Insurance Coverage for BIPA Violations: A Growing Challenge for Illinois Businesses

by
Insurance-Coverage-for-BIPA-Violations-A-Growing-Challenge-for-Illinois-Businesses-300x251

Insurance Coverage for BIPA violations.

Businesses across Illinois are facing serious challenges in securing insurance coverage for lawsuits brought under the Biometric Information Privacy Act (BIPA).   And a recent decision by the federal court in Chicago – Westfield Insurance Company v. UCAL Systems, Inc. – dealt yet another blow to corporate policyholders.  This ruling is just the latest in a series of legal setbacks that make obtaining coverage for BIPA claims under standard Commercial General Liability (CGL) policies an uphill battle.

What Is BIPA, and Why Does It Matter?

In 2008 Illinois enacted BIPA to safeguard the privacy and security of individuals’ biometric information, such as fingerprints, voice prints, retina scans, and other unique biological data. With technology advancing rapidly, BIPA introduced strict requirements for businesses that collect and store this information. The law mandates that companies obtain written consent before collecting biometric data and provide clear details on how the information will be used, stored, and for how long.  Since its passage, BIPA has triggered a flood of litigation, with plaintiffs seeking massive damages. For businesses, these lawsuits have the potential to be devastating, and many have historically relied on their CGL insurance policies to step in and cover the costs. However, a series of recent court decisions has dramatically narrowed the coverage available for BIPA claims.

The Westfield Case: A Major Setback for Businesses

In Westfield Insurance Company v. UCAL Systems, Inc., the employer was sued in a class action by employees who alleged the company had violated BIPA by using biometric fingerprint scans for clocking in and out without proper consent.  The employer turned to its business insurance for coverage under its CGL policy, but the insurer denied the claim, citing an exclusion in the policy for “Recording and Distribution of Material or Information in Violation of Law.”

The court sided with the insurance carrier and held that this exclusion applied to the BIPA claims.  Essentially, the court found that Westfield had no duty to defend or indemnify UCAL for the BIPA lawsuit because the exclusion covered violations of laws related to the dissemination and collection of information—exactly what BIPA regulates.

The Visual Pak Case: Setting the Stage for Westfield

This ruling follows in the footsteps of National Fire Ins. Co. of Hartford v. Visual Pak Co. Inc. where the Illinois Appellate Court upheld a similar exclusion. In Visual Pak, a staffing agency provided employees who were required to scan their fingerprints to track work hours. The plaintiff alleged the company violated BIPA by failing to obtain consent or establish retention policies for the biometric data.

As in Westfield, the insurer in Visual Pak argued that the CGL policy’s exclusion for violations of laws governing information collection and dissemination applied to BIPA claims. The Illinois Appellate Court agreed, holding that the exclusion barred coverage. Notably, the Illinois Supreme Court declined to review the decision, leaving businesses with even fewer options for fighting these denials of coverage.

The Impact of These Decisions

These court rulings have created a significant challenge for businesses hoping to rely on their standard CGL policies to cover BIPA claims.  The legal landscape for BIPA coverage is becoming more treacherous for employers.

The stakes for businesses could not be higher. BIPA violations can result in severe financial penalties, and without insurance coverage to soften the blow, companies could be facing significant out-of-pocket expenses. The Westfield decision makes it clear that companies should not assume their CGL policies will cover them in the event of a BIPA lawsuit.

What Should Businesses Do?

Illinois businesses need to take proactive steps to protect themselves in light of these rulings:

  1. Review Your Insurance Policies: Look closely at the exclusions in your CGL policy, especially those related to the collection and dissemination of information. If your policy contains a “Violation of Law” exclusion similar to the ones in Westfield and Visual Pak, coverage for BIPA claims may not be available.
  2. Consider Additional Coverage: Given the increasing risk of BIPA lawsuits, it may be wise to seek supplemental insurance coverage specifically designed to cover biometric privacy claims. These policies can provide a much-needed layer of protection if your standard CGL policy falls short.
  3. Consult with Legal and Insurance Experts: The language in insurance policies can be complex, and understanding the full scope of your coverage is crucial. Don’t hesitate to consult with legal counsel or an insurance expert to ensure you have the right coverage in place to protect your business from BIPA-related risks.

The landscape of BIPA litigation is evolving, and the courts are making it clear that businesses cannot rely on their traditional insurance policies to cover every risk. If you have questions about your coverage, don’t wait until it’s too late—reach out to an experienced legal advisor to help navigate these complex issues.