Litigation Trends Analysis

The BIPA Insurance Coverage Fight Continues

Technologies involving the use of biometric information have advanced rapidly in recent years. So much so, that the legal landscape has evolved to accommodate the new claims that arise in connection with the use of things like facial geometry and voice recognition. The Illinois Biometric Information Privacy Act (BIPA) concerns the protection of this biometric data, and BIPA has been the basis for a growing number of legal actions. Businesses involved in BIPA litigation have turned to their insurers for coverage. Particularly with general liability insurers, coverage is often denied and the insurer will seek court approval to affirm the claim denials.

Last year in West Bend Mutual Insurance Co. v. Krishna Tan Schaumburg Inc., 2021 IL 125978, 183 N.E.3d 47, the Illinois Supreme Court decided that BIPA lawsuits could potentially be covered by commercial general liability insurance for personal injury. The insurance policy at issue in Krishna Tan defined “personal injury” as “[o]ral or written publication of material that violates a person’s right of privacy.” Id. at 51. The court concluded that a BIPA violation for disclosure of a person’s biometric information was potentially covered as a publication in violation of a person’s privacy rights.

Many insurance companies continued the coverage fight following the Krishna Tan decision, denying coverage based on other exclusions such as recording and distribution of material, employment-related practices, and disclosure of confidential or personal information. 

Recent decisions out of the U.S. District Court for the Northern District of Illinois have reinforced arguments in favor of the policyholders’ coverage for BIPA actions under general liability policies:

1. In Citizens Ins. Co. of Am. v. Thermoflex Waukegan, LLC, No. 20-CV-05980, 2022 WL 602534 (N.D. Ill. Mar. 1, 2022), the insurers sought a declaratory judgment that they had no duty to defend or indemnify the insured in a BIPA action involving the collection of employee handprint data, which was ultimately used for authentication and timekeeping purposes. The court found that the policy exclusions did not relieve the insurers of their duty to defend the insured.
2. In Citizens Ins. Co. of Am. v. Highland Baking Co., Inc., No. 20-CV-04997, 2022 WL 1210709 (N.D. Ill. Mar. 29, 2022), the insurance companies argued no duty to defend or indemnify the policyholder in a BIPA class action. The court adopted the reasoning of Thermoflex in finding that the policies do not unambiguously preclude coverage of the BIPA claims.
3. In Citizens Ins. Co. of Am. v. Wynndalco Enterprises, LLC, No. 20 C 3873, 2022 WL 952534 (N.D. Ill. Mar. 30, 2022), the insurer sought a declaration that the policy did not provide coverage in connection with the BIPA lawsuits involving facial recognition software. The court found that the policy covered the lawsuits and that the insurer had a duty to defend.

Other decisions have affirmed the position of the insurance companies in denying coverage, including:

1. In Fam. Mut. Ins. Co. v. Caremel, Inc., No. 20 C 637, 2022 WL 79868 (N.D. Ill. Jan. 7, 2022), the insurance company argued no duty to defend the policyholder in a class action involving the use of a biometric time clock system to record employees’ time worked. The court found this to be a BIPA violation, but agreed with the insurance company that a policy exclusion applied to the action and justified denying coverage to the policyholder.
2. In Fam. Mut., Ins. Co., S.I. v. Carnagio Enterprises, Inc., No. 20 C 3665, 2022 WL 952533 (N.D. Ill. Mar. 30, 2022), the insurance company sought a declaratory judgment that BIPA violations are excluded under their policies and thus, they have no duty to defend the policyholder in an action involving the use of fingerprints for timekeeping and identification. The court agreed, finding that the BIPA lawsuit did not implicate the insurance policy and the insurance company had no obligation to defend or indemnify the policyholder in connection with the BIPA lawsuit.

These actions continue to crop up and policyholders have more support in their efforts to obtain insurance coverage. When a BIPA claim arises, policyholders should take immediate action, including providing notice to their insurance carriers, reviewing in detail any bases for denial of coverage, and studying the asserted exclusions to determine whether the exclusion survives. 

Please feel free reach out to Honigman’s Data, Privacy and Cybersecurity team with any questions.