Illinois Supreme Court Clarifies Duty to Defend Insureds Against BIPA Claims

The Facts of the Case

The class action filed on behalf of the class by Klaudia Sekura was the underlying lawsuit. Sekura was a one-time member of Krishna Schaumburg Tan Inc., a tanning salon. Under the terms of the membership, Sekura gained access to L.A. Tan tanning salons. Krishna was a franchisee of the L.A. Tan chain. However, Sekura was required to provide her fingerprints to Krishna.

Sekura’s class action against Krishna alleged that Krishna violated the BIPA. Allegedly, Krishna violated BIPA by taking customers’ fingerprints and sharing them with an out-of-state third-party vendor.

Upon receiving notice of the lawsuit, Krishna sent the information to West Bend Mutual Insurance Co., its business insurer. Krishna then sought coverage under Krishna’s business insurance policy with West Bend. West Bend provided a defense under a reservation of rights, believing Krishna’s business insurance policy did not cover BIPA claims. Without that coverage, West Bend did not have a duty to defend Krishna in the case.

Why Exclusions for Statutory Actions Did Not Apply

Specifically, West Bend believed it had no duty to defend because Krishna’s policy contained a violation of statutes exclusion. The exclusion stated that the policy did not cover injury “arising directly or indirectly out of any action or omission that violates or is alleged to violate” two named statutes, the Telephone Consumer Protection Act (TCPA) or the CAN-SPAM Act, or any other law or regulation “that prohibits or limits the sending, transmitting, communicating, or distribution of material or information.”

West Bend’s declaratory judgment action alleged that the violation of statutes exclusion applied. It also claimed that Sekura’s complaint did not fall within the policy’s “personal injury” or “advertising injury” coverage. West Bend further claimed the complaint did not allege any publication of material that would violate someone’s right to privacy.

Court Ruling

The court addressed both claims. Regarding the violation of statutes exclusion, the court held that the language of the policy did not bar coverage. The violation of statutes exclusion referred to the communication of information. It specifically referenced two types of statutes that address communication—the TCPA and the CAN-SPAM Act.

Applying rules of statutory interpretation, the court held that the exclusion applies to statutes like the TCPA and CAN-SPAM Act. The court stated that BIPA is not a statute of the same type. It seeks to regulate consent and privacy, rather than communication methods. Thus, the court held, West Bend’s exclusionary language did not apply. The insurance company had a duty to defend Krishna under the terms of the business insurance policy.

As to the question of publication, the court found that publication could include communication with a single party—for example, the third party that received Sekura’s and other customers’ fingerprints. It also held that BIPA intends to protect the “right of an individual to keep his or her personal identifying information like fingerprints secret.” As such, the court held, Sekura’s claim against Krishna fell within the phrase “right to privacy.” West Bend business insurance policy lists this phrase.

What to Expect in Future Biometric Protection Cases

The Illinois Biometric Information Privacy Act is unique among state biometric privacy laws. It is the only one that currently offers a private right of action to individuals whose biometric information is taken, used, or shared without their consent. Consequently, the state supreme court is split on the application of business insurance policies to biometric information. As such, privacy claims from insureds are unlikely in the near future.

However, the Illinois Supreme Court decision will likely impact how insurance companies proceed with future policies and insureds within Illinois. Insurers may update their policy language to reflect that violation of statutes exclusion covers statutory claims, including BIPA claims. They may also choose to offer BIPA coverage riders for an additional fee to customers to seek them.