Illinois policyholders are likely covered under their insurance policies for a complaint alleging a violation of the Illinois Biometric Information Privacy Act (the "Biometric Act") (740 ILCS 14/1 et seq.).
In West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., the Illinois Appellate Court affirmed a grant of summary judgment in favor of a policyholder on the insurance company’s duty to defend a claim for a violation of the Biometric Act. 2020 IL App (1st) 191834 (March 20, 2020). The appellate court found that the policyholder’s alleged sharing of fingerprint data with a third party was potentially a "personal injury" because it was a "publication" of material that "violates a person’s right of privacy."
Under its Businessowners Liability policies, West Bend agreed to defend its policyholder in a lawsuit that alleged a "personal injury." Id. at ¶ 4. The policies defined a "personal injury" as "injury, other than ‘bodily injury,’ arising out of … oral or written publication of material that violates a person’s right of privacy." Id. at ¶ 27. The underlying complaint alleged that the policyholder violated the Biometric Act by providing the underlying plaintiff’s fingerprint data to a single third-party vendor. Id. at ¶ 28.
The policyholder argued that the underlying complaint alleged a "publication" of material that violated the underlying plaintiff’s right of privacy. Id. at ¶ 23. Relying on the Illinois Supreme Court’s decision in Valley Forge Ins. Co. v. Swiderski Electronics, Inc., West Bend argued that the underlying complaint did not allege a "publication" because a "publication" required communication of information to the public at large, not only to a single third party. Id. at ¶ 29.
The appellate court rejected West Bend’s argument. It held that in Valley Forge, the supreme court did not define the term "publication" as being "limited to requiring communication to any number of persons." Id. at ¶ 33. The appellate court explained that the supreme court simply recognized that "publication" included the actions alleged in the underlying complaint in that case, and did not necessarily limit the meaning of "publication" in the manner suggested by West Bend. Id. The appellate court then analyzed the "plain, ordinary, and popular meaning" of the term "publication" by considering its definition from a dictionary. Id. ¶¶ 34-35. The appellate court found that the term "publication" included both the "broad sharing of information to multiple recipients that the court viewed a ‘publication’ in Valley Forge and a more limited sharing of information with a single third party." Id. at ¶ 35. The appellate court then concluded that West Bend had a duty to defend its policyholder because a "common understanding of ‘publication’" encompassed the policyholder’s alleged act of providing the underlying plaintiff’s fingerprint data to a third party. Id. at ¶ 38.
The appellate court also rejected West Bend’s argument that the "violation of statutes" exclusion barred coverage for the underlying complaint. The policies’ exclusion barred coverage for personal injuries "arising directly or indirectly out of any action or omission that violates or is alleged to violate" the TCPA, the CANSPAM Act of 2003 (15 U.S.C. § 7701 et seq. (2012)), or "[a]ny statute, ordinance or regulation … that prohibits or limits the sending, transmitting, communication or distribution of material or information." Id. at ¶ 40. West Bend argued that the allegations in the underlying complaint fell within the exclusion because the Biometric Act "limits or prohibits the communication of biometric information unless the conditions set forth therein are met." Id. at ¶ 41.
The appellate court disagreed. It held that the "violation of statutes" exclusion was limited to exclude coverage for the violation of statutes that "govern certain methods of communication, i.e., e-mails, faxes, and phone calls, not to other statutes that limit the sending or sharing of certain information." Id. at ¶ 42. Accordingly, the appellate court held that the exclusion did not bar coverage for the Biometric Act claims alleged in the underlying complaint. Id. at ¶ 45.
There has been a recent explosion of Biometric Act claims in Illinois. If a policyholder receives a Biometric Act complaint, it is important that they consult their insurance policies. Most Commercial General Liability policies provide "personal injury" coverage that is similar to the coverage provided by West Bend. If a policy provides "personal injury" coverage similar to the coverage provided by West Bend, then the policyholder should tender the complaint to its insurance company. There is a good chance that, based on the appellate court’s holding in West Bend, the policyholder is covered for the Biometric Act claim.