Workers Compensation Insurance Coverage
In McDonald v Symphony Bronzeville Park LLC,[13] the Illinois appellate court held that the exclusive remedy of Workers’ Compensation does not prohibit employees from bringing an action against an employer for allegedly violating the Illinois BIPA. While acknowledging that the Illinois Supreme Court “’has indicated that the [Compensation Act] generally provides the exclusive means by which an employee can recover against an employer for a work-related injury,’”[14] the court found that the exception for “not compensable” under the Workers’ Compensation Act provided the out for the plaintiff in this case, holding:
In light of the above discussion, we fail to see how a claim by an employee against an employer for liquidated damages under the Privacy Act—available without any further compensable actual damages being alleged or sustained and designed in part to have a preventative and deterrent effect—represents the type of injury that categorically fits within the purview of the Compensation Act, which is a remedial statute designed to provide financial protection for workers that have sustained an actual injury. As such, we conclude that the exclusivity provisions of the Compensation Act do not bar a claim for statutory, liquidated damages, where an employer is alleged to have violated an employee’s statutory privacy rights under the Privacy Act, as such a claim is simply not compensable under the Compensation Act.[15]
The Illinois Supreme Court granted petition for leave to appeal. On February 1, 2022, the court affirmed the appellate court, [16] holding that the exclusive remedy of the Workers' Compensation Act does not apply to these kinds of claims.
In a special concurrence, Justice Michael Burke agreed in the judgment, but he pointed out the incongruity with the decision in Rosenbach (the first case where the court addressed BIPA): "McDonald contends that her Privacy Act claim should proceed because she has suffered absolutely no injury, which is totally inconsistent with the concept that a technical violation of the Privacy Act is a 'real and significant' injury. See Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 34.[17]
General Liability and Other Liability Policies
In West Bend Mutual Ins. Co. v. Krishna Schaumburg Tan. Inc.,[18] an Illinois appellate court in a case of first impression affirmed the grant of summary judgment in favor of the insured and held that the underlying complaint sufficiently alleged “publication” to trigger the duty to defend a BIPA claim, and that the exclusion for statutory violations that mentioned the TCPA and the Can-Spam Act (but not BIPA) did not apply. The appellate court also found: “In short, the violation of statutes exclusion applies to bar coverage to violations of statutes that regulate methods of communication. The Act says nothing about methods of communication. It instead regulates ‘the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.’ 740 ILCS 14/5(g).”[19]
The Illinois Supreme Court granted petition for leave to appeal and on May 20, 2021 , affirmed the appellate court.[20] The court held that allegations of BIPA were a covered “publication” under the policy because the term was ambiguous and construed it against the insurer: “We find, based on our review of dictionaries, treatises, and the Restatement, that the term ‘publication’ has at least two definitions and means both the communication of information to a single party and the communication of information to the public at large.”[21]
The court also found “that [underlying plaintiff’s] assertion that [underlying defendant] shared her biometric identifiers and information with [a third-party vendor] alleges a potential violation of [underlying plaintiff’s] right to privacy within the purview of West Bend’s policies.”[22]
The court also looked at the “Violation of Statutes Exclusion” and found that based on the specific language, it did not bar coverage.[23] The court found:
Applying the doctrine of ejusdem generis, we construe the ‘other than’ language to mean other statutes of the same general kind that regulate methods of communication like the TCPA and the CAN-SPAM Act. Therefore, since the Act is not a statute of the same kind as the TCPA and the CAN-SPAM Act and since the Act does not regulate methods of communication, the violation of statutes exclusion does not apply to the Act. [24]
Insurers must review their violation of statutes exclusions and other language of their policies in light of this Illinois Supreme Court decision.
Limitation Periods and Impact on Size of Claims
As discussed in the next section, the first jury trial in a class action came back against the defendant company in the amount of $228 million. Two cases before the Illinois Supreme Court currently awaiting decision could further impact the question of the magnitude of exposure that employers and other users of biometric information might face.
The first case that addressed BIPA liability and magntiude is Cothron v. White Castle, No. 128004, which will answer the following certified question from the 7th U.S. Circuit Court of Appeals concerning the BIPA: “Do section 15(b) and 15(d) claims accrue each time a private entity scans a person’s biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?”
The decision will be hugely important, as it now sets the parameters for how much exposure those entities using biometric information in Illinois, especially employers, face. The oral argument was heard on May 17, 2022.[25] Of note is that the Illinois Supreme Court has changed composition since then, with the court having a large number of new justices as a result of a retirement, redistricting, and the November elections.
On February 17, 2023, the Supreme Court issued its decision.[26] In a 4-3 decision, the court held:
“We hold that a separate claim accrues under the Act each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d).”[27]
The second case that the Illinois Supreme Court heard that is relevant is Tims v. Black Horse Carriers, heard on September 22, 2022. In Tims, the court will decide what statute of limitations applies for various provisions of BIPA. The appellate court held that there is a 1 year statute of limitations for alleged violations of Sections 15(c) and (d) of BIPA, as they involve publication, and a 5 year statute of limitations for alleged violations of Sections (a), (b), and (e) of BIPA.[28]
At the supreme court, the defendant argued that 735 ILCS 5/13-201 that states "actions for slander, libel or for publication" does not require publication for it to apply because BIPA uses the word "for" which he contended means "relates to or concerns" publication. The plaintiff countered they have not alleged publication and the five year catchall and not the one statute of limitations for publications applies to all claims under BIPA.
On February 2, 2023, the Illinois Supreme Court held that the five year provision was the appropriate statute of limitations.[29] The court held, “For the following reasons, we find that the five-year limitations period contained in section 13-205 of the Code governs claims under the Act.”[30]
These decisions result in a large exposure for anyone collecting biometric information in Illinois that does not have consent or does not have policies published. Insurers will be continuing to look at how to address BIPA claims in their various coverages.
At the appellate level, the Tims court found, "as section 20 provides that a 'prevailing party may recover for each violation' (740 ILCS 14/20 (West 2018)), a plaintiff who alleges and eventually proves violation of multiple duties could collect multiple recoveries of liquidated damages."[31]
The Illinois Supreme Court’s resolution of the statute of limitations issue and what represents a claim results in more clarity to Illinois employers and businesses, but also increases potential exposures to them. The decisions in these two cases are important for those entities, as the court agreed with the plaintiffs in both instances Insurers should monitor these actions for potential coverage implications in light of West Bend.
First BIPA Class Action Trial
In a decision that was surprising in its magnitude, a jury in the federal court found BIPA coverage against BNSF Railway Co. On October 12, 2022, the jury returned a verdict in Rogers v. BNSF Railway Co.[32] The plaintiff representative on behalf of the class alleged BNSF had violated Section 15(b) of BIPA by improperly requiring drivers entering the railway’s facilities to provide their biometric information through a fingerprint scanner, without providing the requisite notice and consent.[33] The plaintiffs also alleged BNSF had improperly disclosed biometric information to a third-party vendor providing the fingerprint-scanning services without informed consent in violation of Section 15(c) of BIPA, and so was vicariously liable for the acts and omissions of that vendor.[34] The plaintiff class sought statutory damages of $5,000 for each willful and/or reckless violation of BIPA or $1,000 for each negligent violation.[35]
After one hour of deliberating, the jury rejected various arguments proffered by BNSF and found BNSF liable for approximately 45,600 reckless or intentional violations of BIPA and awarded the class $228 million in statutory damages.[36]
Cases such as BNSF have caused some insurers “to exclude BIPA claims from coverage — in their cyber, employment practices liability or commercial general liability policies — and more are expected to consider doing so in the wake of last month’s ruling, in which BNSF Railway Co. was ordered to pay $228 million.”[37]
Other Insurance Coverages
Many of the class action defendants are employers who have required their employees to use biometric information for signing in and out of their workday.[38] Many EPL policies contain exclusions for violations of statutes, but also might include invasion of privacy or failure to provide adequate corporate policies in the definition of “employment practices wrongful act,” which may trigger coverage under the EPL policies.[39] These issues continue to be considered by Illinois state and federal courts, and will be resolved potentially in the coming years.
Another potential avenue of insurance coverage likely to be pursued is in the cyber arena. Today’s entities are facing an evolving, wide-ranging specter of cyber and privacy risks that extend far beyond traditional notions of cyber security. As privacy laws and regulations continue to proliferate, the ways entities collect, use, store, share, and dispose of information can lead to legal and regulatory exposures, even in the absence of a data breach. How cyber issues of insurance will evolve very much will depend on how the policy defines covered information, and intentional conduct and statutory penalties might not be covered. To date, no cases have addresses these issues.
The insurance coverage determinations will vary by insurance type.[40] Policy language and type of policy will be important. As the Illinois courts see more insurance coverage disputes related to BIPA, the landscape should become more apparent.
Conclusion
BIPA continues to be heavily litigated in the state and federal courts in Illinois. This plethora of suits will result in a continued search for insurance coverage and money to pay for the continued substantial exposures defendants face. The availability of coverage under any policy will depend on the claim specific facts, the type of harms alleged, and policy terms and court applications of same and applicable law. As some insurers have explicitly done or will soon do, insurers should review policy language and address the edits and clarifications needed to avoid potential catastrophic exposure to BIPA claims.