The Legislature Acts

As noted in the Summer 2024 Journal, in the last legislative session, the Illinois legislature passed major amendments to BIPA.  SB2979 passed easily, and the governor signed the bill into law.  SB2979[14] and did two things- 1) it limits to a single violation the practices of businesses that repeatedly collect a plaintiff’s biometric identifier via the same method, and 2) it defines “electronic signature” (for the first time) and provides that the “written release” that businesses are required to obtain to comply with BIPA includes electronic signatures.  Similar to Overstreet’s dissent in Cothron,[15] the bill makes the following changes to define actionable violations under BIPA:

(b) For purposes of subsection (b) of Section 15, a private entity that, in more than one instance, collects, captures, purchases, receives through trade, or otherwise obtains the same biometric identifier or biometric information from the same person using the same method of collection in violation of subsection (b) of Section 15 has committed a single violation of subsection (b) of Section 15 for which the aggrieved person is entitled to, at most, one recovery under this Section.

 (c) For purposes of subsection (d) of Section 15, a private entity that, in more than one instance, discloses, rediscloses, or otherwise disseminates the same biometric identifier or biometric information from the same person to the same recipient using the same method of collection in violation of subsection (d) of Section 15 has committed a single violation of subsection (d) of Section 15 for which the aggrieved person is entitled to, at most, one recovery under this Section regardless of the number of times the private entity disclosed, redisclosed, or otherwise disseminated the same biometric identifier or biometric information of the same person to the same recipient.[16]

In addition to these major changes, the amendments make clear that consent can be obtained via electronic signature.

One of the biggest questions that remains open is whether the amendments establishing a one instance trigger/limit outlined above are retroactive.  To date, no court of appeal has addressed this question.

An additional note of caution is that the amendments noted above contain the language, “the same biometric identifier.”  At the recent conference mentioned in the introduction, the legal panel and an identity systems engineer noted that this language provides plaintiffs with more opportunity under BIPA to challenge and contest. 

General Liability Insurance

While the exposure of companies under BIPA continues to be considered by courts, federal courts construing Illinois law and Illinois state courts have been addressing issues of insurance coverage for BIPA-related claims.

In the first case to examine the question of insurance coverage for BIPA, West Bend Mutual Ins. Co. v. Krishna Schaumburg Tan. Inc.,[17] an Illinois appellate court affirmed a grant of summary judgment in favor of the insured and held that the underlying complaint sufficiently alleged “publication” to trigger the duty to defend a BIPA claim, and that an exclusion for statutory violations that mentioned the TCPA and the Can-Spam Act (but not BIPA) did not apply.  The appellate court also found: “In short, the violation of statutes exclusion applies to bar coverage to violations of statutes that regulate methods of communication. The Act says nothing about methods of communication. It instead regulates ‘the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.’ 740 ILCS 14/5(g).”[18]

The Illinois Supreme Court affirmed,[19] finding that that allegations of BIPA were tantamount to a covered “publication” under the policy because the term was ambiguous, and they construed it against the insurer.

In light of this decision, insurers should review their violation of statutes exclusions and other language of their policies.  The ISO form added a provision to address decisions such as the West Bend determination that the exclusion did not preclude coverage.

Some cases, given the magnitude of exposure, have caused some insurers “to exclude BIPA claims from coverage — in their cyber, employment practices liability or commercial general liability policies.”[20]

Recently, courts have weighed in on the exclusions. 

In Citizens Ins. Co. of America v. Wynndalco,[21] the 7th U.S. Circuit Court of Appeals held that a specific statutes exclusion with a catchall clause in a commercial general liability policy was ambiguous because it stripped away coverage for violation of all manner of statutes. The underlying case involved facial recognition software sold to the Chicago Police Department. The court held there was a duty to defend the underlying lawsuit.

In December, the Illinois Appellate Court, 1st District, in National Fire Insurance Company of Hartford v. Visual Pak Company,[22] held the 7th Circuit had predicted wrong on the issue. The court wrote: “The underlying lawsuit here concerns BIPA. Liability for a BIPA violation is unambiguously excluded from coverage. We thus respectfully disagree with the Seventh Circuit’s decision in Wynndalco and hold that the CNA plaintiffs owed no duty to defend the underlying BIPA lawsuit.”[23]

The court also stated: “We cannot agree with the Seventh Circuit’s analysis. We do not find it to be an accurate reflection of Illinois law.”[24]

Unfortunately, the Illinois Supreme Court rejected the petition for leave to appeal, so we don’t know how that court ultimately will come out on the issue.

In June 2024, the 7th Circuit issued its opinion in, Thermoflex Waukegan, LLC v. Mitsui Sumitomo Insurance USA,[25] involving the same issue it addressed in Wynndalco. But this time th 7^th Circuit differentiated its decision in Wynndalco and the decision of the Illinois Appellate Court in Visual Pak, based upon disparate policy language, holding that there was no coverage under a primary or excess policy.  The courtheld that there was coverage under an umbrella policy, following the Illinois Supreme Court precedent of Krishna, subject to exhaustion of another underlying policy. Specifically, the court found that a person’s biometric identifiers, such as handprints, are considered “nonpublic information” within the meaning of the exclusion and thus held that the Access or Disclosure exclusion bars coverage and vitiates an insurer’s duty to defend.

It is important to note that there have been amendments to the ISO language on statutory exclusions.  Specifically, item 4 was amended and modified to specifically recite federal, state and local laws and regulations:

(4) Any federal, state, or local statute, ordinance or regulation, other than the TCPA, CAN-SPAM Act of 2003 or FCRA and their amendments and additions, that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating, or distribution of material or information.

The intent was to capture laws such as BIPA within its reach.

Cyber Insurance

Until recently, no appellate court had opined on how BIPA works with cyber insurance.  In two recent cases, the courts made clear that cyber insurance coverage does not contemplate BIPA claims.

In Remprex, LLC v. Certain Underwriters at Lloyd’s London,[26] an Illinois appellate court found that the policyholder, Remprex, was not entitled to a defense by its insurer because the “data breach” coverage provision of the insurance policy at issue applied to “third-party breaches of [Remprex’s] computer systems that in turn expose[d] the stored personal information to unauthorized persons.”[27]The second case was Tony’s Finer Foods Enterprises, Inc., v.  Certain Underwriters at Lloyd’s, London.[28]  Relying on the logic of Remprex, this court found similarly against duty to defend.

The exclusion provided as follows:

“This policy does not apply to and [Lloyd’s] will have no obligation to pay any loss, damages, claim expenses, or other amounts:

1. based upon or arising out of any actual or alleged:
2. collection of information by [Tony’s] (or others on [Tony’s] behalf) without the knowledge or permission of the persons to whom such information relates; however, this exclusion will not apply if no board member, trustee, director, or officers (or equivalent position) of [Tony’s] knew or had reason to know of such conduct; or
3. use of personally identifiable information by [Tony’s] (or others on [Tony’s] behalf) in violation of law.”[29]

The issue of insurance coverage and duties of insurers under both liability policies and cyber policies remains unsettled, despite some early indications. The fight will continue, and the Illinois Supreme Court may eventually take a case to provide guidance.

Conclusion

While the most recent Illinois legislative changes and court decisions appear to be beneficial to insurers and businesses defending against BIPA suits, the risk and exposure remains. Until the Illinois Supreme Court has weighed in on the recent developments, the question has not been finally addressed. Insurers should continue to monitor developments and consider implementing language and processes to enhance their ability to exclude BIPA claims from coverage under various insurance policies. The statute celebrated its sweet 16 this year and will be a source of disputes for at least another sixteen.