Chicago, Ill. (March 15, 2019) - The Illinois Biometric Information Privacy Act (BIPA, or "the Act") was enacted in 2008 to regulate the collection and storage of biometric information by private entities. The Act covers retina or iris scans, fingerprints, voiceprints, and scans of hand or facial geometry, and requires entities to have a written collection/storage/destruction policy in place, and to obtain a written release from a person for the collection and use of their information. Illinois is the only jurisdiction whose act provides for a private right of action. BIPA allows for the recovery of both actual damages and statutory liquidated damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. It also provides for the recovery of attorneys' fees and other litigation expenses
On January 25, 2019, the Illinois Supreme Court published its widely anticipated decision in Rosenbach v. Six Flags Entertainment Corporation et al., in which it held that an individual does not need to allege they were actually harmed by a violation of BIPA in order to seek liquidated damages and injunctive relief under the Act, effectively opening the flood gates for a storm of class actions. As a result, numerous class actions have already been filed in Illinois alleging BIPA violations. The majority of these class actions have been filed against employers in connection with the collection and use of biometric information for purposes such as clocking in and out, regulating access to secure areas, or logging into networks or point-of-sale systems.
General Liability Coverage & BIPA Suits
Coverage B – Personal and Advertising Injury – in general liability policies may potentially be triggered by these BIPA suits. The definition of "personal and advertising injury" typically is defined to include injury caused by an offense of electronic, oral, written or other publication of material that violates a person's right of privacy. Because BIPA seeks to protect a person's right to privacy in their biometric information, alleged violations of BIPA will typically involve a violation of the right to privacy.
Due to the Rosenbach decision, the majority of class actions may not allege or involve any "publication" to trigger coverage, as there need not be any disclosure of the plaintiffs' biometric information to a third party or the public to succeed on a BIPA claim. However, "publication" is not defined in the ISO policy form and there is some case law, including in Illinois, that suggests the mere disclosure to a single third party, rather than to the public at large, may be sufficient to allege a "publication". In cases where the BIPA defendant has utilized a third party to store biometric information, there could potentially be a "publication".
The majority of BIPA class actions will seek statutory liquidated damages as opposed to actual damages. There is no definition of "damages" in the general liability ISO form. The case law in Illinois and throughout the country interpreting similar statutory damages under the Telephone Consumer Protection Act (TCPA) suggests that Illinois and the majority of other states would find that the $1,000 award for negligent violations is compensatory and thus "damages," rather than punitive in nature and uninsurable.
The TCPA case law, however, also supports that the additional $4,000 awarded per intentional or reckless violation should be considered a punitive or multiple damage award, and thus be uninsurable in states where insuring punitive damages is against public policy, such as Illinois. There is a split among the states as to whether statutory attorneys' fees falls within the definition of "damages," though in Illinois, they likely do.
Protection via Policy Exclusion?
Most general liability policies include a "Recording And Distribution Of Material Or Information In Violation Of Law Exclusion," which excludes coverage for "'personal and advertising injury' arising out of any action or omission that violates or is alleged to violate any federal, state or local statute, ordinance or regulation that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information".
Although there is not yet any case law construing this exclusion in the BIPA context, the exclusion should likely apply, precluding the duty to defend most BIPA suits based on its clear language. However, for the time being, any outright denial of coverage based on this exclusion would be risky due to the lack of any case law on the issue
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.