Blog

The Biometric Information Privacy Act is the litigation gift that keeps on giving.

Hundreds, if not thousands, of BIPA lawsuits have been filed across the state and federal courts of Illinois. Some BIPA lawsuits have even made their way out-of-state,[i] with some settling for enormous sums.[ii]

With so many BIPA lawsuits being filed, across all industries, an important question emerges: Is there insurance coverage for these BIPA lawsuits?

The recent decision from the Appellate Court of Illinois, First District, in Remprex LLC v. Certain Underwriters at Lloyd’s London provides one answer—among many—to this question.[iii]

What is BIPA?

BIPA establishes safeguards and procedures relating to the retention, collection, disclosure, and destruction of biometric data.[iv]

Passed in October 2008, BIPA is intended to protect a person’s unique biological traits, i.e., the data encompassed in a person’s fingerprint, voiceprint, retinal scan or facial geometry.

Given the sensitivity of this information[v] – there is no replacing or reissuing your fingerprint – BIPA provides a private right of action for “[a]ny person aggrieved by a violation of this Act.”[vi]

BIPA litigation shows no signs of slowing down. Plaintiffs are filing new class action complaints each week.

In addition, the Illinois appellate courts continue to face novel legal issues surrounding the statute, such as its statute of limitations,[vii] a claim’s accrual date[viii] and whether certain state or federal laws offer preemption.[ix]

Another looming issue surrounding the statute is the issue of insurance coverage.

Are defendants covered by their policies for the costs of defending and, even settling, BIPA lawsuits? There is no clear answer to this question.

The federal district courts have reached conflicting decisions on this important issue,[x] even as to the same named insured.[xi] The Remprex decision provides yet another perspective on the question of coverage.

The Underlying Lawsuits in Remprex

In April 2019, truck driver Richard Rogers sued BNSF Railway Co. in the Circuit Court of Cook County, Illinois, alleging the railroad company had obtained his fingerprints in violation of BIPA.[xii]

Rogers did not name Remprex as a defendant in the BNSF case. A few months later, Rogers filed a second class action in the U.S. District Court for the Northern District of Illinois, alleging Illinois Central Railroad Co. and CN Transportation Ltd. had also obtained his fingerprints in violation of BIPA.[xiii]

Rogers initially named Remprex as a defendant in the CN Transportation case, but later voluntarily dismissed Remprex.[xiv]

The BNSF case eventually went to trial “and resulted in a jury award in favor of the class and against BNSF.”[xv]

The BNSF case was the first BIPA case to go to trial and resulted in a $228 million judgment in October 2022, a fact conspicuously absent from the Remprex opinion.[xvi] BNSF’s affirmative defenses had alleged that Remprex provided a number of services to BNSF facilities, including its fingerprint-based automated gate systems.[xvii]

To that end, BNSF requested that Remprex indemnify it for any liability from the Rogers’ lawsuit based on the parties’ contract.[xviii] The CN Transportation case also referred to Remprex’s alleged provision of automated gates.[xix]

The Remprex Decision

Remprex maintained a “Beazley Breach Response” policy, underwritten by Lloyd’s, that covered a policy period from July 2018 to July 2019.

The Lloyd’s policy provided coverage for data and network liability and media liability.[xx]

On Aug. 24, 2020 – well before the BNSF case had gone to trial – Remprex filed suit against Lloyd’s, seeking a declaration of coverage, among other claims.[xxi] The circuit court granted Lloyd’s motion to dismiss, prompting the appeal.

The First District affirmed in part and reversed in part, applying New York law.

In the BNSF case, Remprex was never the subject of a claim, as that term was defined by the policy. Remprex was never named as a defendant, and BNFS’ answer and contractual demand for indemnity were not “claims” made against Remprex. Lloyd’s, therefore, had no duty to defend Remprex in the BNSF case. [xxii]

The Lloyd’s “policy did not cover any aspect of the BNSF lawsuit.”[xxiii] The court’s decision now leaves Remprex potentially responsible for indemnifying BNSF for the full $228 million verdict – a verdict that may be poised to grow even higher in light of the Illinois Supreme Court’s recent decision in Cothron v. White Castle System Inc.[xxiv]

Remprex fared better on the CN Transportation side of the case. The First District found the circuit court erred in denying coverage for the expenses Remprex incurred in defending against the CN lawsuit based on the allegation “that it unlawfully collected the CN plaintiffs’ fingerprints.”[xxv]

The First District held that the media liability provision of the policy extended to instances where the insured violated an individual’s right to privacy “during the ‘course of creating media material.’”[xxvi] The First District declined to find coverage under the data and network liability provision, noting that BIPA violations are not data breaches.[xxvii]

This last point is not a controversial one; BIPA is not a data breach statute. Instead, the statute’s purpose is to regulate the collection and retention of biometric data before there is any data breach or unauthorized access.[xxviii]

Remprex Will Not Be the Last Word

BIPA establishes that “individuals possess a right to privacy in and control over their biometric identifiers and biometric information.”[xxix]

Federal courts have previously determined that a lawsuit asserting a violation of this right to privacy falls within the “personal and advertising injury” provision of an insurance policy, triggering coverage.[xxx]

Indeed, it is all but uncontested that underlying BIPA lawsuits “allege ‘personal and advertising injury.’”[xxxi]

The question in these personal and advertising injury coverage cases has been whether a policy exception unambiguously applies to preclude coverage.[xxxii]

Insurers have pressed three specific policy exclusions for denying coverage in BIPA lawsuits: the employment-related practice exclusion, the statutory violation exclusion and the access or disclosure exclusion.[xxxiii]

Remarkably, there is no uniformity with respect to any of these exclusions. The federal courts have come to conflicting decisions on the application of each of these three exclusions, and there has been no decision from either the First District or the U.S. Court of Appeals for the Seventh Circuit on these exclusions.

The Remprex decision did not involve the interpretation of a standard commercial general liability policy, which has often been at the forefront of BIPA coverage decisions.

As a result, the decision did not interpret a personal and advertising injury provision and did not cover any of the three exceptions that have been the focus of the federal court decisions.

The Remprex decision also involved the vendor as the policyholder, rather than the party directly responsible for implementing the fingerprinting policy, such as the employer or property owner. Given all of these limitations, Remprex’s reach will be somewhat limited.

Remprex’s reach will also be somewhat limited because it was decided under New York law, instead of Illinois law.[xxxiv]

While the black-letter law for interpreting insurance provisions does not vary greatly from New York to Illinois, the choice of law provision will offer litigants another way of distinguishing the Remprex decision.

In the end, Remprex does not offer any conclusive decision on BIPA coverage issues. So, for the time being, BIPA lawsuits – and the coverage disputes that they generate – will keep on truckin’.

This post was originally published online by Law360 on May 23, 2023.

[i] See, e.g., Vance v. Microsoft Corp., 534 F. Supp. 3d 1301 (W.D. Wash. 2021).

[ii] See Zellmer v. Facebook, Inc., No. 3:18-CV-01880-JD, 2022 WL 976981, at *1 (N.D. Cal. Mar. 31, 2022) (noting the $650 million settlement in favor of Illinois Facebook users).

[iii] Remprex, LLC v. Certain Underwriters at Lloyd's London, 2023 IL App (1st) 211097.

[iv] 740 ILCS 14/15.

[v] 740 ILCS 14/5(c).

[vi] 740 ILCS 14/20.

[vii] Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563, ¶1, appeal allowed, No. 127801, 2022 WL 808656 (Ill. Jan. 26, 2022).

[viii] Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1159 (7th Cir. 2021) (certifying to the Illinois Supreme Court the question of whether a BIPA claim accrues only once or repeatedly); Watson v. Legacy Healthcare Fin. Servs., LLC, 2021 IL App (1st) 210279, ¶65.

[ix] McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, ¶1; Walton v. Roosevelt Univ., 2022 IL App (1st) 210011, ¶2.

[x] Citizens Ins. Co. of Am. v. Wynndalco Enterprises, LLC, No. 20-CV-3873 JZL, 2022 WL 952534, at *1 (N.D. Ill. Mar. 30, 2022) (granting insured’s motion for judgment on the pleadings), appeal filed (7th Cir. Apr. 27, 2022); Am. Fam. Mut., Ins. Co., S.I. v. Carnagio Enterprises, Inc., No. 20-CV-3665 JZL, 2022 WL 952533, at *1 (N.D. Ill. Mar. 30, 2022) (granting insurer’s motion for summary judgment); Citizens Ins. Co. of Am. v. Highland Baking Co., No. 20-CV-4997 MMP, 2022 WL 1210709, at *1 (N.D. Ill. Mar. 29, 2022) (granting insured’s motion for judgment on the pleadings); State Auto. Mut. Ins. Co. v. Tony's Finer Foods Enterprises, Inc., No. 20-CV-6199 SCS, 2022 WL 683688, at *1 (N.D. Ill. Mar. 8, 2022) (denying insurer’s motion for summary judgment); Massachusetts Bay Ins. Co. v. Impact Fulfillment Servs., LLC, No. 1:20-CV-926 WLO, 2021 WL 4392061, at *1 (M.D.N.C. Sept. 24, 2021) (granting insurer’s motion for judgment on the pleadings); Am. Fam. Mut. Ins. Co. v. Caremel, Inc., No. 20-CV-637 HDL, 2022 WL 79868, at *1 (N.D. Ill. Jan. 7, 2022) (granting insurer’s motion for summary judgment).

[xi] Compare Citizens Ins. Co. of Am. v. Thermoflex Waukegan, LLC, No. 20-CV-05980 JFK, 2022 WL 602534, at *1 (N.D. Ill. Mar. 1, 2022) (granting insured’s motion for judgment on the pleadings), with Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., No. 21-CV-788 JZL, 2022 WL 954603, at *1 (N.D. Ill. Mar. 30, 2022) (granting insurer’s motion for summary judgment).

[xii] Remprex, LLC, 2023 IL App (1st) 211097, ¶5.

[xiii] Id. at ¶9.

[xiv] Id. at ¶10.

[xv] Id. at ¶7.

[xvi] Rogers v. BNSF Railway Co., No. 1:19-cv-3083 (N.D. Ill.) (Doc. 225).

[xvii] Remprex, LLC, 2023 IL App (1st) 211097, ¶5.

[xviii] Id. at ¶19.

[xix] Id. at ¶9.

[xx] Id. at ¶12.

[xxi] Id. at ¶15.

[xxii] Id. at ¶¶54-57.

[xxiii] Id. at ¶60.

[xxiv] See Christopher Brown, BNSF’s $228 Million BIPA Judgment in Play After ‘White Castle,’ Bloomberg Law (March 9, 2023) (discussing Cothron v. White Castle System, Inc., 2023 IL 128004).

[xxv] Remprex, LLC, 2023 IL App (1st) 211097, ¶74.

[xxvi] Id. at ¶72 (quoting the policy). The parties did not “appear to dispute whether fingerprints are considered media material.” Id.

[xxvii] See id. at ¶78.

[xxviii] See 740 Ill. Comp. Stat. 14/5.

[xxix] Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶33.

[xxx] Thermoflex Waukegan, 2022 WL 602534, at *4.

[xxxi] Thermoflex Waukegan, 2022 WL 954603, at *3.

[xxxii] Thermoflex Waukegan, 2022 WL 602534, at *4.

[xxxiii] See id. at *4-7.

[xxxiv] Remprex, LLC, 2023 IL App (1st) 211097, ¶40.