Illinois Federal Court Holds Facial Recognition Data Falls Within Scope of “Confidential or Personal Information” in “Access or Disclosure” Exclusion

In Phoenix Insurance Co. v. Ackercamps.com LLC, the U.S. District court for the Southern District of Illinois held that an “access or disclosure of confidential or personal information” exclusion in a commercial general liability policy barred coverage for a lawsuit alleging that an insured retained facial recognition data from photographs.

Ackercamps obtained a commercial liability policy from its insurer, which provided coverage for, among other things, personal and advertising injury under Coverage B. The policy issued to Ackercamps also contained an access or disclosure of confidential or personal information exclusion endorsement, providing that coverage under the policy did not apply to “‘personal injury’ or ‘advertising injury’ arising out of any access to or disclosure of any person’s or organization’s confidential or personal information.”

In 2022, several claimants filed a class action lawsuit against Ackercamps, the purveyor of Bunk1 software. Ackercamps had partnered with summer camps that uploaded photographs of children attending their programs to the Bunk1 platform. Bunk1 then used facial recognition software to match photographs of campers with existing profile photos and notified parents when new photos of their children were uploaded. According to lawsuit, Ackercamps’ collection of facial geometry violated the Illinois Biometric Information Privacy Act.

Ackercamps notified its insurer of the class action lawsuit in October 2022. In December 2022, Ackercamps’ insurer denied coverage for the lawsuit based on the access or disclosure of confidential or personal information exclusion contained in the policy. Ackercamps ultimately settled the class action, and its insurer thereafter filed a coverage action against the policyholder seeking a declaration that it had no duty to defend or indemnify Ackercamps in connection with that lawsuit. Ackercamps, in turn, filed counterclaims against its insurer seeking a declaration that the insurer had a duty to defend and indemnify Ackercamps in connection with the lawsuit and that the insurer acted in bad faith and was estopped from asserting coverage defenses.

Ackercamps’ insurer did not dispute that Coverage B would provide coverage for the alleged violations of the Biometric Information Privacy Act. Instead, the only question in the coverage action was whether the access or disclosure of confidential or personal information exclusion barred coverage for the underlying lawsuit.

Applying Illinois law, the district court cited the Seventh Circuit’s holding in Thermoflex Waukegan LLC v. Mitsui Sumitomo Insurance USA Inc., in which the court held that the terms “confidential or personal information” included biometric identifiers usable for identity theft. Applying the same rationale, the district court reasoned that “confidential and personal” information, as those terms were used in the access or disclosure of confidential or personal information exclusion in the Ackercamps policy, included information derived from facial geometry. The court therefore held that the exclusion operated to bar coverage for lawsuit.

The court also cited Citizens Insurance Company of America v. Mullins Food Products Inc., in which the district court had found that an insurer had no duty to defend its insured in a lawsuit alleging violations of the Illinois Biometric Information Privacy Act. The Mullins court applied an “ordinary understanding” of the terms “confidential or personal information” in finding that a similar “access or disclosure” exclusion would operate to bar coverage under the subject policy.

Accordingly, the court determined that the exclusion in the Ackercamps policy unambiguously barred coverage for the class action lawsuit. The court rejected Ackercamps’ argument that the scope of the exclusion renders Coverage B of the policy illusory, finding that Coverage B would broadly apply, among other things, to the publication of a person’s photograph or likeness rather than to the retention of biometric information as alleged in the lawsuit and as excluded by the endorsement.

Finally, the court rejected Ackercamps’ contentions that its insurer was estopped from asserting defenses to coverage or acted in bad faith, as the insurer had a reasonable and correct basis to deny coverage for the lawsuit.

As such, the court granted the summary judgment motion of the insurer and denied that of Ackercamps, finding that the insurer had no defense or indemnity obligation for the lawsuit.