Insurer must defend insured for Biometric Information Privacy Act violations
The Illinois Supreme Court ruled on a class-action suit that claimed a tanning salon violated BIPA by sharing fingerprint data with a third party.
In West Bend Mutual Insurance Company v. Krishna Schaumburg Tan, Inc., [2021 IL 125978] the Illinois Supreme Court held that West Bend owed a duty to defend its insured, a tanning salon, against a class-action lawsuit alleging the salon violated the Biometric Information Privacy Act (BIPA). The Court found that the duty to defend was owed due to the language of the insured’s business owner’s policy, which provided coverage for lawsuits alleging “personal injury” or “advertising injury.” The ruling could have significant ramifications for carriers given the growing prevalence of BIPA class-action lawsuits and the resulting settlements.
The Illinois Biometric Privacy Act
BIPA was enacted in Illinois in 2008 and regulates how private entities may collect people’s biometric information (such as fingerprints, voiceprints, facial scans, etc.) and bars selling or otherwise profiting from an individual’s biometric identifiers. The statute provides for a private right of action by any person aggrieved by a BIPA violation and provides that a prevailing party may recover damages between $1,000 to $5,000 for each violation, as well as attorney’s fees.
Since BIPA’s enactment, the number of class-action lawsuits has increased, with over 800 BIPA class actions filed in the past few years, with many resulting in substantial settlement amounts. Earlier this year, the United States District Court for the Northern District of California entered final approval of a $650 million settlement against Facebook in a landmark class-action case alleging violations of BIPA. A Cook County judge approved a $25 million settlement in a BIPA class-action lawsuit against ADP, and currently, the United States District Court for the Northern District of Illinois is considering approval of a proposed $92 million class-action settlement against Tiktok, Inc. for allegedly violating BIPA.
The lawsuit
A class-action lawsuit was filed against Krishna Schaumburg Tan, Inc., a franchisee of L.A. Tan, alleging that the tanning salon violated BIPA by requiring its customers to provide their fingerprints and then disclosing the customers’ fingerprints to an out-of-state vendor, SunLync. The salon tendered defense of the class-action lawsuit to West Bend Mutual, pursuant to the language in the business owner’s policy.
The policy provided coverage for lawsuits alleging a “personal injury,” defined as an “injury, other than ‘bodily injury,’ arising out of one or more of the following offenses: …oral or written publication of material that violates a person’s right of privacy.” Similarly, the policy provided coverage for lawsuits alleging an “advertising injury,” defined as an “injury arising out of one or more of the following offenses: …oral or written publication of material that violates a person’s right of privacy.”
The policy also contained a “violation of statutes” exclusion stating the policy would not apply to the distribution of material that violated the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act of 2003, or any other statute, ordinance, or regulation that prohibited the transmission, distribution or communication of material information.
Defense coverage litigation
The insurer rejected coverage for the insured’s defense costs and filed a declaratory judgment action denying any duty to defend on the grounds that there was no “personal injury” or “advertising injury” alleged in the class action. Specifically, the insurer argued that there was no “publication” of information that violated any person’s right to privacy that would trigger a duty to defend because the insured only sent its customers’ biometric information to a single third-party vendor rather than to the public at large. Further, the insurer argued that the violation of statutes exclusion in the policy barred any coverage in this matter. The insured filed a counterclaim arguing the insurer owed a duty to defend under the plain language of the policy.
Following cross-motions for summary judgment, the trial court ruled in the insured’s favor, finding the term “publication” in the policy “simply means the dissemination of information,” which can be to a single person rather than to the public at large. The court also found that the violation of statutes exclusion in the policy was inapplicable because, based on the specific statutes mentioned in the exclusion, the exclusion was only intended to relate to violations of statutes regulating communications, whereas BIPA regulates the collection and use of biometric identifiers and biometric information. West Bend appealed, and the appellate court affirmed the trial court’s ruling on the same basis. As a result, the insurer appealed to the Illinois Supreme Court.
Illinois Supreme Court’s analysis
In making its determination, the Illinois Supreme Court first analyzed whether the insured’s alleged sharing of its customers’ biometric information with the third-party vendor constituted “publication” under the insurance policy. Since the term was not defined by the policy, the Court analyzed dictionary definitions, case law, and the Restatement (Second) of Torts. The Illinois Supreme Court found that “publication” has multiple meanings, and if there is an ambiguous term in an insurance policy, then the term should be construed broadly against the insurance company.
Therefore, the Court held that the insurer’s duty to defend was triggered because sending its customer’s biometric information to a single third party vendor constituted a “publication” of the information and the BIPA class-action alleged a “personal injury” or “advertising injury” under the plain language of the business owner’s policy.
The Illinois Supreme Court also found the violation of statutes exclusion in the policy did not bar coverage since the exclusion focused on statutes that regulate communications while BIPA regulates the collection, use, and safeguarding of biometric information and identifiers. It affirmed the trial court and appellate court’s rulings that the insurer owed a duty to defend the insured under the plain language terms of the policy.
BIPA class-action lawsuits have the potential to result in substantial losses. With hundreds of new BIPA class-action lawsuits filed annually, both insurers and insureds need to be aware that the Illinois Supreme Court has established that insurance companies may owe a duty to defend in these cases. Insurers should also analyze the language within their policies to determine their risks with regard to future defense and indemnity payments that may result from potential BIPA class-action lawsuits against their insureds.
Matthew T. Connelly is an associate in Freeborn & Peters LLP’s litigation practice group and a member of the insurance and reinsurance team. He can be reached at mconnelly@freeborn.com.
Related: