The deluge of lawsuits brought under the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14 et seq. over the past several years has presented a challenge to companies operating in Illinois. Not surprisingly, companies looked to insurance coverage for BIPA claims, but nearly all such claims were denied. To make matters worse, insurers aggressively filed declaratory judgment actions opening up a two-front legal war for policyholders. One such case filed by an insurer finally reached the Illinois Supreme Court, and in a stunning reversal of fortune, the court definitively found in favor of coverage for BIPA claims under a general liability policy. West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 2020 IL 125978 (May 20, 2021).

As background, BIPA allows for a private cause of action with statutory damages against companies that collect, capture, purchase, receive, otherwise obtain, disclose, or disseminate biometrics and negligently or intentionally fail to provide notice in writing and to obtain a written release. BIPA also requires companies that possess biometrics to publish a publicly available retention schedule, and prohibits selling, leasing, trading, or otherwise profiting from biometrics. Failure to strictly comply with BIPA is the basis for over 1,000 class action lawsuits filed against companies of all types in Illinois. The costs of defending BIPA claims are high and the potential liability under the statute could lead many to bankruptcy, while settlements costs are daunting. Facebook, for example, reached a $650 million BIPA settlement after a judge refused to approve a $550 million settlement. Facebook faced billions in alleged liability under BIPA.

Although insurance policy language may vary, virtually all denials rest primarily on two arguments: (1) BIPA claims are not a “personal injury” where there is no “publication” violating a right of privacy; and (2) BIPA is a statutory scheme that falls under a violation of statutes exclusion catchall. The Illinois Supreme Court in West Bend rejected both of these arguments and ordered the insurer to continue to provide a defense. As such, the decision in West Bend is instructive for other coverage disputes involving BIPA.

Broad Understanding of Publication for Personal Injury or Advertising Injury

General liability policies contain a coverage for “personal injury” or “advertising injury” arising out of an “oral or written publication of material that violates a person’s right to privacy.” Insurance carriers routinely argue that the distribution of biometrics from a policyholder to a private third party is not a “publication of material” under the policy language, because the information is not being communicated to the public. Instead, as in West Bend, the information is being communicated to a third-party vendor maintaining a database or providing a discrete service such as payment processing.

The Illinois Supreme Court rejected that argument by giving “publication” a broad definition. The court reasoned that when a term is undefined in an insurance policy it should be given its plain, ordinary, and popular meaning, including consulting dictionary definitions. Referring to classic dictionary definitions, the court concluded that any reasonable person would understand “publication” to include both sharing with the public and sharing with a single third party.

BIPA Does Not Fall Under the Statutory Exclusion Catchall

After facing considerable class-action liability under the Telephone Consumer Protection Act (TCPA) and the CAN-SPAM ACT of 2003, insurers began inserting “distribution of material in violation of statutes” exclusions in general liability policies. The exclusion is often written to say that the insurance does not apply to “personal injury” arising out of any action or omission that violates the TCPA, the CAN-SPAM ACT of 2003, or other acts like those two. In this instance the catchall provided:

Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM ACT of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.

Insurers argue, as did the insurer in West Bend, that this “other than” catchall provision should include BIPA claims. The court disagreed. In addition to reading the title of the catchall to limit the exclusion to enumerated types of communication, the court found that the catchall should be read in conjunction with the TCPA and CAN-SPAM to include only those statutory acts that regulate certain methods of communication. BIPA does not regulate methods of communication. As such, the court determined the BIPA claim at issue was not excluded.  

Possible Impact of West Bend on the Statute of Limitations for BIPA Claims

In addition to the application of West Bend to coverage issues, it also has the potential to affect what the appropriate statute of limitations is for BIPA claims. BIPA does not provide for a statute of limitations and what limitations period applies is the subject of several appeals. For example, in Tims v. Black Horse Carriers, Inc., No. 1-20-0562, the Illinois Appellate Court will determine whether the one-year, two-year of five-year statute of limitations applies to BIPA claims where the trial court (and many other trial courts) found that the five-year catchall statute of limitations applies. In Cothron v. White Castle System, Inc., No. 20-3202, the U.S. Court of Appeals for the Seventh Circuit is poised to rule on when the claim accrues for statute of limitations purposes—whether it accrues at the first scan or whether each subsequent scan is a separate violation. The argument that the proper statute of limitations is the one-year period is found in 735 ILCS 5/13-201 for defamation and privacy actions. Section 13-201 applies to “publication of matter violating the right of privacy.” As noted above, the court in West Bend found that the personal injury and advertising injury arose from “the oral or written publication of material that violates a person’s right to privacy.” ¶49. This is nearly identical language to that found in 13-201. Thus, the West Bend decision supports the application of the one-year statute of limitations for BIPA claims as BIPA involves the “publication of matter violating the right of privacy.”

Takeaways

The Illinois Supreme Court decision in West Bend provides guidance to policyholders seeking to obtain coverage under general liability policies. Policyholders should not simply accept a denial letter from a general liability carrier for a BIPA claim. Instead, companies should carefully review their insurance policies and the allegations of a BIPA complaint to determine if they contain language or circumstances similar to that considered in West Bend. Coverage counsel can assist with this process, including responding to denials and working with insurers to resolve disputes.

© 2021 Perkins Coie LLP