A recent opinion from the United States Court of Appeals for the Seventh Circuit underscores the importance of understanding the scope of your general liability coverage, and consider whether that means obtaining additional coverage under a cybersecurity policy.
In what can only be described as a modern twist on punching in, an automotive accessories company required its hourly workers to use their handprint to clock in and clock out. An assembly line worker brought a class action against the company, alleging its failure to seek his (and other employees’) prior written consent violated Illinois’s Biometric Information Privacy Act (“BIPA”).[1] The company made a claim under its general liability policy, but the company’s insurer disclaimed coverage, arguing that an Access or Disclosure Exclusion barred coverage for BIPA claims. A typical Access or Disclosure Exclusion will exclude claims “arising out of any access to or disclosure of any person’s or organization’s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information.” Going against the weight of other district courts in Illinois,[2] the district court agreed and held the BIPA claims fell within the Access or Disclosure Exclusion because biometric information (such as a handprint) is personal information.[3]
The Seventh Circuit affirmed. It held that a handprint is a kind of “confidential or personal information” covered by the Access or Disclosure Exclusion.[4] The Seventh Circuit bucked the trend in insurance claims in this regard by broadly interpreting the Access or Disclosure Exclusion, holding that the phrase “confidential and personal” followed by a list of both confidential and personal and non-confidential and non-personal items did not make the Access or Disclosure Exclusion ambiguous.[5] This outcome is noteworthy because the general rule in interpreting insurance contracts is that policies should be read broadly, and exclusions should be read narrowly (especially when the exclusion is potentially ambiguous).[6] Judge Easterbrook, writing for the Court, offered the following hypothetical in concluding the Access or Disclosure Exclusion was not ambiguous: a list covering “all red items,” one blue item, and ending with the phrase “plus anything pink” unambiguously covers a ruby-colored object; that is to say, the fact the list includes one blue item amid a sea of red items does not make the list ambiguous.[7]
Although not a complete victory for insurers (the Court still found some coverage for the automotive accessories company), this opinion is expected to have a significant impact on coverage disputes over BIPA claims because the Access or Disclosure Exclusion is a popular exclusion. This opinion underscores the importance of having your general liability coverage reviewed by counsel. This result may also mean obtaining additional coverage under a cybersecurity policy to fill any gaps in coverage. Courts in some states, like New York, have held that for privacy and data security claims like the one at issue in Thermoflex, a dedicated cybersecurity policy is required to provide coverage.[8]
If you have questions about the adequacy of your insurance coverage and whether it may cover similar claims against your company, please contact a member of the HSE Insurance Coverage and Privacy and Data Security teams.
[1] In recent years, BIPA has become a powerful tool for class action plaintiffs, given (1) its express private right of action, see 740 Ill. Comp. Stat. Ann. 14/20, and (2) that the Illinois Supreme Court recently held that a separate BIPA violation accrues each time one’s biometric information is transmitted, not just the first time, see Cothron v. White Castle Sys., 216 N.E.3d 918, 920 (Ill. 2023). But BIPA only applies to conduct in Illinois. See, e.g., Mahmood v. Berbix, Inc., 2022 WL 3684636, at *1 (N.D. Ill. Aug. 25, 2022).
[2] See, e.g., Am. Fam. Mut. Ins. Co. v. Caremel, Inc., 2022 WL 79868, at *2–3 (N.D. Ill. Jan. 7, 2022).
[3] Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., 595 F. Supp. 3d 677, 683–85 (N.D. Ill. 2022).
[4] Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., 102 F.4th 438, 440 (7th Cir. 2024).
[5] Id.
[6] In re Residential Cap., LLC, 2022 WL 17836560, at *3 (Bankr. S.D.N.Y. Dec. 21, 2022) (collecting cases).
[7] Thermoflex Waukegan, 102 F.4th at 441.
[8] See Zurich Am. Ins. v. Sony Corp. of Am., 2014 N.Y. Misc. LEXIS 5141, *72 (Sup. Ct. New York County Feb. 21, 2014).