Illinois Supreme Court rules that insurer is required to defend claim under Biometric Information Privacy Act (“BIPA”)

On Thursday May 20, 2021, the Illinois Supreme Court decided a potentially important coverage case for BIPA defendants. In West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., the court held that an insurer owed a duty to defend its insured against BIPA class action claims where the insurance policies at issue provided coverage for injuries due to “oral or written publication of material that violates a person’s right of privacy.” [1] Specifically, the court held that the term “publication” as used in the policies encompassed communications of private information to even a single third party. The court found the underlying complaint’s allegations that Krishna unlawfully disclosed biometric information to its third-party vendor satisfied this test. [2]

The court’s decision, while significant for being the first of its kind with respect to insurance coverage for BIPA claims, has other potential implications. It comes as two Illinois appellate courts are considering whether a one-year limitations period for claims involving “publication of matter violating the right to privacy” applies to BIPA. [3] Thus, the focus on the scope of the term “publication” in West Bend may be important.

Since the Rosenbach v. Six Flags decision triggered a tidal wave of BIPA class actions, [4] litigants have devoted tomes of briefing to the question of whether a one-year limitations period applies to BIPA claims. Defendants argue the one-year limitations period applies because the ultimate harm BIPA is designed to protect against is the unlawful disclosure—or “publication”—of biometric information. [5] Plaintiffs argue that disclosure in the BIPA context is not equivalent to a “publication of private information” because it often involves only the sharing of biometric information with third-party vendors as opposed to the public at large.

Many state and federal trial courts have questioned or rejected a one-year limitations period for BIPA claims. Recently, however, some BIPA cases have been stayed for the appellate courts to review, and ultimately decide, whether disclosure of biometric information constitutes a “publication of private information” sufficient to trigger the one-year limitations period. The appellate courts’ decisions may depend on the interpretation and scope of the term “publication” as applied to the disclosure of biometric information.

Enter the Illinois Supreme Court’s West Bend opinion. The court’s primary task in West Bend was to determine the scope of the term “publication” as used in the policies and resolve whether Krishna’s alleged transmission of biometric data to its third-party vendor in violation of BIPA fell within the policy’s scope.[6]  West Bend, as the insurer, contended that publication meant only a communication of information to the public. [7] Krishna, as the insured, argued that publication also included communications made to a single party such as its third-party vendor.[8]

Notably, the policies at issue in West Bend did not define the term “publication,” so the court relied on other sources to inform its analysis. Reviewing dictionary definitions for the term as well as definitions from the Restatement (Second) of Torts, the court found those sources supportive of interpreting “publication” to include communications to even a single third party. [9]

The court’s review of these sources could play a key role in the Tims and Marion decisions because those appellate courts similarly will have to ascertain the type of “publication” required to trigger a one-year limitations period for BIPA claims. The appeals in Tims and Marion are fully briefed, and thus, an appellate court ruling could come in the next few months. Depending on the outcome of those appeals, a further appeal to the Illinois Supreme Court is likely.

The development of appellate case law in the biometric privacy space is an important reminder that biometric privacy regulation is here to stay. Nixon Peabody has assisted numerous clients in updating disclosures and policies to ensure that liability under BIPA, and other biometric privacy laws [10], is minimized.

1. 2021 IL 125978, ¶62.[Back to reference] [Back to reference]
2. Id. ¶¶38-43, 50, 62.[Back to reference]
3. See Tims v. Black Horse Carriers, No. 1-20-0563 (Ill. Ct. App. 1st Dist.); Marion v. Ring Container Techs., No. 3-20-0184 (Ill. Ct. App. 3rd Dist.) [Back to reference]
4. https://www.nixonpeabody.com/ideas/articles/2019/01/25/illinois-biometric-information-privacy-act-ruling [Back to reference]
5. BIPA expressly prohibits the disclosure of a person’s biometric information without providing notice and obtaining their consent. See 740 ILCS 14/15(d). [Back to reference]
6. 2021 IL 125978, ¶38-43, 45. [Back to reference]
7. Id., ¶39. [Back to reference]
8. Id. [Back to reference]
9. Id., ¶41, 42. [Back to reference]
10. https://www.nixonpeabody.com/en/ideas/blog/data-privacy/2021/05/11/nyc-biometric-privacy-law-what-do-businesses-need-to-know [Back to reference]