In Citizens Insurance Company of America v. Wynndalco Enterprises, LLC, No. 22-2313 (7th Cir. 2023), the Seventh Circuit affirmed a ruling that Citizens Insurance Company of America (Citizens) must defend its insured, Wynndalco Enterprises, LLC (Wynndalco), under a business liability policy with regard to two putative class actions filed under the Illinois Biometric Information Privacy Act (BIPA) 740 ILCS 141 et seq. 

The Seventh Circuit held a broad version of the Violation-of-Statutes exclusion is ambiguous because it appears to nullify significant portions of coverage provided under “personal and advertising injury.” Because ambiguities are construed in favor of the insured, the Court held the BIPA claims at least potentially fall within coverage, thus triggering the duty to defend. The decision potentially resolves a split among trial court judges, some of whom found the broad version of the Violation-of-Statutes exclusion unambiguously barred coverage for BIPA claims. 

The Lawsuits

Wynndalco is a technology company that allegedly served as an intermediary between Clearview AI, Inc. (Clearview AI) and the Chicago Police Department’s purchasing agent, CDW-Government. Clearview AI, which has been a defendant in numerous privacy lawsuits, allegedly extracted or “scraped” billions of photographs of individuals from online social media and other platforms and converted those images into biometric facial recognition identifiers so customers can pair faces with other identifying information such as names and addresses. Wynndalco allegedly purchased and/or licensed this information from Clearview AI and provided it to CDW-Government, which in turn provided the information to the Chicago Police Department. The underlying putative class action lawsuits allege these transactions ran afoul of BIPA, which imposes restrictions on how private entities collect, retain, disclose and destroy biometric identifiers. See the authors’ previous article for more background on BIPA.

Wynndalco sought coverage for the lawsuits under a business liability insurance policy. Following the tender, Citizens commenced a declaratory judgment action seeking a declaration that it had no obligation to defend or indemnify Wynndalco because its broad Violation-of-Statutes exclusion barred coverage. This exclusion was the sole basis under which Citizens claimed it had no duty to defend. 

Narrow versus Broad Violation-of-Statutes Exclusion

The Violation-of-Statutes exclusion generally has a narrow version and a broad version. The narrow version excludes coverage for claims arising from violations of the Telephone Consumer Protection Act (TCPA) and the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM Act), and has a catch-all provision that also bars coverage for violations of “[any] statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.”

The broad version also bars coverage for violations of the TCPA and the CAN-SPAM Act of 2003, but further expands the scope to include violations of the Fair Credit Reporting Act (FCRA). Additionally, its catch-all provision excludes coverage for violations of “[any] other laws, statutes, ordinances, or regulations, that address, prohibit or limit the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.”

In West Bend Mutual Ins. Co. v. Krishna Schaumburg Tan Inc., 2021 IL 125978, (May 20, 2021), the Illinois Supreme Court held the narrow version did not bar coverage for BIPA claims because the exclusion only barred coverage for violations that regulate methods of communication such as telephone calls, faxes and emails, and BIPA does not regulate methods of communication.

After West Bend, some trial courts distinguished the broad version from the narrow version and found the inclusion of the FCRA significantly altered the scope of the exclusion because the FCRA does not govern methods of communication. Instead, the FRCA protects the confidentiality of personal information. Finding the TCPA, CAN-SPAM Act of 2003 and the FCRA do not share a natural connection, some trial courts concluded the catch-all provision was intended to exclude coverage for violations of privacy statutes such as BIPA. See, e.g., Continental Western Ins. Co. v. Cheese Merchants of Am., Case No. 21-cv-1571, 2022 U.S. Dist. (N.D. Ill. Sept. 27, 2022) (S. Seeger); State Auto Prop. Cas. Ins. Co. v. Fruit Fusion, Inc., Case No. 3:21-cv-1132-NJR (S.D. Ill. Sept. 29, 2022) (N. Rosenstengel); Massachusetts Bay Insurance Company et al. v. Impact Fulfillment Services, LLC, Case No. 20-cv-926-WLO (M.D.N.C. Sept. 24, 2021); Westfield Ins. Co. v. Archer Advisors, LLC, No. 21 CH 1469 (Cook County Cir. Ct. Aug. 4, 2022) (P. Meyerson, unpublished transcript).

The Arguments and Rulings

Judge John Z. Lee, who was the district judge at the time, found the breadth of the catch-all provision in the broad Violation-of-Statutes exclusion created an ambiguity because it all but eliminated coverage for certain claims that are largely, if not exclusively, statutory in nature and therefore the exclusion essentially “swallowed” the “personal and advertising injury” coverage.

On appeal, the Seventh Circuit panel, of which Judge Lee was not a part, agreed and noted the definition of “personal and advertising injury” included not only the oral or written publication of material that violates a person’s right of privacy but also the oral or written publication of material that slanders or libels a person or organization, the use of another’s advertisement, and infringing upon another’s copyright. The Seventh Circuit found all these injuries are subject to, or potentially subject to, statutory causes of action and that the broad Violation-of-Statutes exclusion would essentially exclude from coverage such statutory prohibitions.

The Seventh Circuit acknowledged that coverage still would be afforded for non-statutory common-law claims, and therefore coverage is not illusory, but nevertheless found the exclusion “on its face would eliminate coverage for a number of statutory injuries expressly included in the definition of ‘personal and advertising [injuries]’ that the policy purports to cover” and that the “clash between competing provisions of the policy gives rise to an ambiguity …” 

The Seventh Circuit also rejected Citizens’s argument that the catch-all provision only excluded coverage for statutory causes of action related to privacy. Using the doctrines of ejusdem generis (meaning “of the same kind”) and noscitur a sociis (meaning “it is known by its associates”), the Court found there was no harmonizing factor or common characteristic that points to privacy as the focus of the exclusion. 

Implications

The Citizens decision may resolve the split of trial court opinions analyzing similar broad versions of the Violation-of-Statutes exclusion. However, the Seventh Circuit’s reasoning will likely be concerning for insurers and might have implications beyond coverage for BIPA claims. The Seventh Circuit essentially found the exclusion was ambiguous because on its face it was too broad because “that provision would swallow a substantial portion of the coverage that the policy otherwise explicitly purports to provide …”

However, the Seventh Circuit also found the exclusion was not so broad as to create illusory coverage because coverage would be afforded for common-law claims. This reasoning therefore begs the question, at what point does an exclusion become broad enough that is becomes ambiguous? The Seventh Circuit did not provide much guidance in this regard.