Court Finds that Liability Insurance Coverage Covers Company Sued under Illinois Biometric Information Privacy Act

A recent case of first impression out of the Illinois Appellate Court, First District continues to develop precedent for class actions under the Illinois Biometric Information Privacy Act (BIPA). In West Bend Mutual Insurance Company v. Krishna Schaumberg Tan, Inc., the Illinois Appellate Court held that a company’s liability insurance policy for personal injury covered an underlying class action alleging violations of BIPA and that the company’s insurer therefore had a duty to defend the company in the class action. This case adds to the important precedent relating to BIPA class actions that has developed over the past few years, and sheds light as to how courts may construe insurance policies involving alleged BIPA violations.

Certain previous court decisions have also set notable precedent for BIPA violations and set the stage for the importance of the West Bend case. A 2019 landmark decision discussed here established that companies could be held liable under BIPA for mere statutory non-compliance. In this case, the Illinois Supreme Court found that civil liability under BIPA, which carries penalties that could exceed $5,000 per violation, does not require a data breach, wrongful disclosure, or actual injury to the consumer. Following the case, the number of class actions under BIPA has skyrocketed across the country, including a Ninth Circuit case that Facebook agreed to settle in January 2020 for $550 million (discussed here).

The West Bend case stems from a class action complaint filed against a tanning company, Krishna Schaumburg Tan, Inc., by clients in April 2016. The complaint alleged violations of BIPA, specifically that Krishna Schaumburg Tan, as part of its membership, required clients to have their fingerprints scanned for identity verification purposes and then disclosed this biometric data to a third-party vendor without providing or obtaining written consent from clients. Krishna Schaumburg Tan tendered the class action complaint to its insurer, West Bend, seeking a defense and indemnity under its insurance policies. West Bend agreed to defend Krishna Schaumberg Tan under a reservation of rights but then sought a court declaration that it had no duty to defend the company. West Bend argued that the insurance policies did not cover the class action lawsuit because the underlying allegations did not describe an “advertising injury” or a “personal injury” and, in the alternative, that a policy exclusion for statutory violations barred coverage for the underlying lawsuit.

Both the trial court and the Illinois Appellate Court found that West Bend had a duty to defend Krishna Schaumburg Tan because (1) the underlying class action complaint potentially fell within the insurance policies’ definition of “personal injury”; and (2) the statutory violations exclusion did not apply. The policies defined “personal injury” as an “injury, other than ‘bodily injury’ arising out of…oral or written publication of material that violates a person’s right of privacy.” The Illinois Appellate Court held that the transmission of fingerprint data qualified as a “publication” as that term was used in the policies, rejecting West Bend’s argument that publication required communication of information to the public at large, rather than to a single third party. In doing so, the court highlighted that the term “publication” was not defined in the policies, and thus the coverage analysis required the court to consider the dictionary definitions of “publication” rather than solely how other courts have construed the term.

The West Bend case illustrates how a BIPA class action may be covered under an insurance policy as a “personal injury” and how a court may interpret “publication” of biometric information. It also highlights the need for insurance coverage for data privacy matters, which we previously discussed in relation to data breaches here. As litigation in this area continues to increase, companies that collect information subject to BIPA or to other biometric privacy laws should monitor and ensure their compliance with those laws, as well as obtain adequate insurance coverage or review existing coverage to ensure protection from alleged violations.

If you need assistance complying with biometric information laws or other privacy laws, or if you have any questions regarding your insurance policies or any potential insurance claims associated with collecting biometric information, please contact one of the authors above.

Firm Highlights
Client Alert

Have You Done Your Annual CCPA Housekeeping?

More
Diversity & Inclusion

Law Firm ILN-telligence Podcast Hosts Ronald A. Norwood to Discuss Mentorship, Diversity & Inclusion in the Legal Industry, and the Importance of Equity for All

More
Client Alert

New York State Regulator Discourages Ransomware Payments and Publishes New Cyber Insurance Risk Framework

More
Diversity & Inclusion

Lewis Rice Member Ronald A. Norwood Serves on Missouri Bar’s Special Committee on Lawyers of Color to Establish Diversity, Inclusion Programs

More
Client Alert

Model COBRA Notices Under the American Rescue Plan Act

More
Client Alert

Temporary COBRA Changes Under the American Rescue Plan Act

More
Diversity & Inclusion

Two Lewis Rice Members Selected for Leadership Council on Legal Diversity Programs

More
Client Alert

CROWN Act Legislation on the Verge of Passage in St. Louis City & County

More
Client Alert

Supreme Court Hands Down Unanimous Decision Limiting FTC’s Ability to Seek Monetary Relief

More
Client Alert

Federal Appellate Court Determines a Website Is Not a “Place of Public Accommodation” Under the ADA

More
News

Meghan S. Largent and Lindsay S. C. Brinton Negotiate $700,000 Award to Cobb County, Georgia Landowners in Rails-to-Trails Case

More
Client Alert

Public Access to Electronic Court Records in Missouri

More
News

Brian P. Pezza Gives Advice on Vaccination Acceptance in the Workforce in Society for Human Resource Management Article

More
News

Jeremy P. Brummond’s Article on Waivers of Consequential Damages is Published in Construction Executive

More
Diversity & Inclusion

Fatima G. Khan Elected President of South Asian Bar Association of Metropolitan St. Louis

More
News

Kansas City Office of Lewis Rice Names New Member

More
Client Alert

COVID-19 Rescue Plan Act Expands Paid Leave Availability but Does Not Revive Employer Mandates

More
Client Alert

Virginia Passes Sweeping Data Privacy Legislation Similar to CCPA and GDPR

More
News

Lindsay S. C. Brinton and Meghan S. Largent Negotiate $1.4 Million Settlement for Landowners along Legacy Trail

More
News

Jerina D. Phillips Offers COVID-19 Vaccination Advice for Employers in St. Louis Magazine Article

More