A Win for Policyholders Seeking Coverage in a BIPA Class Action Suit

As practitioners across the state are well aware, Illinois has become a hotbed for litigation concerning the protection of biometric information, as companies of all shapes and sizes have found themselves defendants in lawsuits seeking to recover for alleged violations of Illinois’ Biometric Information Privacy Act (“BIPA”). Naturally, the availability of insurance coverage in these cases has become an equally compelling legal issue. The recent $36 million settlement of the class action BIPA lawsuit, Rosenbach v. Six Flags Entertainment Corporation, highlights the importance of insurance coverage in this area. 

In a separate case, the Illinois Supreme Court has issued an opinion that will have major implications concerning insurance coverage of BIPA lawsuits. On May 20th, the Illinois high court affirmed a lower court’s ruling that West Bend Mutual Insurance Co. must defend Krishna Schaumburg Tan Inc. in a BIPA class action lawsuit under its commercial general liability (CGL) policy.[1] At the heart of the Supreme Court’s opinion is the legal principle that an ambiguity in the language of an insurance policy will be strictly construed against the insurer. Notably, the First District has already cited the Krishna opinion in support of that very proposition.[2] Clearly, language matters.

In Krishna, the underlying BIPA class action alleges that Krishna, a franchisee of L.A. Tan, violated BIPA by collecting, storing, and distributing customers’ fingerprint data to an out-of-state vendor without customers’ consent. Krishna’s CGL policy covers claims arising from the “publication” of information that violates an individual’s privacy rights. The Justices took issue with the insurance policy’s use of the term “publication”, and construed that term broadly. The Supreme Court found that the term can have more than one meaning, and “publication” includes a situation in which information is provided to a single party and not just the public at large. This interpretation resulted in a finding of coverage, favoring the insured.  

Notably, the underlying BIPA lawsuit against Krishna involves a plaintiff who was a customer and not an employee of the tanning salon. In cases involving employee-plaintiffs, insurers oftentimes rely on employment practice exclusions to avoid coverage. However, these exclusions were inapplicable in Krishna.

What does this ruling mean for companies and their insurers? Of course, this opinion will provide comfort to those companies seeking coverage in high-stakes BIPA cases. Nonetheless, companies that collect biometric information should carefully review policy language in order to ensure this risk will be covered in the event of a claim, especially in light of the very real potential for large damages. 

Moreover, this ruling will serve as a wake-up call for insurers who will need to return to the drawing board and craft specific language that will operate to excludes coverage for BIPA and other privacy violation claims. While insurers will, no doubt, endeavor to shore up policy language and definitions in an effort to clarify any potential ambiguities, continued litigation in this area is inevitable. At least for now, however, the Supreme Court has issued the “final word” when it comes to BIPA coverage in Illinois, and states seeking to enact legislation similar to BIPA may very well rely on this seminal opinion.

[1] West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978 (May 20, 2021).

[2] Montano v. Erie Ins. Exch., 2021 IL App (1st) 201306-U (June 11, 2021). The Montano case does not involve BIPA claims. 

Get Updates By Email

Blog Contributors