Last week the Seventh Circuit Court of Appeals ruled on yet another BIPA-related insurance coverage dispute, adding to the growing list of such Illinois state and federal decisions attempting to define the limits of insurance coverage for such actions. In Citizens Ins. Co. of Am. v. Wynndalco Enter., LLC, 2023 U.S. App. LEXIS 14834 (7th Cir. June 15, 2023), the Seventh Circuit Court of Appeals addressed whether a broad catch-all provision in a “violation-of-statutes” exclusion relieves the insurer of the duty to defend its insured in litigation over violations of Illinois' Biometric Information Privacy Act ("BIPA"). The court ultimately determined the catch-all provision was so broad in scope that it would eliminate coverage for injuries the policy purported to cover, creating an impermissible ambiguity. Accordingly, the Seventh Circuit Court of Appeals upheld the district court’s holding that Citizens Insurance Co. (“Citizens”) had a duty to defend its insured.
In Citizens Ins. Co. of Am., Wynndalco, the insured, bought and resold facial recognition software made by Clearview AI in a manner that allegedly ran afoul of BIPA. By way of background, Clearview AI created the software by extracting or “scraping” over three billion photographs of individuals from social media platforms (including Facebook, Instagram, and Twitter, among others) and converting them into biometric facial recognition identifiers using proprietary algorithms. With this data, Clearview AI created a facial recognition application that allows users to identify an individual by uploading a photograph of them to the app. After uploading the photo, the user can then see photographs of the individual on other media platforms or websites, and get other identifying information like their name and address. As a result, several counts were brought against Wynndalco alleging that it intentionally or recklessly violated sections 15(b) and (c) of the BIPA.
At the time of the sale, Wynndalco had business owner's insurance coverage through a Citizens’ policy that provided liability coverage for “personal and advertising injury,” defined to include “injury, including consequential 'bodily injury,' arising out of ... [o]ral or written publication, in any manner, of material that violates a person's right of privacy.” Citizens did not dispute that Wynndalco’s alleged conduct fell within the policy’s definition of “personal and advertising injury,” but rather the claims were barred by a catch-all provision in a policy exclusion barring coverage for certain statutory violations. The “violation of statutes” exclusion excluded coverage, in relevant part, for “personal and advertising injury” arising directly or indirectly out of any action or omission that violates or is alleged to violate: (1) the TCPA; (2) the CAN-SPAM Act of 2003; (3) the Fair Credit Reporting Act, including FACTA; and (4) Any other laws, statutes, ordinances, or regulations, that address, prohibit or limit the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.
Using this exclusion, Citizens argued the injuries alleged constituted a “personal or advertising injury” that arose directly or indirectly from BIPA violations, which is a “law” or “statute” of the type that is excluded from coverage.
The Seventh Circuit, as did the District Court, found Citizens argument unpersuasive. According to the Court, a literal reading of the broad language of the exclusion would not only limit coverage for privacy-related statutes like BIPA, but would also limit the very statutory causes of action the policy purports to cover, such as libel, slander, trademark, and copyright. The Court stressed that policy terms that purport to limit an insurance company’s liability are construed in favor of coverage when terms are ambiguous or susceptible to more than one reasonable interpretation. In some instances, the language of a policy exclusion may seem clear in isolation, but when read alongside a separate policy provision that grants coverage for the same type of action or injury that the exclusion ostensibly reaches, an ambiguity arises. That is precisely the type of ambiguity the Seventh Circuit found here—The exclusion appears to take away with one hand coverage that the policy purports to give with the other.
The Seventh Circuit also rejected Citizens’ attempt to rely on the canons of ejusdem generis and noscitur a sociis to argue that the catch-all provision is limited only to statutes relating to privacy. The Court concluded that the use of these interpretative canons did not provide a narrower reading that would solve the ambiguity inherit in the policy. First, the Court reasoned that the language in the heading of the exclusion broadly referred to “Distribution of Material in Violation of Statutes” with no additional words that limit it to statutes regulating communication, privacy, or any particular subject matter. Second, the Court found that the contrasting scope of the statutes within the exclusion did not help limit the catch-all provision either. The FCRA and FACTA statutes regulate the reporting of credit information and the accuracy of consumers’ credit-related records, while the TCPA and CAN-SPAM regulate communication.
While the Court did concede the four statutes could all be described as bearing on individual “privacy” at a very high level of generality, there is no readily discernible theme that “jumps off the page” and would put the type of layperson or business purchasing this policy on notice that injuries arising from the violation of privacy-related statutes are excluded from coverage. The Seventh Circuit reasoned that only by engaging in a relatively sophisticated and nuanced examination of the four statutes might one be able to identify generic privacy as a theme that unifies them, and that, the Court concluded, gives the ejusdem generis canon entirely “too much work to do.” The noscitur a sociis textual canon, “a word is known by the company it keeps,” also failed to resolve the ambiguity for the same reasons.
In the end, the Seventh Circuit found that a plain-text reading of the exclusion and its catch-all provision had an extremely broad sweep that would eliminate coverage for a number of statutory injuries expressly included in the definition of “personal and advertising injuries.” According to the Seventh Circuit, this clash between competing provisions left the court with no choice other than to conclude that the catch-all provision in the violation-of-statutes exclusion was ambiguous. In construing the ambiguity against Citizens and in favor of the insured, the Court concluded that the underlying injuries alleged at least potentially fall within the coverage of the Citizens policy. Thus, Citizens owed its insured a duty to defend.
