Illinois - Commercial General Liability Coverage - Personal and Advertising Injury Claim
The Northern District of Illinois in Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc. (March 30, 2022) found no CGL coverage for a class action lawsuit based on the Illinois Biometric Information Privacy Act because the policies’ Access Or Disclosure Of Confidential Or Personal Information exclusion defeated the duty to defend.
Thermoflex Waukegan, LLC was sued in Illinois state court based on allegations it violated the Illinois Biometric Information Privacy Act (“BIPA”). The BIPA provides an action for damages against a private entity if it “disclose[s], redisclose[s], or otherwise disseminate[s] a person’s … biometric identifier or biometric information” without the person’s consent.
The plaintiff class, led by employee Gregory Gates, claimed Thermoflex violated the BIPA by requiring him to scan his handprint each time he clocked in and out of work and then transmitting handprint data to a third party without authorization.
Thermoflex sought coverage for the class action lawsuit under a series of CGL policies issued to it by insurer Mitsui Sumitomo. These policies covered, among other things, “personal and advertising injury,” defined to mean “injury … arising out of one or more of” certain enumerated offenses, including “[o]ral or written publication, in any manner, of material that violates a person’s right of privacy.”
Yet the policies also contained three exclusions relevant to the class action suit. The court’s opinion focused its analysis on one of them: the “Access Or Disclosure Of Confidential Or Personal Information” exclusion (the “Access Or Disclosure exclusion”). The exclusion applied to injury “arising out of any access to or disclosure of any person’s or organization’s confidential or personal information.”
The Parties’ Arguments
The insurer contended that personal or advertising injury coverage was unavailable in light of the Access Or Disclosure exclusion. It also relied on two additional exclusions: the “Recording And Distribution Of Material Or Information In Violation Of Law” exclusion and the “Employment-Related Practices” exclusion.
Thermoflex argued that the Access Or Disclosure exclusion has limited scope. It invoked the interpretive canon of ejusdem generis -- or, “general words are construed to embrace only objects similar in nature to those … specific words” -- to pare down the exclusion’s use of the term “confidential or personal information.” It likewise claimed BIPA’s terms do not coincide with those used in the Access Or Disclosure exclusion.
The District Court’s Decision
The court began by setting forth the parties’ relative burdens, including that under Illinois law, the policyholder bears the burden “to show that its losses are covered under the policy’s coverage terms.” It also noted it would interpret policy terms and exclusions against the insurer only in the presence of policy ambiguity. The opinion then clarified it would first analyze whether the Gates suit triggered a duty to defend under the policies.
The court focused on whether the “Access Or Disclosure” exclusion obviated the duty to defend. As an initial matter, the court emphasized the broad nature of the exclusion, evidenced by its application to “any access to or disclosure of any person’s … confidential or personal information.” It also concluded that the exclusion’s language “is clear and unambiguous.” As a result, it rejected Thermoflex’s arguments based on interpretive canons as inapplicable.
The court’s analysis also compared the BIPA’s terms to the Access Or Disclosure exclusion. In particular, the BIPA defines the term “confidential and sensitive information” to include “personal information that can be used to uniquely identify an individual.” The Access Or Disclosure exclusion likewise applied to “personal information.” The court observed “biometric identifier[s],” including hand scans, fit within the BIPA definition and the Access Or Disclosure exclusion.
The court concluded the opinion by finding the Access Or Disclosure exclusion defeated the duty to defend (and, in turn, any indemnification duty) in relation to the class action lawsuit. It reasoned: “Simply put, the state-court litigation seeks damages arising out of a third-party’s access to or Thermoflex’s disclosure of Gates’s personal information, placing it clearly within the scope of the exclusion.”
Conclusion
The court’s opinion in this matter hewed to the plain language of the Access Or Disclosure exclusion in finding it defeated coverage for the class action lawsuit. The court also clarified that this result does not render personal or advertising coverage illusory. Indeed, the decision flowed from a detailed comparison of Gates’ BIPA allegations to the items excluded by the policy.
