As the use of biometric information for verification purposes becomes widespread, employers and others should be aware of statutes which regulate the collection, storage and dissemination of this data. In this regard, there have been several lawsuits involving the use or storage of biometric information which have resulted in multi-million dollar settlements.
The California Consumer Privacy Act (Civil Code sections 1978.100 et seq.) defines biometric information as follows:
“Biometric information” means an individual’s physiological, biological, or behavioral characteristics, including an individual’s deoxyribonucleic acid (DNA), that can be used, singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information. Cal. Civil Code § 1798.140(b).
While a number of states, including California, have statutes which regulate the use or storage of biometric information, only two jurisdictions allow for a private right of action. These are the Illinois Biometric Information Privacy Act (commonly referred to “BIPA”) and section 22-1201-1205 of the New York City Administration Code. Most of the litigation around biometric information has arisen out of claimed violations of BIPA.
In this regard, civil lawsuits seeking recovery of damages and attorneys' fees, alleging that the defendant used, collected and stored its employees’ biometric data without informed consent. Further allegation that the employer failed to inform its employees of the specific purpose, and length of time for which their biometric identifiers or information would be collected, stored and used. See, e.g., Twin City Fire Ins. Co. v. Vonachen Services, Inc., 2021 WL 4876943 (C.D. Ill. October 19, 2021).
Companies that have been sued for alleged misuse of biometric ought to consider tendering the claim to their liability insurance companies. For example, there may be coverage under CGL Policy’s “personal and advertising injury” coverage, as a typical offense is “the oral or written publication of material that violates a person’s right of privacy”. See, e.g., West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan Inc., 2021 IL 125978,183 N.E. 3d 47(2021). In Krishna, the court found that the “publication” requirement was satisfied when the biometric information was shared with a single party (one of the defendant’s outside vendors) and was not disseminated to a large audience.
Another source of coverage might be D & O policies. In this regard, D & O policies typically contain an “invasion of privacy” exclusion. See, e.g., Horn v. Liberty Ins. Underwriters, Inc., 391 F.
Supp. 3d 1157 (S.D. Fla. 2019), aff’d, 998 F. 3d 1289 (11th Cir. 2021). Absent such an exclusion, however, private company D&O policies that provide entity coverage could provide coverage for such claims.
In Twin City, the defendant company argued that the underlying complaints merely asserted “procedural violations of BIPA” that did not constitute invasion of privacy. It also asserted that the underlying actions did not allege any disclosure, release or misuse violations, but instead only alleged procedural violations where the plaintiff-employees “did not face an appreciable risk to harm to their privacy interests”.
The District Court disagreed, noting that the Illinois courts had concluded that BIPA codifies person’s right to privacy in their biometric identifiers and information. See West Bend Mutual Insurance Company v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, (Ill. 2021); Rosenbach v Six Flags Ent. Corp. 129 N.E. 3d 1197, 1206 (Ill.2019) (holding that individuals possess a right to privacy in and control over their biometric identifiers and biometric information). In sum, the Court rejected the company’s argument that BIPA is violated only if the biometric information is collected surreptitiously or disseminated to third parties. For this reason, the Court determined that there was no coverage for the underlying claims under the D&O portion of the policy.
EPL policies might also come into play. Thus, the court in Twin City determined that there was coverage under the EPL part. In this regard, an “employment practices wrongful act” was defined to include the “breach of any oral, written or implied employment contract, including, without limitation, any obligation arising from a personnel manual, employee handbook or policy statement. “According to the court, this language assumes that a personnel manual, employee handbook or policy statement can give rise to a contractual obligation.
The employer Vonachen successfully argued that its employee handbook required employees to use the designated timekeeping system or face penalties for noncompliance, including termination. It also emphasized that the handbook stated that Vonachen “will comply with all applicable laws and regulations.“ Based on these provisions, Vonachen’s argument concerning coverage was that, because the handbook required it to use the timekeeping system, and because Vonachen had obligated itself in the handbook to comply with all laws associated with that system, including BIPA, Twin City’s duty to defend was triggered based on the alleged BIPA violations alleged in the underling complaint.
Cyber polices can also be a source of coverage for biometric claims. This is because such information may be included among the types of data protected in the liability section of cyber policies. In this regard, a cyber policy might provide the broadest possible protection against biometric data privacy claims from regulatory actions, and civil lawsuits where the underlying statute grants a private right of action or employee privacy claims.
Finally, there are three key exclusions which policyholders should keep in mind. They are:
- The access or disclosure exclusion, which bars coverage for access or disclosure and confidential information or data.
- The ERP exclusion, which pertains to employment related practices and bars coverage for claims arising from employment related practices.
- The violation of statute exclusion, which bars coverage arising from the distribution of material in violation of statute.
While there is little case law on these exclusions, a few conclusions can be drawn.
The access or disclosure exclusion does not bar coverage for suits under BIPA AM. Family Mut. Ins. Co. vs. Caramel, Inc., 2022 U.S. Dist. 3475 (N.D. Ill. 2022). Compare: Mass. Bay Ins. Co. vs. Impact Fulfillment Servs., LLC, 2021 U.S. Dist. LEXIS 182970 (M.D.N.C. 2021) (Recording and Distribution of Material or Information Exclusion barred coverage for suit brought under BIPA).
The ERP exclusion does not bar coverage for BIPA action. AM. Family Mut. Ins. Co. vs. Carnagio Ent., 2022 U.S. Dist. LEXIS 58358 (N.D. Ill. 2022); State Auto Mut. Ins. Co. vs. Tony’s Finer Foods Enters., 2022 U.S. Dist. LEXIS 40567 (N.D. Ill. 2022)
But in the absence of an Illinois Supreme Court decision concerning the applicability of this exclusion, there is a split in authority. See AM. Family Mut. Ins. Co. vs. Caremel, Inc., supra. (determining that ERP exclusion barred BIPA claim that arose out of plaintiff’s employment activities).
The violation of statue exclusion does not bar coverage for BIPA suits. AM Family Mut. Ins. Co. vs. Caremel, Inc., supra; West Bend Mut. Ins. Co. vs. Krishna Schaumburg Tan, Inc., supra; Citizens Ins. Co. and AM Family Mut. Ins. Co. vs. Wynndalco Ent., LLC, 2022 U.S. Dist. LEXIS 57654 (N.D.Ill 2022)(because this exclusion is “intractably ambiguous”, it did not override the insurer’s duty to defend).
This article was originally published in the Daily Journal.
- Partner
Peter S. Selvin, Chair of ECJ's Insurance Coverage and Recovery Department, is a business trial lawyer with more than 30 years of experience. While he specializes in the areas of insurance coverage and international litigation, his ...
Subscribe
Recent Posts
- Landlord: Look Out and Take Notice | By: Geoffrey M. Gold
- New Cal/OSHA Indoor Heat Standards Require New Prevention Measures and Written Prevention Plan | By: Joanne Warriner
- California Bans All Plastic Bags at Grocery Stores | By: Pooja S. Nair
- FTC’s Nationwide Ban on Non-Compete Agreements Stopped by Federal Court Ruling | By: Cate A. Veeneman
- Can the IRS Obtain a Receiver to Help Collect Taxes Owed? | By: Peter Davidson
- Severing Unconscionable Terms in Employment Arbitration Agreements | By: Jared W. Slater
- Can You Collaterally Attack a Receiver’s Appointment?
- Changes to PAGA Create Opportunities for Employers to Minimize Penalties | By: Tanner Hosfield
- Overbroad Employment Arbitration Agreements Will Not Be Enforced in California | By: Jared W. Slater
- LA Al Fresco Deadline Extended | By: Pooja S. Nair
Blogs
Contributors
Archives
- October 2024
- September 2024
- August 2024
- July 2024
- June 2024
- May 2024
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- December 2020
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- February 2020
- January 2020
- December 2019
- November 2019
- October 2019
- September 2019
- August 2019
- July 2019
- June 2019
- May 2019
- March 2019
- February 2019
- January 2019
- November 2018
- October 2018
- September 2018
- August 2018
- July 2018
- June 2018
- May 2018
- April 2018
- February 2018
- January 2018
- December 2017
- November 2017
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- November 2016
- October 2016
- September 2016
- August 2016
- July 2016
- June 2016
- May 2016
- April 2016
- January 2016
- December 2015
- November 2015
- October 2015
- September 2015
- August 2015
- July 2015
- June 2015
- May 2015
- April 2015
- March 2015
- February 2015
- January 2015
- December 2014
- November 2014
- October 2014
- September 2014
- August 2014
- July 2014
- June 2014
- May 2014
- April 2014
- March 2014
- February 2014
- January 2014