7th Circuit / BIPA Insurance
“Access or Disclosure” Exclusion Precludes Coverage for BIPA Lawsuits
The United States Court of Appeals for the Seventh Circuit, in an opinion written by Judge Easterbook, affirmed two lower court decisions concerning the scope of an insurer’s duty to defend its insured against allegations of the insured’s violations of the Illinois Biometric Information Privacy Act (BIPA).
Specifically, the Seventh Circuit affirmed the decision by Judge Lee that the “Access or Disclosure” exclusion contained in a commercial general liability primary policy precluded the insurer’s duty to defend, while affirming a decision by Judge Durkin that three other exclusions found in an umbrella policy (Statutory Violation, Data Breach Liability, Employment-Related Practices) did not eliminate the duty to defend. Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., 102 F. 4th 438 (7th Cir. May 17, 2024).
Thermoflex required its employees to scan their handprints to clock in and out work. Three employees sued in 2021, claiming that this practice violated BIPA. Thermoflex held a primary policy and an umbrella policy issued by Mitsui Sumitomo Insurance USA, Inc. (“Mitsui”). Thermoflex tendered the BIPA claims to Mitsui. Mitsui declined coverage on both policies arguing that the primary policy contained an “Access or Disclosure” exclusion that precluded coverage for the BIPA claims and that the umbrella policy contained three other exclusions—a “Statutory” exclusion, a “Data Breach” exclusion, and an “Employment-Related Practices” exclusion—that likewise precluded coverage under the umbrella policy.
Shortly after the employees filed suit, but before Mitsui refused to defend, the Illinois Supreme Court observed in West Bend Mutual Ins. Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978 (Il. Sup. Ct. 2021) that BIPA violations fall within the scope of “personal and advertising injury” for which standard business policies provide coverage—unless an exclusion applies. Thus, the only issue before the Seventh Circuit was whether any exclusions applied to eliminate Mitsui’s duty to defend for the BIPA claims.
The Seventh Circuit first analyzed whether the “Access of Disclosure” exclusion (a catch-all exclusion for the recording and distribution of material or information in violation of law) applied to bar coverage for the BIPA claims under the primary policy. The Seventh Circuit noted that the exclusion in the primary policy was broader than that in West Bend as it included language precluding coverage arising out of “any access to or disclosure of any person’s … confidential or personal information.” The Seventh Circuit held that this language “describes BIPA claims, which include valid concerns about access to and disclosure of personal biometric data.” Because this language was present in the primary policy’s exclusion, the court held that Mitsui had no duty to defend under the primary policy.