The Illinois Supreme Court in W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, affirmed a ruling from the Illinois Appellate Court that West Bend Mutual Insurance Company owed a duty to defend its insured against Biometric Information Privacy Act (BIPA) violation allegations. Krishna involved a class-action lawsuit against a tanning salon alleging that the salon violated the BIPA when it scanned and disclosed clients’ fingerprint data to an out-of-state third-party vendor. West Bend defended the tanning salon while reserving the right to challenge its duty to defend.
The Illinois Supreme Court rejected the following coverage defenses argued by West Bend to preclude a duty to defend:
Publication
The West Bend Policy defines “personal injury” to mean, in relevant part, injury that arises out of an “oral or written publication of material that violates a person’s right of privacy.” West Bend argued that the salon did not publish Plaintiffs’ information because it did not provide same to the public at large.
The policy does not define the term publication. The Court looked to the dictionary definition of that term, which means both communications to a single party and to the public at large. The Court also relied on treatises on insurance law, treatises on privacy law, and the Restatement (Second) of Torts, all of which define publication in the same way. The Court found the term publication to be ambiguous, such that when construed against the insurer it can mean communication with a single party (such as the vendor to whom the salon disclosed the fingerprint data).
Right of Privacy
“Personal injury” occurs when publication violates a person’s right of privacy. West Bend argued that the insured’s disclosure of fingerprint data did not violate a right of privacy.
The Court held that the right of privacy typically involves two interests: seclusion and secrecy. The right of secrecy is the right to keep certain information confidential, and the right to seclusion is the right to be left alone and protecting a person from another’s prying into their physical boundaries or affairs. The class-action complaint alleged that the salon violated the BIPA by disclosing Plaintiffs’ biometric identifiers and information to the vendor. The Court, relying on the stated purpose of the BIPA and statutory intent, held that the BIPA protects a secrecy interest.
Violation of Statutes Exclusion
West Bend argued that the Violation of Statutes Exclusion precludes a duty to defend. The exclusion in the West Bend Policy applies to the TCPA (regulating telephone calls and faxes), the CAN-SPAM Act (regulating e-mails), and statutes “other than” the TCPA and CAN-SPAM Act that “prohibit or limit the communicating of information.”
The Court cited the doctrine of ejusdem generis, a rule of statutory and contract interpretation. The doctrine goes, “where general words follow an enumeration of persons or things, by words of a particular and specific meaning, such general words are [. . .] to be held as applying only to persons or things of the same general kind or class as those specifically mentioned.” The “other than” language in the exclusion follows the enumeration of words within a specific meaning, the TCPA and the CAN-SPAM Act. Applying ejusdem generis, the Court found that the “other than” language means other statutes of the same general kind that regulate methods of communication. The Court held that the BIPA does not regulate methods of communication and the exclusion did not apply.
The Court held that West Bend owed a duty to defend the class-action complaint.
