In Citizens Ins. Co. of Amer. v. Thermoflex Waukegan, LLC no. 20-05980 (N.D. Ill. Mar. 1, 2022), the United States District Court for the Northern District of Illinois rejected the application of three separate general liability exclusions to a claim seeking coverage for an Illinois Biometric Information Privacy Act (BIPA) class action alleging the wrongful collection of employee fingerprint scans.
In doing so, the court specifically rejected the holding of the January 2022 Northern District of Illinois decision in American Family Mutual Insurance Co. v. Caremel, where the court (different judge) held that the employment related practices exclusion in Coverage B in a general liability insurance policy precluded coverage for a similar BIPA claim. The Thermoflex court also rejected application of the Recording and Distribution of Material exclusion – an unstated rejection of the recent North Carolina federal court decision, Massachusetts Bay Insurance Company et al. v. Impact Fulfillment Services, LLC, which applied the exclusion to a BIPA claim. Finally, the court in Thermoflex also rejected application the Access or Disclosure of Personal Information exclusion – the second such court to reject the exclusion in the context of a BIPA claim. This case is particularly unusual because it has set up a rare intra-district conflict that will need to be resolved by appellate-level courts. As we explain further below, in the end, we believe it is a questionable decision that creates further uncertainty in the law.
Background. Thermoflex, an automotive accessory development and production company, was sued by a putative class of current and former employees alleging that Thermoflex violated BIPA in its collection of employees’ fingerprint scans for authentication and timekeeping purposes. See 2022 WL 602534, at *1-2. Thermoflex sought coverage for “personal and advertising injury” under its general liability policy and its excess/umbrella policy. Collectively, the policies defined “personal and advertising injury” in part as injuries “arising out of ... [o]ral or written publication, in any matter, of material that violates a person's right of privacy.” Id.
Both insurers denied coverage and commenced a declaratory judgment action alleging that three separate exclusions barred coverage: the Employment Related Practices exclusion, the Recording and Distribution of Material exclusion, and the Access and Disclosure of Personal Information exclusion. The parties then cross-moved for judgment on the pleadings. The insurers went 0-3, with the court concluding that none of the exclusions applied on the basis that their application in the context of the BIPA claim was ambiguous. For reasons unclear from the court’s opinion, the insurers apparently conceded that the underlying action alleged “personal and advertising injury.” Id. at *3.
Employment Related Practices (ERP) exclusion. The ERP exclusion precludes coverage in part for “personal and advertising injury” to a person arising out of any “[o]ther employment-related practices, policies, acts or omissions including but not limited to coercion, criticism, demotion, evaluation, failure to promote, reassignment, discipline, defamation, harassment, humiliation or discrimination directed at that person.” In this case, the insurers argued that the exclusion applied because, in essence, the fingerprint scans were collected in the context of the putative plaintiffs’ employment. Thermoflex, on the other hand, argued that because BIPA is not an employment statute and does not regulate employment matters, BIPA claims are “entirely different from—not ‘of the same kind’ as—the enumerated employment practices contained in the Employment[-Related Practices] Exclusion[s].” Id. at *4. The court agreed with Thermoflex.
Examining the exclusion’s catch-all provision in subparagraph (c), the court opined that it was “unclear” whether the underlying collection and use of fingerprint scans constituted “an employment-related practice like” the examples listed in the exclusion’s provision. Id. at *4. Then, noting that some of the examples listed in the exclusion were legal claims while others were forms of employer conduct, and that the BIPA claim could be either, the court concluded that this “mixture of examples” did not demonstrate a fit, but instead “amplifies the ambiguity of the exclusion.” The court stated:
Some of the listed examples (defamation, harassment, discrimination, and malicious prosecution) can be viewed as types of legal claims, while others (demotion, evaluation, reassignment, and humiliation) can be viewed as types of employer conduct. (“Coercion” may fall into either category, although the Court is unaware of any independent cause of action by that name.) Although the practice at issue in the [underlying lawsuit] could be understood as a claim—such as a “privacy violation[]” … it could equally well be understood as employer conduct, such as “collection of biometric information” or “collection of handprints[.]” The mixture of examples in the Employment-Related Practices exclusions amplifies the ambiguity of the exclusions as applied in this case.
Id. at *4 (internal citations omitted). Despite concluding that the BIPA claim could be deemed to fall within either category of employment practices included within the exclusion, the court concluded that the exclusion is ambiguous and did not preclude the duty to defend.
Further, examining the court’s earlier decision in Caremel – rendered just over a month before, and where the court held that the ERP exclusion did apply to a BIPA claim arising out of a collection of employee fingerprint scans – the court found that Caremel got it wrong. The court said:
[Caremel] explained that “a BIPA violation is of the same nature as the exemplar employment-related practices listed in the Policy” because, like BIPA, “[e]ach of ‘coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, [and] humiliation,’ reflect a practice that can cause an individual harm to an employee.” Id. at 10. But reading the exclusions as barring any employment-related practices that “can” cause harm to an employee would potentially preclude coverage for any claim against an employer. Such a result would be contrary to the rule that policy exclusions must “be read narrowly and ... applied only where ... clear, definite, and specific.”
Id. at *5 (emphasis added). In other words, the court said that Caremel read the exclusion too broadly to prohibit a claim for any employment practice brought against an employer – which is of course what the exclusion says. The court further opined that “several of the listed employment-related practices—evaluation and reassignment—are not inevitably ‘harm[ful]’ to employees such that coverage would be excluded.” Id. But if there is no harm, there would be no claim.
The recording and distribution of material exclusion. The exclusion in Thermoflex, which is broader than the Distribution of Material exclusion at issue in West Bend Mutual Ins. Co. v. Krishna Schaumburg Tan, Inc., prohibits coverage for:
Recording and distribution of material or information in violation of law
“Personal and advertising injury” arising directly or indirectly out of any action or omission that violates or is alleged to violate:
- The Telephone Consumer Protection Act (TCPA), including any amendment of or addition to such law;
- The CAN-SPAM Act of 2003, including any amendment of or addition to such law;
- The Fair Credit Reporting Act (FCRA), and any amendment of or addition to such law, including the Fair and Accurate Credit Transactions Act (FACTA); or
- Any federal, state or local statute, ordinance or regulation, other than the TCPA, CAN-SPAM Act of 2003 or FCRA and their amendments and additions, that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.
Id. at *5.
The carriers tried to distinguish the exclusion from the one at issue in West Bend, arguing that (1) the title of the exclusion in West Bend - “Violation of Statute That Govern E-Mails, Fax, Phone Calls or Other Method [of Sending Material or Information]” - differed and made that exclusion narrower; (2) the catch all provision in subparagraph (4) of the current exclusion was broader than the catchall provision of the exclusion at issue in West Bend; and (3) the West Bend exclusion did not include the FCRA, which conveyed a broader scope for the present exclusion. Id. at *6. The court rejected the arguments in total and with little analysis. Opining that BIPA, “on its face,” was not “of the same kind” of statute as TCPA, CAN-SPAM, and FCRA, the court concluded that “[a]t best, it is unclear whether BIPA is sufficiently similar to those other statutes,” thus making the potential applicability of the Recording and Distribution of Material exclusion ambiguous. Id.
Notably, and without naming the case, the decision flatly rejected the logic expressed in Massachusetts Bay Insurance Company et al. v. Impact Fulfillment Services, LLC, which held that BIPA was “of the same kind, character and nature as the enumerated statutes” to warrant the exclusion’s application.” There, the court concluded that: “the main purpose of this exclusion is to exclude from coverage statutes that protect and govern privacy interests in personal information. Like those statutes, BIPA protects and governs a person’s privacy interest in their biometric information.” How the Thermoflex court reached a different conclusion was really never explained.
The access or disclosure of personal information exclusion. Finally, Thermoflex became the second decision to reject application of the Access or Disclosure of Personal Information exclusion to a BIPA claim. Like in Caremel, the court employed the noscitur a sociis – by the company it keeps – doctrine to determine that the categories of information enumerated in the exclusion limited the its scope. (Okay, the Caremel court used ejusdem generis, but let’s not get too technical.)
The court observed that the Access or Disclosure Exclusion targets various types of “confidential or personal information,” concluding that “[a]ll the listed examples are types of sensitive information traditionally kept private—whether for financial/proprietary reasons in the case of ‘patents, trade secrets, processing methods, customer lists, financial information, [and] credit card information,’ or for personal reasons in the case of ‘health information.’” Id. at *7. Missing from this list are fingerprints. Further, BIPA itself “expressly distinguishes between ‘biometric identifiers,’ and ‘confidential and sensitive information.’” “Scans of hand or face geometry” are listed by the statute as a biometric identifiers, and are not identified as “confidential and sensitive information.” Id. Thus, the court concluded:
Although BIPA suggests that “biometric identifiers” may sometimes fall into the category of “confidential and sensitive information,” see, e.g., id. § 14/15(e)(2), it is noteworthy that none of the examples of biometric identifiers listed in the statutory definition are included in the definition of confidential and sensitive information, see id. § 14/10. The statutory text also makes clear that BIPA regards “[b]iometrics [as] unlike other unique identifiers that are used to access finances or other sensitive information.” Id. § 14/5.
Id. According to the court, “it is at best unclear whether BIPA treats handprints as ‘confidential and sensitive information.’ The Court resolves the Policies’ ambiguity in favor of the insured.” Id.
What this case means. Given the competing decisions by two judges from the same court within a matter of weeks, Thermoflex highlights the unsettled and uncertain nature of jurisprudence surrounding BIPA. Going 0-3, and in a time when spring training should have begun already, it’s also perhaps too cliché to view this decision as a strikeout for insurers. We feel that way, in part, because the decision fails to fully articulate the bases of its decision for each exclusion. The insurers will get “another at-bat,” whether on appeal or in another case. Nevertheless, the case should be one that cheers and jeers for caution. In the end, BIPA coverage case law remains unsettled.
