Illinois Supreme Court Finds That Alleged Sharing of Fingerprint Data Violates the Right of Privacy, a “Personal Injury” Triggering Duty to Defend

The Illinois Supreme Court recently affirmed that West Bend Mutual Insurance Co. has a duty to defend an insured under a business insurance policy against allegations that they violated the Illinois Biometric Information Privacy Act (BIPA), finding that an exclusion that bars coverage for certain statutory actions did not apply. The court ruled that a tanning salon’s sharing of its clients’ biometric identifiers and biometric information (fingerprints) with a third-party vendor violated the clients’ right to privacy.

Klaudia Sekura purchased a membership from Krishna Schaumburg Tan Inc., a tanning salon and franchisee of L.A. Tan. The membership gave Sekura access to L.A. Tan’s tanning salons and required Sekura to provide Krishna with her fingerprints. Sekura filed a class action lawsuit against Krishna, alleging that Krishna violated BIPA when it scanned Sekura’s and other customers’ fingerprints and disclosed the biometric information containing the fingerprints to an out-of-state third-party vendor.

Krishna tendered the lawsuit to its insured, West Bend, asserting coverage under its business insurance policy. West Bend advised Krishna that it would provide a defense under a reservation of rights because it believed that the lawsuit was not covered by the policy, and therefore West Bend did not have a duty to defend Krishna against Sekura’s lawsuit.

The policy at issue covered damages that the insured would be legally obligated to pay because of “bodily injury,” “property damage,” “personal injury,” or “advertising injury.” A requirement for both “advertising injury” and “personal injury” was the “oral or written publication of material that violates a person’s right of privacy.” Additionally, the policy included a violation of statutes exclusion, which provided that the policy will not cover injury “arising directly or indirectly out of any action or omission that violates or is alleged to violate” the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act of 2003, or any “statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.”

West Bend filed a declaratory judgment action and alleged that Sekura’s complaint did not come within the policy’s coverage for “personal injury” or “advertising injury” because the complaint did not allege a publication of material that violates a person’s right of privacy. In the alternative, the declaratory judgment action alleged that the policy’s violation of statutes exclusion applied and therefore barred West Bend from providing coverage to Krishna.

In regard to the interpretation of the term “publication,” the court ruled that various sources define the term as encompassing both “communication to a single party and communication to the public at large.” Therefore, the term is ambiguous and must be interpreted against the insured that drafted the policy. The court adopted the construction used by Krishna and construed the term to include communication with a single party.

In regard to the “right of privacy,” the court looked to dictionary definitions, as West Bend’s policy did not define the phrase. The court reasoned that based on past rulings, the right to privacy includes the right to seclusion and the right to secrecy. The statute in question protected the right to secrecy, which is the “right of an individual to keep his or her personal identifying information like fingerprints secret.” Therefore, the allegations of the complaint fell or potentially fell within the phrase “right to privacy” in West Bend’s policy.

The court found that the violation of statutes exclusion did not bar coverage, as the exclusion references methods of communication. Although the exclusion applies to statutes “other than” these statutes, the rules of statutory construction dictate that the statutes referenced must be of the “same general kind that regulate methods of communication.” Because BIPA does not regulate methods of communication, according to the court, it is not a statute of the same kind and therefore the exclusion does not bar coverage.

Accordingly, the court held that West Bend has a duty to defend Krishna in Sekura’s lawsuit.