21/05/2021
On May 20, 2021, the Supreme Court of Illinois in West Bend Mutual Insurance Company v. Krishna Schaumburg Tan, Inc., No. 125978, 2021 IL 125978 (Ill. May 20, 2021) affirmed the Illinois appellate court’s ruling that an underlying lawsuit alleging violation of the Illinois Biometric Information Privacy Act (BIPA) implicated the duty to defend under a CGL policy. The Court held that the term “publication” in the context of coverage for a privacy offense under a general liability policy could mean both the dissemination of information to the public-at-large and dissemination of information to a single party. The Court also rejected arguments that the catch-all provision of the distribution of material exclusion prohibited coverage for allegations of publication of biometric data in the underlying BIPA lawsuit.
The decision likely will have a significant impact on insurance coverage for BIPA litigation, and the Court’s reasoning in its decision may even influence other privacy coverage matters. We will address those issues at a later time. Here, we provide a summary of the decision.
The insured, Krishna Schaumburg Tan, Inc., was sued by Klaudia Sekura in an underlying class-action lawsuit for alleged violations of BIPA. (2021 IL 125978, ¶ 1.) The lawsuit alleged that Krishna violated BIPA’s provisions relating to the collection of biometric identifiers and biometric information by collecting, using, and storing customers’ fingerprint scans without obtaining written releases or providing publicly available retention schedules or destruction guidelines. (Id.) Significantly, the lawsuit also alleged that Krishna disclosed the biometric data to a vendor:
Specifically, Krishna Tan systematically disclosed Plaintiff's and the Class's biometric identifiers and biometric information to SunLync, an out-of-state * * * vendor.
Krishna tendered the lawsuit to West Bend Mutual Insurance Company, its general liability insurer, and coverage litigation ensued. (Id. ¶ 1.)
The policies at issue provided coverage for “personal injury” or “advertising injury,” both of which were defined in part as: “[o]ral or written publication of material that violates a person’s right of privacy.” (Id. ¶¶ 7-8.) By endorsement, the policies had an exclusion titled “Violation of Statutes that Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or Information,” which precluded coverage for:
DISTRIBUTION OF MATERIAL IN VIOLATION OF STATUTES
“Bodily injury”, “property damage”, “personal injury” or “advertising injury” arising directly or indirectly out of any action or omission that violates or is alleged to violate:
(1) The Telephone Consumer Protection Act (TCPA) [(47 U.S.C. § 227 (2018))], including any amendment of or addition to such law; or
(2) The CAN-SPAM Act of 2003 [(15 U.S.C. § 7701 (Supp. III 2004))], including any amendment of or addition to such law; or
(3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.
(Id. ¶¶ 9, 58.)
West Bend argued that the BIPA complaint did not allege a “publication of material that violates a person’s right of privacy,” and, in the alternative, that the distribution of material exclusion in its policies applied to bar coverage. (Id. ¶ 18.) Both the trial and intermediate appellate courts rejected these arguments. (Id. ¶¶ 24-27.) The Illinois Supreme Court affirmed the appellate court’s decision. (Id. ¶¶ 62-63.)
In evaluating West Bend’s first argument, the Illinois Supreme Court considered the meaning of the term “publication.” Because the policies did not define “publication,” the Court looked to the definition of the word in various sources to ascertain the term’s “plain, ordinary, and popular” meaning. (Id. ¶ 38.) Citing dictionaries, such as the Oxford English Dictionary Online (OED) and Webster’s Third New International Dictionary, the Court found that “the term [publication] means both communication to a single party and communication to the public at large.” (Id. ¶ 40.) The Court also observed that “insurance law and law of privacy treatises” define the term publication to mean “both communication to a single party and communication to the public at large.” (Id. ¶ 41.) In addition, the Court noted that the Restatement (Second) of Torts and common law define publication as “both communication to a single party and communication to the public at large.” (Id. ¶ 42.) Based on these varying meanings, the Court determined that the term was ambiguous because it had “at least two definitions”:
We find, based on our review of dictionaries, treatises, and the Restatement, that the term “publication” has at least two definitions and means both the communication of information to a single party and the communication of information to the public at large. If a term has multiple reasonable definitions or is subject to more than one reasonable interpretation within the context in which it appears, as in West Bend’s policies, the term is ambiguous.
* * *
A publication occurs when information is shared with a single party. See, e.g., Oxford English Dictionary Online, www.oed.com/view/Entry/154060 (last visited May 12, 2021) [https://perma.cc/35H3-UF7N]. Sekura alleges in her complaint that her biometric identifiers and information were shared with SunLync. Therefore, we find that the allegations in Sekura's complaint alleging that Krishna shared Sekura' s biometric identifiers and information with SunLync fall within or potentially within the definition for the term publication in West Bend's policies.
(Id. ¶¶ 43, 50.) Accordingly, the Court strictly construed the term against West Bend and construed “publication” to include a communication with a single party, like SunLync. (Id. ¶ 43.) The Court did not discuss or explain why it did not consider the use of the term “publication” in the context of the tort for violation of the right of privacy as relevant to the term’s meaning. In essence, the Court examined the word in isolation.
Addressing the distribution of material exclusion, the Court focused on the endorsement’s title—“Violation of Statutes that Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or Information” (emphasis added by Court)—and express reference to the TCPA and CAN-SPAM Act, along with the doctrine of ejusdem generis, to narrow the scope of the exclusion:
We begin our analysis with the fact the exclusion is titled "Violation of Statutes that Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or Information." (Emphasis added.) We note that all the items listed in the title are methods of communication. Next, the specific words used in the exclusion are two statutes that regulate methods of communication: the TCPA (telephone calls and faxes) and the CAN-SPAM Act (e-mails).
(Id. ¶ 58.) The Court then explained:
Applying the doctrine of ejusdem generis, we construe the “other than” language to mean other statutes of the same general kind that regulate methods of communication like the TCPA and the CAN-SPAM Act. Therefore, since [BIPA] is not a statute of the same kind as the TCPA and the CAN-SPAM Act and since [BIPA] does not regulate methods of communication, the [distribution of material] exclusion does not apply to [BIPA].
(Id.) In other words, the Court determined that BIPA—which regulates “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information”—does not regulate “methods” of communication and is “fundamentally different” from statutes that do regulate “methods” of communication, and therefore does not come within the purview of the distribution of material exclusion. (Id. ¶¶ 55-59.) The Court thus held:
[U]nder the doctrine of ejusdem generis and our rules of insurance contract construction, we construe the [distribution of material] exclusion to apply only to statutes like the TCPA and the CAN-SPAM Act, which regulate methods of communication like telephone calls, faxes, and e-mails. We also hold that the [distribution of material] exclusion in West Bend’s policies does not bar West Bend from providing coverage to Krishna for Sekura’s complaint. Accordingly, we hold that West Bend has a duty to defend Krishna against Sekura’s lawsuit.
(Id. ¶ 59.)
We will continue to monitor developments in privacy coverage stemming from this decision.
