Finally, Some Good News for Illinois Employers When Defending BIPA Suits.
Illinois employers are subject to the strictest biometric privacy law in the country. Since its passage in 2008, the Biometric Information Privacy Act (“BIPA”) regulates private employer use of employee biometric information. This has opened the floodgates to a wave of BIPA class actions, many of which are directed at employers who use fingerprint technology to keep employee time records. For more information about BIPA read here, here, and here.
The Illinois Supreme Court recently held that a business owners’ liability insurance policy provided coverage to an employer for limited disclosures of biometric data. The case arose from an employer’s mishandling of employee fingerprints. This is good news for Illinois employers because many earlier cases sided with insurers and no coverage was available for these suits.
According to the class action complaint in West Bend Mutual Insurance Company v. Krishna Schaumburg Tan, Inc., Krishna Schaumburg Tan, Inc. (“Krishna”) violated BIPA when it scanned customer fingerprints and disclosed biometric information to out-of-state third-party vendors. After being sued, Krishna tendered defense of the lawsuit to his insurance carrier, Westbend Mutual Insurance Co. (“Westbend”) for defense and indemnification. Westbend denied coverage and claimed that it did not owe Krishna a duty to defend.
Insurer’s Duty to Defend and Indemnify
Insurance policies typically include a duty to defend and a duty to indemnify. The “duty to defend” is an insurer’s commitment to provide an insured with a defense to claims that qualify under an insurance policy. Illinois employers often need their insurers to defend them in BIPA suits because the cost of defending these suits is high.
The “duty to indemnify” is an insurer’s obligation to pay claims for loss or damages against an insured if such penalties are incurred. Although this is traditionally what most insureds think of when they think of “insurance.” The duty to indemnify is typically narrower than the duty to defend.
Whether an insurer has a duty to defend an insured party in a lawsuit depends on the allegations of the complaint and the language of insured’s policy. Many Illinois insurers have denied any duty to their Illinois employers and insureds when BIPA claims are made.
Legal Analysis
Krishna was insured by Westbend under a business owners’ liability policy. Business owners’ [policies protect companies against major property and liability risks. These policies tend to cover an insured’s liability for “bodily injuries”, “personal injuries”, and “advertising injuries”. Krishna’s policy defined both “personal injury” and “advertising injury” to include injuries arising from “publication” of material that violates one’s “right of privacy”. However, the policies did not define “publication” or “right of privacy”.
Westbend’s primary argument for denying its duty to defend was that the disclosure of fingerprints to a single party did not qualify as a “publication”, and, therefore, the personal injury and advertising injury coverages were inapplicable to claims arising from BIPA.
The Court held, however, that “publication” “simply means the dissemination of information” to a single party as well as “communication to the public at large.” Because the term involved two definitions, the Court further held that it was ambiguous and had to be interpreted against the insurer that drafted the policy. Thus, the Court concluded that Krishna’s sale of the biometric information constituted “publication” of private information and was covered under his insurance policy’s Personal Injury and Advertising Provision.
Employer Takeaways
The decision in West Bend Mutual Insurance Company offers employers a basis to seek a defense for BIPA claims from insurers. This holding is likely to give rise to an increasing number of insurance coverage disputes. Therefore, employers should keep an eye out for BIPA specific exclusions in future policies. Illinois employers should also scrutinize their current personal injury and advertising injury coverage provisions and, if they find their policies do not protect them from BIPA claims, they should take steps to obtain additional coverage