BIPA Liability – Illinois (New York Law)

Remprex, LLC v. Certain Underwriters at Lloyd's London
2023 IL App (1st) 211097, 2023 WL 2724347 (Mar. 31, 2023)

The Appellate Court of Illinois, First District upheld the trial court’s ruling that a technology company was not entitled to coverage for an underlying class action in which it was not named as a defendant but was referred to in the pleadings. There was a duty to defend, however, with respect to a subsequent class action that included the insured as a defendant.

Remprex, LLC (Remprex) had a “Beazley Breach Response” policy (BBR Policy) underwritten by Certain Underwriters at Lloyd’s, London (Lloyd’s) that provided “data & network liability” and “media liability” coverage. A truck driver commenced a class action lawsuit against BNSF Railway Company (BNSF), alleging that BNSF had scanned his and other truck drivers’ fingerprints without consent. While Remprex was not named as a defendant, it was referred to in BNSF’s answer, participated in mediation efforts and responded to a subpoena. The lawsuit resulted in a jury verdict in the driver’s favor. The driver then instituted a second-class action lawsuit against Remprex, Illinois Central Railroad Company (ICRC) and CN Transportation, Ltd. (CN), alleging that the defendants used biometric data from truck drivers without their consent in violation of Illinois’ Biometric Information Privacy Act (BIPA). Remprex was voluntarily dismissed from that action.

Remprex sought coverage for costs incurred in both lawsuits under its BBR Policy. Lloyd’s denied coverage with respect to both lawsuits. Remprex commenced a declaratory judgment action against Lloyd’s, alleging breach of the BBR Policy, bad faith and fraud. The trial court granted Lloyd’s motion to dismiss, granting dismissal with prejudice of Remprex’s causes of action relating to the lawsuit against Remprex, ICRC and CN, and dismissing without prejudice the causes of action relating to the lawsuit against BNSF, allowing Remprex leave to re-file if it was later named in that lawsuit.

The appellate court affirmed the trial court’s dismissal of the complaint with respect to the lawsuit against BNSF. The appellate court reasoned that “Remprex was never named as a defendant in the BNSF complaint, thus no claim as defined by the policy was ever made against it by [the trucker], which would arguably have formed the basis for any duty to defend under the provisions of the policy.” The appellate court also determined that Remprex’s participation in mediation efforts did not rise to the level of a claim. As for the subpoena, the appellate court found that the subpoena was received outside of the policy period, so it was outside of the notice provision of the BBR Policy. The appellate court concluded that dismissal of the portion of the declaratory judgment complaint relating to this action was proper.

With respect to the lawsuit against Remprex, CN and ICRC, the appellate court found that the lawsuit did constitute a claim for which there might be coverage under the BBR Policy such that Lloyd’s had a duty to defend. The appellate court reasoned that the allegations that Remprex collected biometric data in violation of BIPA potentially fell within the BBR Policy’s Media Liability coverage part. However, there was no duty to defend under the policy’s data and network liability coverage because “[w]hile it is true that fingerprint biometric data is personally identifiable information, the collection and storage of it without the individual's permission does not appear to fall under this section of the policy.” The appellate court also affirmed the trial court’s dismissal of the causes of action sounding in bad faith and fraud.  

By: Stephanie Brochert