What Companies Involved About Illinois Biometric Info Privateness Act (BIPA) Dangers Can Study From Tony’s Finer Meals

Simply two months in the past, Illinois Governor J. B. Pritzker signed vital amendments to the Illinois Biometric Info Privateness Act (BIPA). Whereas the amendments restrict companies’ publicity to BIPA-related damages, vital BIPA exposures nonetheless persist. Given these persevering with exposures, companies ought to take into account the protections that insurance coverage can supply. The Illinois Appellate Court docket’s September 2024 determination in Tony’s Finer Meals Enterprises v. Sure Underwriters at Lloyd’s, 2024 IL App (1st) 231712 presents concrete steering for companies interested by doing simply that.

Background  

A plaintiff filed a putative class motion alleging that grocer Tony’s Finer Meals violated BIPA by requiring workers to scan their fingerprints to clock out and in of labor. The fingerprints, that are biometric data beneath BIPA, had been allegedly maintained in a database by third-party Kronos. Tony’s tendered the lawsuit to its cyber insurer Lloyd’s. Lloyd’s denied protection and litigation ensued.

Lloyd’s defended its protection denial by arguing that the lawsuit didn’t fall inside the cyber coverage’s insuring settlement. The cyber coverage prolonged protection for Tony’s “loss” “ensuing from” a “information breach” or a “safety failure.” The coverage outlined “information breach,” in pertinent half, to imply “the acquisition . . . of personally identifiable data . . . in a way, that’s unauthorized by” Tony’s. The coverage outlined “safety failure” to imply any failure by Tony’s or its contractors in securing Tony’s laptop techniques.

Tony’s argued that the underlying BIPA lawsuit match inside the definitions of “information breach” and “safety failure.” In keeping with Tony’s, the underlying lawsuits alleged that information was disclosed in a way unauthorized by Tony’s in that Tony’s didn’t authorize Kronos to entry or retailer the biometric information in a BIPA non-compliant method. In a dissenting opinion, Justice Reyes credited Tony’s argument to find that Lloyd’s had an obligation to defend. In keeping with Justice Reyes, a “believable inference is that Tony’s anticipated Kronos to handle the biometric data in a way compliant with relevant regulation.”

The bulk disagreed. It reasoned that the underlying lawsuit didn’t “allege any type of third-party entry to Tony’s workers’ information that Tony’s didn’t authorize, both resulting from laptop safety failures or for another purpose,” which is the one state of affairs that, in keeping with the Court docket, this cyber insurance coverage was meant to cowl. The bulk additionally held that an exclusion neither the events nor the circuit courtroom raised independently barred protection.

The Cyber Insurance coverage Market Response to Tony’s and Different BIPA Dangers

The cyber insurance coverage market has been grappling with methods to deal with BIPA and different biometric liabilities and exposures for a while. Some insurers have added categorical biometric information exclusions to all of their insurance policies to keep away from BIPA dangers. Others have centered extra on biometric exposures in underwriting, solely including doubtlessly relevant exclusions the place the chance profile for that insured is excessive. Different insurers haven’t added exclusions, as an alternative counting on current wrongful assortment of information exclusions of their insurance policies to seize this threat and/or counting on slim insuring agreements that might not embody most BIPA claims.

Apply Pointers

Whereas the Tony’s courtroom discovered for the insurer and denied protection to a policyholder, there are nonetheless avenues for policyholders searching for insurance coverage protection for BIPA claims. After Tony’s, companies searching for insurance coverage protection for BIPA claims ought to take into account the next:

1. Alternative of Regulation: As a result of BIPA is an Illinois statute, most case regulation decoding the applicability of insurance coverage to BIPA claims has occurred to additionally come up in Illinois. However not all insurance coverage insurance policies are topic to Illinois regulation – most aren’t. Certainly, they’re prone to be ruled by the legal guidelines of different states such because the state the place a given enterprise is included or headquartered. And when the regulation of different states applies, policyholders can litigate these points as issues of first impression, together with with quotation to and assist from Justice Reyes’ dissenting opinion.
2. Coverage Language: Insurance coverage coverage language—particularly cyber insurance coverage coverage language—will not be standardized and may differ considerably from coverage to coverage. When the coverage language is totally different, Tony’s is not going to management a courtroom’s disposition of whether or not cyber insurance coverage is out there for a particular BIPA declare, even for different policyholders certain by Illinois regulation. Policyholders ought to search for broad insuring agreements round privateness dangers and attempt to keep away from—or at the very least slim—overbroad “wrongful assortment” and biometric information exclusions.
3. Different Traces of Protection: Whereas cyber insurance coverage is a possible supply for insurance coverage protection for BIPA claims, so too are industrial common legal responsibility (CGL) and errors & omissions (E&O) insurance coverage insurance policies. So companies ought to remember to notify insurers aside from their cyber insurer. Certainly, relative to the identical underlying lawsuit at concern in Tony’s, a federal courtroom discovered that Tony’s was entitled to protection beneath a CGL coverage. See Cont’l W. Ins. Co. v. Tony’s Finer Meals Enterprises, Inc., 2023 WL 4351469 (N.D. Unwell. July 5, 2023).

Tony’s is a well timed reminder to policyholders to think about their protection for BIPA claims earlier than a lawsuit is filed. As at all times, session with skilled protection counsel may be important to make sure that your insurance coverage program is ready to reply when a BIPA declare arises.