BIPA

Subscribe to BIPA

The landscape of biometric privacy litigation already has changed dramatically in 2023. Last month, the Illinois Supreme Court ruled in Tims v. Black Horse Carriers, Inc., 2023 IL 127801, that claims for violations of the Illinois Biometric Information Privacy Act (BIPA) (which allows individuals to sue companies directly for the wrongful collection or disclosure of their biometric data) are subject to a five-year statute of limitations. Later that month, in Cothron v. White Castle System, Inc., 2023 IL 128004, the court ruled that a BIPA violation accrues each time an individual’s data is improperly collected or shared, not merely the first time. Taken together, these rulings significantly broaden the scope of claims facing companies that have violated BIPA and the damages flowing from such violations.

In recognition of the dystopian risks presented by the rampant, unlawful sharing of biometric data, several more states are jumping on Illinois’ bandwagon, attempting to pass BIPA-like laws. According to Bloomberg, legislation proposed in nine other states also would grant a private right of action to individuals whose biometric data was wrongly collected or shared.

Despite the growing threat of civil litigation related to the mishandling of biometric data, there is a silver lining for corporate policyholders: the opportunity to obtain insurance coverage for biometric privacy liability has never been greater.Continue Reading Key considerations for policyholders after landmark biometric privacy decisions reshape insurance landscape

Although the policyholder bar has previously had success obtaining coverage for Biometric Information Privacy Act (BIPA) litigation under an employment practices liability (EPL) policy, insurers recently notched a win by convincing a court to deny EPL coverage for an employee-based BIPA class action.  In Church Mutual Insurance Company v. Prairie Village Supportive Living, LLC, the insured’s former employee brought a class action alleging the insured unlawfully collected, used, and disseminated employee biometric identifiers (fingerprints) in violation of BIPA, and the insured sought coverage from its insurer under its general liability (GL) and EPL policies.  No. 21 C 3752, 2022 U.S. Dist. LEXIS 143495 (N.D. Ill. Aug. 11, 2022).  Based on a unique combination of policy provisions not previously addressed in BIPA coverage litigation, the court declined to find coverage under either policy.  Rather than be discouraged from pursuing coverage for BIPA class actions involving employee biometrics, however, there are some important lessons policyholders can glean from this opinion.

The unique terms of the insured’s EPL policy precluded coverage under all policies

The combination of policy terms at issue in Church Mutual was quite unique and does not appear to be typical of those found in most insureds’ policies.  As an initial matter, although the insured had purchased both GL and EPL coverage, the EPL coverage form stated:  “Except for the insurance provided by this coverage form, the policy to which this coverage form is attached does not apply to any claim or ‘suit’ seeking damages arising out of any ‘wrongful employment practice.’”  Right off the bat, therefore, the insured was limited to seeking EPL coverage because it did not dispute that it was seeking coverage for a “wrongful employment practice” as defined in its EPL policy.  Any coverage that may have existed under the insured’s GL policy was irrelevant.

After limiting its analysis to whether EPL coverage existed, the court then focused on an exclusion in the EPL policy entitled “Violation of Laws Applicable to Employers.” Pursuant to that exclusion, the policy precluded coverage for, in relevant part:

“Any claim based on, attributable to, or arising out of any violation of any insured’s responsibilities or duties required by any other federal, state, or local statutes, rules, or regulations, and any rules or regulations promulgated therefor or amendments thereto. However this exclusion does not apply to: Title VII of the Civil Rights Act of 1964, the Americans With Disabilities Act, the Age Discrimination in Employment Act, the Equal Pay Act, the Pregnancy Discrimination Act of 1978, the Immigration Reform and Control Act of 1986, the Family and Medical Leave Act of 1993, and the Genetic Information Nondiscrimination Act of 2008 or to any rules or regulations promulgated under any of the foregoing and amendments thereto or any similar provisions of any federal, state, or local law.”Continue Reading Court’s denial of employment liability coverage for Biometric Information Privacy Act litigation should not discourage policyholders

Since the Illinois Supreme Court’s ruling that class actions alleging violations of the Illinois Biometric Information Privacy Act (“BIPA”) trigger general liability coverage, the focus of BIPA coverage litigation has shifted to the applicability of three exclusions often found in general liability policies: (1) the Employment Related Practices exclusion, (2) the Violation of Statutes exclusion, and (3) the Access or Disclosure exclusion.  Although the first quarter of 2022 brought a mixed bag of opinions, with four out of seven resulting in a finding of coverage, the scorecard with respect to each specific exclusion tells a different story that generally favors the policyholders.  As outlined in this blog post, insureds facing BIPA lawsuits therefore have plenty of reason to continue pressing their insurers for coverage.

Employment-related practices exclusions

The Employment-Related Practices exclusion bars coverage for bodily injury or personal and advertising injury to a person arising out of any of the following:

  • Refusal to employ that person
  • Termination of that person’s employment
  • Employment-related practices, policies, acts or omissions, such as coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation, or discrimination directed at that person

In coverage disputes arising out of employment-based BIPA class actions, the issue is whether the conduct at issue is an employment-related practice that falls within the third prong of the exclusion.

As outlined in a previous blog post, there is case law outside of the BIPA context standing for the proposition that the phrase “employment-related” has a narrow meaning and only refers to matters that concern the employment relationship itself. According to this line of case law, where the conduct at issue in a lawsuit does not arise out of personnel management or employee discipline (i.e., the employment relationship), but instead merely happens to involve an employee, the third prong of the exclusion does not bar coverage.Continue Reading Recent opinions provide support for insureds seeking coverage for BIPA claims