The United States District Court for the Northern District of Illinois, Eastern Division, in an opinion written by Judge Leinenweber, applying Illinois law, granted American Family Mutual Insurance Company’s (“American”) motion for summary judgment, holding that the insurer owed no coverage to the insured for alleged violations of the Illinois Biometric Information Privacy Act (“BIPA”). The insured, the operator of McDonald’s restaurants in Kankakee County, had utilized a biometric time clock system, which required employees to scan their fingerprints whenever they began or stopped working. That identifying information was then disclosed to the insured’s time keeping vendor, a third party, in an apparent violation of BIPA.

American argued that three separate exclusions in the policy operated to preclude its duty to defend the insured against the underlying BIPA lawsuit. The District Court, in granting American’s motion, held that only one exclusion was relevant here: the “ERP Exclusion,” which bars coverage for personal and advertising injury arising out of employment related practices, policies, acts, or omissions directed at individual employees. Specifically, the District Court held both that the company policy to collect fingerprints constituted individual harm to each employee, and that a BIPA violation was sufficiently similar to the exemplar harms identified in the provision, such as coercion, demotion, defamation, harassment, and humiliation, such that the exclusion applied here.

The District Court, nonetheless, dismissed American’s argument that two other exclusions applied. First, the Access or Disclosure Exclusion, which bars coverage for personal and advertising injury arising out of access to or disclosure of any person’s confidential or personal information, did not apply, because a BIPA violation was not like the exemplar harms in this provision—such as patents, trade secrets, financial information, health information, or “any other type of nonpublic information.” Specifically, the Court found that fingerprint scans are neither intellectual property, like some items on the list, nor indicative of the state of health of an individual. Second, following Illinois case law, the Court found that the Violation of Statute Exclusion did not apply to BIPA claims. Because, however, the ERP Exclusion was applicable, the District Court granted American’s motion for summary judgment and denied coverage to the insured. Am. Family Mut. Ins. Co. v. Caremel, Inc., No. 20 C 637 (N.D. Ill. Jan. 7, 2022).