It is increasingly common for companies to collect biometric information from their employees and customers.  Employers are replacing keycards and physical timesheets, with fingerprint and retina scans.  Social media companies harvest facial data through photo-labeling to enhance the user experience and generate more revenue.  While companies’ use of biometric identifiers can enhance security and revenue, its use requires companies to at least temporarily collect and store biometric information.

Multiple states have specific statutes regulating a company’s collection and use of biometric information.  For instance, Illinois has enacted the Biometric Information Privacy Act (“BIPA”) (740 ILCS 14/1 et seq.), which allows for a private right of action by an employee or customer against a company that allegedly violates BIPA.  The penalties for a company’s violation of BIPA can be significant, including $1,000 per violation due to negligence or $5,000 per violation due to reckless or intentional conduct. 

For example, in Rogers v. BNSF Railway Co., No. 1:2019-cv-03083, (N.D. Ill. 2022), plaintiff truck driver Richard Rogers sued on behalf of a class of 45,600 drivers whose fingerprints were scanned when visiting BNSF Railway’s rail yards to pick up and drop off loads. Plaintiffs sued BNSF for alleged violations of BIPA and sought statutory damages of up to $5,000 per violation.  On October 12, 2022, a jury returned a verdict in favor of Plaintiffs, held BNSF had recklessly or intentionally violated BIPA 45,600 times, and awarded damages of $228 million.

There is no clear-cut answer to whether a particular company may have insurance to cover a claim like Rogers.  Among other reasons, this is true because there are multiple lines of insurance that may provide coverage, and this area of the law is undeveloped and unsettled. 

For example, in West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, (May 20, 2021), the Illinois Supreme Court held that a BIPA class action fell within a commercial general liability’s (“CGL”) coverage for “personal injury.”  However, subsequent decisions by federal district courts in Illinois have reached inconsistent conclusions whether various exclusions not at issue in Krishna bar coverage for BIPA claims (for “employment related practices exclusion,” compare Am. Family Mut. Ins. Co. v. Caramel, Inc., 2022 WL 79868 (N.D. Ill. Jan. 7, 2022) (bars coverage for BIPA claim brought by employee), with State Auto Mut. Ins. Co. v. Tony’s Finer Foods Enters., 589 F.Supp.3d 919 (N.D. Ill. March 8, 2022) (does not bar coverage for BIPA claim brought by employee)) (for “access or disclosure” exclusion, compare Citizens Ins. Co. of America, v. Thermoflex Waukegan, LLC, 588 F.Supp.3d 845 (N.D. Ill. March 1, 2022) (“access or disclosure” exclusion does not apply), with Continental Western Ins. Co. v. Cheese Merchants of America, LLC, 2022 WL 4483886 (N.D. Ill. September 27, 2022) (“access or disclosure” exclusion bars coverage)). 

There may be coverage for BIPA claims under not only a CGL policy, but also an employment practices liability policy.  For example, in Twin City Fire Insurance Co. v. Vonachen Services Inc. et. al, 567 F.Supp.3d 979 (C.D. Ill. October 19, 2021), the district court held Twin City must defend Vonachen in two putative class-action lawsuits alleging the company violated BIPA. 

While there is a dearth of cases analyzing the possibility of coverage for a BIPA claim under directors and officers, errors and omissions, and cyber and privacy policies, coverage may be available under those types of policies – depending on the allegations and policy language. 

This area of the law is not fully developed, multiple lines of insurance may be involved, and there is no uniformity of policy language.  Notwithstanding the uncertainty arising from these circumstances, what is certain is that a company facing a BIPA claim should analyze all lines of its insurance coverage to determine if the claim is potentially covered and consider consulting with an experienced insurance coverage attorney.

This article is for general informational purposes.  It is not intended to be, nor is it, legal advice.