Split appellate panel says insurers need not defend BIPA class action

A split Illinois appeals court panel Tuesday relieved insurers from Lloyd’s of London from defending against an Illinois Biometric Information Privacy Act class action because the allegations do not fall within the terms of two cyber policies.

The Appellate Court of Illinois, First District, majority in Tony’s Finer Foods Enterprises Inc. v. Certain Underwriters at Lloyd’s said Charlene Figueroa’s allegations did not trigger the insurers’ duty to defend because the employer authorized third-party timekeeping company Kronos to collect and store workers’ biometric information.

The 2-1 majority also said the insurers had no defense obligations under cyber policies issued from 2018 until 2020 because the class action does not involve a loss that resulted from a data breach, security failure or extortion threat.

Ms. Figueroa worked for the Chicago-based independent grocery chain from March 2017 until September 2018 and said in her state court class-action complaint that employees were required to clock in and out of work by scanning their fingerprints. She said Tony’s violated BIPA by failing to obtain workers’ consent before collecting their biometric data and failing to publish a schedule for the deletion of the information.

Tony’s sued the insurers from Lloyd’s in September 2022 after its request for a defense against the class action was denied. The parties filed competing motions for summary judgment, and the judge agreed with the grocery chain that the allegations fell within the terms of the policies.

The dissenting appellate judge said the lower court’s ruling should be affirmed because the insurers at Lloyd’s did not agree to provide a defense under a reservation of rights or initiate a lawsuit challenging its defense obligations.

Representatives for the parties did not respond to requests for comment.