Two recent rulings in the Northern District of Illinois have provided insurers a new, viable path to avoid defense obligations for the explosion of lawsuits brought by insureds’ employees under the Illinois Biometric Information Privacy Act (BIPA). The decisions held the Access or Disclosure Exclusion, which is commonly found in general liability policies, unambiguously barred coverage for BIPA claims. See American Family Mut. Ins. Co., S.I. v. Carnagio Enters., Case No 20-c-3665 (N.D. Ill. Mar. 30, 2022); Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., Case No. 21-c-788 (N.D. Ill. Mar. 30, 2022). 

The rulings by the Hon. John Z. Lee, U.S.D.J. (N.D. Ill.) departed from recent decisions within the District that held the exclusion did not unambiguously exclude coverage. See Am. Fam. Mut. Ins. Co. v. Caremel, Inc., Case No. 20-c-637, 2022 WL 79868 at 3 (N.D. Ill. Jan. 7, 2022); Citizens Ins. Co. of Am. v. Thermoflex Waukegan, LLC, Case No. 20-cv-05980, 2022 WL 602537 at 6-7 (N.D. Ill. Mar. 1, 2022); Citizens Insurance Company of America v. Highland Baking Company, Inc., Case No. 20-cv-04997 (N.D. Ill. March 29, 2022). 

Background

Enacted in 2008, BIPA regulates the collection, use and storage of biometric data such as fingerprints. In sum, BIPA requires private entities to (1) obtain informed, written consent from individuals prior to collecting their biometric information and (2) develop a written, publicly available policy on retention and destruction of such information. BIPA creates a private right of action and provides potential recovery for actual damages or statutory liquidated damages of $1,000 for each negligent violation and $5,000 for each reckless or intentional violation, plus attorneys’ fees and costs and injunctive relief. 

BIPA-related litigation has grown exponentially since 2015, with the majority of cases being putative class action lawsuits based on employers requiring employees to scan their fingerprints to clock in and out of work. This increased litigation has, in turn, spurred insurance coverage litigation for such claims. The published decisions concerning coverage for BIPA claims have focused on whether any exclusions bar coverage, with most of the decisions finding various exclusions do not unambiguously exclude coverage. 

Access or Disclosure Exclusion Opinions

Judge Lee’s opinions with respect to the Access or Disclosure Exclusion may provide the best opportunity for insurers to avoid defense obligations for BIPA claims because he found the exclusion to be clear and unambiguous and he highlighted the faulty reasoning in prior decisions that found the exclusion did not unambiguously exclude coverage. 

The Access or Disclosure Exclusion at issue in Carnagio and Mitsui Sumitomo states:

This insurance does not apply to … “personal and advertising injury” arising out of … any access to or disclosure of any person’s or organization’s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information. 

Addressing the Caremel and Thermoflex Waukegan opinions head on, Judge Lee found the prior decisions in the Northern District of Illinois were wrong to limit the scope of the exclusion by using the interpretative canons ejusdem generis (of the same kind) and noscitur a sociis, a broader variation of ejusdem generis, for three reasons: 

• First, ejusdem generis does not apply when the language is unambiguous. Here, Judge Lee found the exclusion to be unequivocal, clear and unambiguous.
• Second, when examples are introduced by the word “including,” the list that follows is not exhaustive. As such, Judge Lee found the examples of the types of information covered by the exclusion do not limit the scope of the preceding clause, which states coverage is not afforded for “‘personal and advertising injury’ arising out of … any access to or disclosure of any person’s or organization’s confidential or personal information.”
• Third, ejusdem generis does not apply when the listed items are not sufficiently similar to belong to one identifiable class. The examples in the Access or Disclosure Exclusion, which include everything from publicly available patent information to private credit card information, have no readily identifiable common thread. As a result, ejusdem generis is inapplicable. 

Judge Lee also held that even if he were to use the broader interpretive canon of noscitur a sociis, the only resemblance among the listed examples is that they are categories of information individuals and companies have a heightened interest in keeping from third parties or the public. Biometric data, Judge Lee held, certainly falls within that category. 

Summary

Judge Lee’s decisions are significant because they represent the most extensive analysis of the Access or Disclosure Exclusion within the BIPA context to date. Judge Lee’s opinions also explain why prior decisions within the District provide an incomplete analysis and how the reasoning in those opinions was faulty. Although, technically, three out of the five published decisions addressing the Access or Disclosure Exclusion found the exclusion does not unambiguously exclude coverage for BIPA claims, the Highland Baking case merely adopted the Thermoflex Waukegan decision and did not provide an independent analysis. 

Moreover, the Caremel court’s discussion of the Access or Disclosure Exclusion was brief, focused more specifically on the exclusion’s “health information” language, and is judicial dicta. Judge Lee’s decisions are more reasoned and undoubtedly will establish a road map for insurers when this issue reaches the Seventh Circuit Court of Appeals.                             

Until then, the new split within the Northern District of Illinois clearly demonstrates there is a bona fide coverage dispute concerning coverage for BIPA claims that likely will protect insurers from bad faith claims under 215 ILCS 5/155.