions Act], which made it impossible to limit the exclusion to statutes regarding methods of communication.” The court noted that the inclusion of laws such as FCRA and FACTA “protect a consumer's confidentially in his or her financial freedom,” which is different from the TCPA and CAN-SPAM, which protect “consumer's freedom from unwanted solicitation.” In reasoning that BIPA “regulates the collection, dissemination, and disposal of one's biometric identifiers and information,” and is closer to “protecting a consumer's confidentiality,” the court reversed the lower court and held that the policy's recording and distribution exclusion precluded coverage.
This decision follows another recent decision from the U.S. District Court for the Northern District of Illinois on August 5, 2024, Westfield Insurance Co. v. UCAL Systems Inc. et al., case number 1:21-cv-03227, which held that the policy's exclusion for recording and distribution of material or information of law “applies to violations of BIPA.” In granting summary judgment, the court focused on a similar “Recording and Distribution of Material or Information In Violation of Law Exclusion” which included catch-all language precluding “FCRA and their amendments and additions, that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.” The Westfield court not only distinguished Krishna based upon other Illinois state court decisions but also considered the Seventh Circuit decision in Citizens Ins. Co. of Am. v. Wynndalco Enters., LLC, 70 F.4th 987, 995 (7th Cir. 2023) (holding the underlying BIPA lawsuit fell within the coverage of the policy because a BIPA violation is a violation of privacy). In Wynndalco, the court evaluated a “Distribution of Material in Violation of Statutes Exclusion” which contained a “catchall provision that applied to personal and advertising injury arising out of ‘any other laws, statutes, ordinances, or regulations that address, prohibit or limit the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material information.'” In contrast, the court in Westfield found that an exclusion that includes “FCRA and their amendments” is materially distinguishable from the exclusion at issue in Wynndalco. Therefore, the court held “that the Recording and Distribution of Material or Information of Law Exclusion applies to violations of BIPA.”
Another recent decision in a matter before the U.S. District Court for the Northern District of Illinois involving coverage for a BIPA matter under a CGL policy examined a different exclusion for the violation of communication or information law. Tri City Foods Inc. v. Commerce and Industry Insurance Co., 24 C 414 (N.D. ILL. Nov. 26, 2024). In the November 2024 decision, the court in Tri City Foods addressed whether the underlying lawsuit alleging a violation of BIPA related to the sharing of workers' biometric information with a third-party vendor was considered a “publication” under the CGL policy's insuring agreement for personal or advertising injury. Regarding the violation of law exclusion, the court noted that the exclusion in this case was arguably broader than the exclusion in Krishna, but not as broad as the exclusion in Westfield. The court ruled that it “cannot say that the applicability of the Violation of Laws Exclusion to BIPA claims is ‘clear and free from doubt' and that “at a minimum, there exists an ambiguity that must be resolved in the insured's favor.”
AN EVOLVING AREA
These recent decisions in the past couple of months evaluating coverage for BIPA claims under CGL policies show that the issue continues to evolve, particularly in Illinois. Ohio Security, Westfield, and Tri City Foods all evaluate similar exclusions under a CGL policy, but the specific wording in each policy's exclusion was determinative. This focus on the specific language found in an exclusion will continue to be scrutinized, as there are a number of other lawsuits currently pending involving coverage for biometric claims. They include disputes over employment-related practices exclusions, access or disclosure exclusions, expected or intended injury exclusions, right of privacy created by statute exclusions, and professional services exclusions. As such, the scope of coverage for BIPA claims will likely continue to be a heavily litigated area in 2025.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
