Disclosure to 3^rd Party a “Publication” – “Violation of Statute” Exclusion Inapplicable

The Illinois Supreme Court, in an opinion written by Justice Neville, applying Illinois law, affirmed the lower courts’ rulings and held that the insurer had a duty to defend claims for violations of the Biometric Information Privacy Act (“BIPA”) because the disclosure of fingerprint data to a third party constitutes “publication” as required for “personal injury” coverage.  Additionally, the Illinois Supreme Court held that coverage for the BIPA claims was not excluded by the policy’s “violation of statutes” exclusion, because it excluded coverage for statutes that regulate the method of communication, not the dissemination of information, like BIPA. 

The opinion stems from a declaratory judgment action filed by West Bend Insurance Company (“West Bend”) asking the court to find that it does not have a duty to defend Krishna Schaumburg Tan, Inc. (“Krishna”) in a class action suit initiated against it by Klaudia Sekura.  The underlying suit alleges that Krishna violated BIPA when it disclosed its customers’ fingerprint data to a third-party vendor without consent.  Upon receiving the complaint, Krishna notified West Bend and sought a defense.  West Bend agreed to defend Krishna in the class action suit under a reservation of rights and filed a declaratory judgment action seeking a declaration that it had no duty to defend Krishna.  On cross-motion for summary judgment, the trial court determined that West Bend had a duty to defend because the underlying allegations fell within the policy’s coverage for “personal injury” as a “publication which violates a person’s right to privacy” and the policy’s violation of statutes exclusion did not apply to the BIPA violation allegations.  The appellate court affirmed.

Under a de novo review, the Illinois Supreme Court construed the policies to determine whether the underlying complaint alleges: (1) a “personal injury or advertising injury,” (2) a “publication” of material by Krishna that violated Sekura’s right to privacy, and (3) a publication of material by Krishna that violated Sekura’s “right of privacy.” 

First, it determined that the underlying complaint alleged a potential nonbodily injury under West Bend’s policy, thus alleging a “personal injury or advertising injury” under the policy.  Next, it examined the definition of “publication” in various dictionaries, treatises on insurance law and the law of privacy, and the Restatement of the Law of Torts, and it found that the term “publication” has at least two definitions and means both the communication of information to a single party and the communication of information to the public at large.  Thus, the Illinois Supreme Court found the term to be ambiguous, and therefore, must be strictly construed against the insurer who drafted the policies.  Accordingly, it construed the term “publication” to include a communication with a single party and found that the allegations in the underlying complaint established there was a “publication”.

Then, it looked to Black’s Law Dictionary to determine that “right of privacy” means the right to personal autonomy.  It found that courts have recognized the “right of privacy” to include the interests of seclusion and secrecy.   BIPA protects a secrecy interest: “[T]he right of an individual to keep his or her personal information like fingerprints secret.”  Therefore, it found that Sekura’s assertions in the underlying complaint that Krishna shared biometric identifiers and information with a third party alleges a potential violation of Sekura’s right to privacy.

Lastly, the Illinois Supreme Court interpreted the violation of statutes exclusion, finding that it does not apply to bar coverage for the underlying action.   The violation of statutes exclusion excludes coverage for (1) the TCPA, (2) the CAN-SPAM Act, and (3) statutes “other than” the TCPA or CAN-SPAM Act that prohibit or limit the communication of information.  Because the violation of statutes exclusion does not list BIPA, the court analyzed the “other than” language in prong three, and it determined, based on the doctrine of ejusdem generis, that itonly applies to statutes like TCPA (phone calls and faxes) and the CAN-SPAM Act (e-mails) that regulate methods of communication.

Based on its analysis, the Illinois Supreme Court held that West Bend has a duty to defend Krishna against the underlying action.  West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978 (May 20, 2021).