Insurance Law Update, author Jamie L. Hull, Esq., Illinois Defense Counsel Quarterly, Jan. 2022

West Bend Mutual Insurance Company v. Krishna Schaumburg Tan, Inc.: CGL Coverage for BIPA Claims Destined to Be Short-Lived, Author Jamie L. Hull

While at first glance the Illinois Supreme Court’s recent ruling in West Bend Mutual Insurance Company v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, may appear to be an important “win” for policyholders any such victory will likely prove to be short-lived.

In Krishna Schaumburg, a customer filed a class-action lawsuit against a tanning salon for alleged violations of the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1. The customer alleged that the salon collected customers’ fingerprints and entered them into a national database for identification. Id. at ¶ 1. The salon allegedly violated BIPA by disclosing the customers’ fingerprints to a third-party vendor. Id.

BIPA was enacted by the Illinois legislature in 2008 due to the increased use of biometrics by companies and the consequential heightened risk for identity theft should that biometric information be compromised. 740 ILCS 14/5(c). At the time, Illinois was the first state to regulate the collection of biometric information. NICOLE O., The Illinois Biometric Information Privacy Act and Your Business, https://bit.ly/3BmefF6 . Other states such as Washington, Texas, New York, California, and Arkansas have passed similar laws. DMITRY SHIFRIN, MARY TOBIN & LINDSAY DAILEY, Past, Present And Future: What’s Happening With Illinois’ And Other Biometric Privacy Laws, https://www.biometrica.com/whats-happening-with-illinois-and-other-biometric-privacy-laws/  However, Illinois currently remains the only state to create a private right of action for damages allegedly stemming from a violation of the statute. Id.

BIPA prohibits companies from collecting, capturing, purchasing, or receiving through trade a person’s biometric information unless they: (1) inform the person in writing that the biometric information is being collected or stored; (2) inform the person in writing of the specific purpose and length of term for which the biometric information is being collected, stored, and used; and (3) receive a written release executed by the person of the biometric information. 740 ILCS 14/15(b). Biometric information includes retina or iris scans, fingerprints, voiceprints, and scans of hand or facial geometry. 740 ILCS 14/10.

BIPA also prohibits companies from disclosing biometric information to third-parties unless there is consent, is for purposes of completing a financial transaction request, state or federal law requires the disclosure, or there is a valid warrant or subpoena requiring the disclosure. 740 ILCS 14/15(d). Any “aggrieved person” may recover $1,000 “for each violation” against a company that “negligently” violates BIPA, or $5,000 “for each violation” against a company that “intentionally or recklessly” violates BIPA. 740 ILCS 14/1-30. However, it is unclear what “for each violation” means. ALLEN SMITH, Illinois Biometric Class Actions Are on the Rise, https://www.shrm.org/ResourcesAndTools/legal-and-compliance/state-and-local-updates/Pages/biometric-class-actions.aspx.  A prevailing party may also obtain injunctive relief and reasonable attorney’s fees and costs, as well as expert witness fees and other litigation expenses. Significantly, the Illinois Supreme Court has held that plaintiffs need not sustain actual damage to establish that they are “aggrieved” under BIPA. Rosenbach v. Six Flags Entertainment Corp, 2019 IL 123186.

The salon in Krishna Schaumburg carried a business owners’ liability insurance policy, which is commonly referred to as a commercial general liability or “CGL” policy. CGL policies are designed to protect commercial entities from litigation and liability arising out of their business operations. RANDY MANILOFF & JEFFREY STEMPEL, General Liability Insurance Coverage Key Issues In Every State 5 (4th ed. 2020). They generally provide coverage for “bodily injury” and “property damage” claims sounding in negligence, as well as coverage for “personal and advertising injury” claims. “Personal and advertising injury” is customarily defined as injury arising out of certain enumerated offenses including the oral or written publication of material that violates a person’s right of privacy. Id. at 13-14.

In Krishna Schaumburg, the salon tendered the class action lawsuit to its CGL insurer, West Bend Mutual Insurance Company (“West Bend”) and requested a defense. Krishna Schaumburg, 2021 IL 125978, ¶ 1. In response, West Bend agreed to defend the salon pursuant to a reservation of rights and filed a declaratory judgment action asserting that: (1) the underlying class action lawsuit did not come within the policies’ coverage for personal injury or advertising injury because the lawsuit did not allege a publication of material that violates a person’s right of privacy; and (2) the policies’ violations of statutes exclusion applied and barred West Bend from having to provide coverage to the salon for the underlying lawsuit. Id. at ¶ 13. The violations of statutes exclusion in the West Bend policy provided:

This insurance does not apply to:  DISTRIBUTION OF MATERIAL IN VIOLATION OF STATUTES

‘Bodily injury’, ‘property damage’, ‘personal injury’ or ‘advertising injury’ arising directly or indirectly out of any action or omission that violates or is alleged to violate: (1) The Telephone Consumer Protection Act (TCPA) [47 U.S.C. ,[((2018) 227 § including any amendment of or addition to such law; or (2) The CAN-SPAM Act of 2003 [(15 U.S.C. § 7701 (Supp. III 2004))], including any amendment of or addition to such law; or (3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.” Id. at ¶ 9.

The Court ruled against West Bend finding that the term “publication” includes both communication to a single party and communication to the public at large requiring the Court to construe the policy in favor of the policyholder. Id. at ¶ 43. The Court also held that a violation of the statutes’ exclusion did not apply to bar coverage for the salon’s BIPA claim as the exclusion only applied to methods of communication. BIPA does not regulate methods of communication but regulates “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” Id. at ¶¶ 56-58. Accordingly, BIPA was not one of the statutes contemplated by the exclusion. Id. at 58.

The Krishna Schaumburg decision relied on the specific language of the West Bend policy and ejusdem generis, a rule of statutory and contract construction. However, not all CGL policies contain identical insurance exclusion provisions. In fact, more recent versions of the violations of statutes exclusion apply to a statute that not only “prohibits or limits,” but also the “collecting” and “recording” of material or information. Moreover, in addition to excluding coverage for alleged violations of the TCPA, CAN-SPAM, FRCA, and FACTA, the exclusion also precludes coverage for “personal and advertising injury” arising directly or indirectly out of any act or omission that violates or is alleged to violate any federal, state, or local statute, ordinance, or regulation. These broader versions of the violations of statutes exclusion should dictate a different result than that in Krishna Schaumburg.

Insurers have filed declaratory judgment actions asserting in several pending cases that the following exclusions further preclude coverage for BIPA claims: (1) employment-related practices; (2) access or disclosure of confidential or personal information; (3) “knowing” violations of rights; and (4) recording and distribution of material in violation of the law. State Auto Mut. Ins. Co. v. Tony’s Finer Foods Enters., Inc., No. 1:20-cv-06199 (N.D. Ill. Jan. 28, 2021); Old Republic Union Ins. Co. v. McDonald’s USA, LLC, No. 2021 CH 02445 (Ill. Cir. Ct. May 19, 2021); Scottsdale Ins. Co. v. Mini Storage Maintenance, LLC, 2020 CH 07294 (Ill. Cir. Ct. Dec. 15, 2020); Westfield Ins. Co. v. Caputo’s New Farm Produce, Inc., No. 2019 CH 00232 (Ill. Cir. Ct. Jan. 18, 2019); Am. Guar. Liability & Ins. Co. v. Toms King LLC, 2020 CH 04472 (Ill. Cir. Ct. June 5, 2020).

Other possible exclusions to alleged BIPA claims include those that preclude coverage for injury arising out of the intrusion into, or theft of, information that is electronically stored, commonly referred to as “hacking” or “cyber” liability exclusions. Most importantly, however, some insurers are already adding BIPA exclusions to their CGL policies. Accordingly, the impact of the Krishna Schaumburg decision over time will likely have little or no practical application.

About the Author
Jamie L. Hull focuses her practice on complex, high exposure insurance coverage and commercial litigation matters, including broker/agent professional liability, business litigation and appellate. She represents insurance companies, corporations and individuals in a wide range of insurance and business matters in multiple jurisdictions. Ms. Hull has extensive experience working with risk retention groups, self-insured retentions and insurance policies including commercial general liability, professional liability, D&O liability, employer’s liability, builder’s risk, cyber liability, excess/umbrella liability and disability. In addition, she serves as outside general counsel for a variety of companies. She counsels on all business-related matters, coordinates and manages all commercial litigation, dispute and transactional work, national, regional, and state distribution agreements, contracts with industry suppliers, employment, operating, services, licensing agreements, and other commercial agreements.

About the IDC
The Illinois Defense Counsel (IDC) is the premier association of attorneys in Illinois who devote a substantial portion their practice to the representation of business, corporate, insurance, professional and other individual defendants in civil litigation. For more information on the IDC, visit us on the web at www.IDC.law or contact us at PO Box 588, Rochester, IL 62563-0588, 217-498-2649, 800-232-0169, admin@IDC.law.

REPRINTED WITH PERMISSION. IDC Quarterly Volume 31, Number 4 (31.4.10) |  Illinois Defense Counsel | www.idc.law | 800-232-0169 Statements or expression of opinions in this publication are those of the authors and not necessarily those of the association. IDC Quarterly, Volume 31, Number 4. © 2021. Illinois Defense Counsel. All Rights Reserved. Reproduction in whole or in part without permission is prohibited.