Coverage litigation over whether alleged violations of Illinois’ Biometric Privacy Act (“BIPA”) triggers coverage under commercial general liability or similar policies has been a hot topic over the past few years. While it seemed the courts were trending toward finding coverage in many instances, recent Illinois case law has tipped the other way. On February 27, 2024, in Citizens Ins. Co. of Am. v. Mullins Food Products, 2024 U.S. Dist. LEXIS 33273 (N.D. Ill. Feb. 27, 2024) the United States District Court for the Northern District of Illinois, applying Illinois law, held that two policy exclusions containing broad catch-all provisions, barred coverage for alleged BIPA violations. The two exclusions the District Court found applied to bar coverage were the “Recording And Distribution Of Material or Information In Violation Of Law Exclusion” and “Access Or Disclosure Of Confidential Or Personal Information Exclusion” contained within the commercial general liability policy the insured held with Citizens Insurance Company of America.
In the underlying case, Mullins Food Products was sued by a former employee who alleged that during the time he worked there, he was required to use biometric identifiers, which Mullins allegedly disseminated in violation of BIPA. While the District Court initially found that Citizens had a duty to defend, Citizens moved for reconsideration of that ruling in light of a recent Illinois appellate court case, Nat’l Fire Ins. Co. of Hartford & Cont’l Ins. Co. v. Visual Pak Co., No. 2023 IL App (1st) 221160 (Dec. 19, 2023), which held that an identical Recording and Distribution exclusion applied to BIPA claims to bar coverage.
The court first addressed the “Recording And Distribution Exclusion,” which excludes from coverage “personal and advertising injury” arising directly or indirectly out of any action or omission that violates or is alleged to violate: (1) the TCPA; (2) the CAN-SPAM Act of 2003; (3) the FCRA and FACTA; or “(4) Any federal, state or local statute, ordinance or regulation, other than the TCPA, CAN-SPAM Act of 2003 or FCRA and their amendments and additions, that addresses, prohibits or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.” Citizens argued that the BIPA violations fell within the fourth, “catch all” provision and would be excluded from coverage. Although the District Court recognized a division in the federal district courts over application of the catch-all provision in similar exclusions, the court was persuaded by the Illinois Appellate Court’s recent decision in Visual Pak.
The District Court distinguished similar exclusionary language addressed by the Seventh Circuit, reasoning that Recording and Distribution Exclusion was identical to the one addressed in Visual Pak and broader than that addressed by the Seventh Circuit. According to the District Court, the BIPA violations fell within the catch all provision of the exclusion which encompassed statutes addressing personal privacy under either a plain reading of the provision or by applying the doctrine of ejusdem generis, which seeks to clarify a broad or general term by looking to the specific items preceding that term for clues as to how that term should be construed. Using these textual canons, the District Court found that the scope of the catch all provision applied to violations of statutes or other laws that protect personal privacy, which “unambiguously” included BIPA violations.
The District Court also addressed the “Access Or Disclosure Of Confidential Or Personal Information Exclusion,” which precludes coverage for “personal and advertising injury” arising out of any access to or disclosure of any person’s or organization’s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information. While the appellate court’s recent opinion in Visual Pak did not address this exclusion, the District Court found its reasoning also applicable to the “Access of Disclosure” exclusion. Looking to the text of the exclusion, the District Court found that the word “any” has a broad meaning and that “personal information” easily could include information typically kept private. According to the District Court, a literal, plain reading of the text included fingerprints and handprints. Within the second clause, the District Court reasoned that the list was illustrative, rather than exhaustive, and that “any other nonpublic information” would include handprints or fingerprints. Thus, “the mere fact that an exception conflicts with the coverage provision does not, in and of itself, make it ambiguous” and the exclusion did not “wholly eviscerate” the “personal and advertising injury” coverage provided by the policy.
