On May 17, 2024, the U.S. Court of Appeals for the Seventh Circuit affirmed an Illinois federal district court’s ruling that the policy exclusion titled Access or Disclosure of Confidential or Personal Information (Access or Disclosure exclusion) excludes coverage for claims under the Illinois Biometric Information Privacy Act (BIPA). Specifically, the court found that a person’s biometric identifiers, such as handprints, are considered “nonpublic information” within the meaning of the exclusion and thus held that the Access or Disclosure exclusion bars coverage and vitiates an insurer’s duty to defend.

Because the Access or Disclosure exclusion is commonplace in most general liability policies, this ruling is a major win for insurers and will likely have a substantial impact on coverage disputes for BIPA claims.

Background
In Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., the Seventh Circuit considered whether an insurance carrier (Mitsui) had a duty to defend its policyholder (Thermoflex) for the claims against it in an underlying lawsuit alleging violations of BIPA. Mitsui issued a series of primary commercial general liability, umbrella and excess policies to Thermoflex. A putative class action lawsuit was filed in Illinois state court alleging that Thermoflex violated BIPA by requiring hourly workers to scan their handprints each time they clocked in and out of work, transmitting their handprint data to a third party without authorization, and not providing them with a publicly available policy identifying its retention schedule or procedures for obtaining their consent and release. Mitsui denied coverage and filed a declaratory judgment action in the Northen District of Illinois seeking a declaration that it had no duty to defend or indemnify Thermoflex under the policies.

In the underlying case, the district court found the Access or Disclosure exclusion to be unequivocal, clear and unambiguous. It concluded that biometric information constitutes “personal information” within the meaning of the Access or Disclosure exclusion and therefore found that the exclusion bars coverage for BIPA claims. On the other hand, the district court found that the Data Breach Liability and Employment-Related Practices exclusions do not bar coverage for claims alleging BIPA violations.

The Decision
On appeal, the parties did not dispute that the BIPA claims alleged “personal and advertising injury” within the meaning of the policies. Thus, the Seventh Circuit assessed whether the three exclusions otherwise barred coverage.

The Seventh Circuit first assessed the Access or Disclosure exclusion, which provides in part that coverage:

[Does] not apply to [claims] arising out of any access to or disclosure of any person's or organization's confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information.

Thermoflex argued that the exclusion is ambiguous because it mentions patents that are public and thus not “confidential.” However, the Seventh Circuit affirmed the district court and held that the language of the Access or Disclosure exclusion is unambiguous. The Seventh Circuit found that the Access or Disclosure exclusion contains certain categories of information that individuals and companies have a heightened interest in keeping from the public. Specifically, the Seventh Circuit found that the phrase "confidential or personal information” within the exclusion includes handprints and other biometric identifiers based on the ordinary understanding of that phrase. The Court also noted that the BIPA statute expressly classifies biometric identifiers as confidential.

Thermoflex also argued that any construction that excludes coverage for damages based on the access to or disclosure of biometric information would make the coverage illusory; however, the Seventh Circuit found that an insurance policy is not illusory if it provides coverage against some liabilities, even if it does not provide coverage for all liabilities. For example, coverage would still be afforded for certain claims alleging a violation of a person’s common law right to privacy and therefore would satisfy the definition of "personal and advertising injury" in the CGL policies. Here, because the Access or Disclosure exclusion would arguably not bar claims arising from common law invasions of privacy (e.g., “false light” invasion of privacy), the Seventh Circuit found that the Access or Disclosure exclusion did not render coverage illusory – and upheld it to bar coverage for the underlying BIPA lawsuit.

The Seventh Circuit also found the Statutory Violation exclusion does not bar coverage.

The Statutory Violation exclusion bars coverage for violations of the Telephone Consumer Protection Act (TCPA), Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM Act), and the Fair Credit Reporting Act (FCRA). Additionally, its “catch-all” provision excludes coverage for violations of other laws or statutes that “address, prohibit or limit the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.”

Thermoflex asked the Seventh Circuit to follow its prior decision in Citizens Insurance Co. v. Wynndalco, 70 F. 4th 987 (7th Cir. 2023), which held that under Illinois law a broad reading of this exclusion would nullify coverages expressly provided elsewhere in the policy. The Wynndalco court concluded that such a result would render coverage illusory and thus held that the Statutory Violation exclusion does not bar coverage for a claim under BIPA. 

Instead, the Seventh Circuit relied on the case West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc. In that case, the Illinois Supreme Court assessed the language of an exclusion substantially similar to the Statutory Violation exclusion at issue in Thermoflex. West Bend held that because coverage was excluded for claims arising from violations of statutes that regulate methods of communication such as telephone calls, faxes and emails – and BIPA does not regulate methods of communication – BIPA should not be grouped within those statutes. The Illinois Supreme Court thus found that the language of the exclusion was too "uncertain" to bar coverage of BIPA violations.

Therefore, the Seventh Circuit found that the Statutory Violation exclusion does not bar coverage for BIPA claims because including BIPA in the collection of statutes with different purposes within the exclusion’s “catch-all provision” would make the exclusion ambiguous.

Mitsui asked the Seventh Circuit to overrule Wynndalco in light of the Illinois First District Appellate Court’s decision in National Fire Insurance Co. v. Visual Pak Co., 2023 IL App (1st) 221160, which held that a similar version of the Statutory Violation exclusion (also referred to as the “violation-of-law” or TCPA exclusion) indeed blocks coverage of claims under BIPA. Notably, the Visual Pak opinion held that the Wynndalco decision misunderstood Illinois law by invalidating the exclusion based on how it might potentially conflict or clash with other policy provisions that were not at issue in Wynndalco. The Visual Pak court held that the Statutory Violation exclusion does not wholly nullify coverage for "personal and advertising injury" (as the Wynndalco court feared), because coverage would still be afforded for many common-law claims to which the exclusion would not apply.

Although the central question in both Wynndalco and Visual Pak dealt with the interpretation of the Statutory Violation exclusion in the context of BIPA, the Seventh Circuit in Thermoflex ultimately declined to follow one decision over another or otherwise reconcile them after finding the language of the Statutory Violation exclusion at issue in those cases too dissimilar from the Statutory Violation exclusion at issue in Thermoflex.

While the Seventh Circuit refused to wade into the merits of Visual Pak, its decision that the Statutory Violation exclusion does not bar coverage for BIPA claims certainly conflicts with the Illinois First District Appellate Court’s holding in that case. A petition for leave to appeal the Visual Pak decision was filed in mid-February 2024 and is currently pending before the Illinois Supreme Court.

The Seventh Circuit also held that the Data Breach Liability exclusion does not bar coverage for BIPA violations. The Data Breach Liability exclusion precludes coverage for "personal and advertising injury" arising out of "disclosure of or access to private or confidential information belonging to any person or organization" or "'damages' arising out of damage to, corruption of, loss of use or function of, or inability to access, change, or manipulate 'data records.'" In short, the Seventh Circuit found that the Data Breach Liability exclusion is not intended to bar coverage beyond data breach liability; since the underlying BIPA lawsuit did not allege a data breach, it did not bar coverage for BIPA violations because the exclusion primarily concerns situations in which hackers obtain access to personal information, rather than a policyholder’s own collection and/or disclosure of personal biometric information.

The Seventh Circuit also assessed whether under the Employment-Related Practices (ERP) exclusion, which excludes coverage for "personal and advertising injury" arising out of "other employment-related practices, policies, acts, or omissions directed toward that person,” Thermoflex’s alleged BIPA violations arose out of a “policy” of requiring hourly workers to use a biometric time-tracking and attendance system. Affirming the district court, the Seventh Circuit construed the ERP exclusion to require that a legal claim arise from an adverse employment action against a worker in a targeted, personal way for the exclusion to apply.

Specifically, the Seventh Circuit held, unlike specific practices such as the hiring or firing of an individual employee, Thermoflex’s biometric time-tracking system was not “directed toward” a specific person. In so holding, the Court rejected Mitsui’s argument that collecting and processing handprints is an “employment-related practice” within the meaning of the ERP exclusion.

Accordingly, the Court found that the ERP exclusion did not bar coverage.

Implications
Before the Seventh Circuit’s affirmance in Thermoflex, there was a split in authority within the Northern District of Illinois that created a bona fide coverage dispute concerning whether the Access or Disclosure exclusion bars coverage for BIPA claims. Although that previous split in authority was enough to protect insurers from bad faith claims under 215 ILCS 5/155, the Seventh Circuit’s affirmance in Thermoflex goes a step further by solidifying the Access or Disclosure exclusion as a bar to coverage for BIPA claims.

Although not a total victory for general liability insurers, this decision is expected to have a significant impact on coverage disputes over BIPA claims because the Access or Disclosure exclusion is an extremely common exclusion in such policies. Therefore, in the wake of Thermoflex, insurers weighing forum-choice considerations may be further incentivized to file declaratory judgment actions in federal court despite the ruling rejecting the Visual Pak case.