The Seventh Circuit Court of Appeals affirmed a decision that an Illinois-based infotech firm is owed the duty of defense for underlying suits based on alleged BIPA violations. The case is Citizens Ins. Co. of Am. v. Wynndalco Enters., LLC, 70 F.4th 987 (7th Cir. 2023).  

Clearview AI converted data from more than 3 billion photos of individuals from a variety of online sources into biometric facial recognition identifiers, paired them with information about where the photos were taken, and created a database of the photos that included identifying information. The Chicago Police Department (CPD) gained access to this database through a two-year contract with its purchasing agent and Wynndalco Enterprises, an infotech services and consulting firm. 

Wynndalco was sued in two separate class actions for its part in the transaction. The suits, though they differed on the exact nature of Wynndalco's role, accused Wynndalco of intentional or reckless violations of BIPA, unjust enrichment, and invasion of privacy. 

Wynndalco had purchased a businessowners policy from Citizens that provided coverage for personal and advertising injury. The policy defined such an injury as "including consequential 'bodily injury,' arising out of one or more of the following offenses: … e. oral or written publication, in any manner, of material that violates a person's right of privacy." Citizens did not dispute that the claims levied against Wynndalco in the class actions fit the bill for personal and advertising injuries. 

However, Citizens denied Wynndalco's claim based on a catch-all provision for statutory violations that excluded injuries arising from acts or omissions that actually or allegedly violated the TCPA, CAN-SPAM Act, FCRA, FACTA, or "[a]ny other laws, statutes, ordinances, or regulations, that address, prohibit or limit the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information." (italics omitted, bold added). Wynndalco filed suit against Citizens for breach of policy and sought a declaration that Citizens owed the duty of defense.  

Both parties moved for a judgment on the pleadings. The trial court found that the catch-all provision of the exclusion was ambiguous because it would preclude coverage not only for violations of privacy statutes, but also for actions the policy was intended to cover, such as slander and copyright violations. The judges could not resolve the ambiguity using interpretive canons and ruled that Citizens was obligated to defend Wynndalco. 

Citizens appealed and argued that the principle of ejusdem generis (when a general term follows a list of specific terms, the general term only applies to things similar to the specific terms) meant that since the specific regulations named in the exclusion all dealt with privacy, the catch-all provision only excluded coverage for statutory violations related to privacy. It would exclude BIPA claims, but leave coverage intact for non-statutory common law claims, like defamation. 

The judges of the Seventh Circuit didn't expressly disagree, but they pointed out a major problem with Citizens's interpretation: There were no clues, either in the catch-all provision or elsewhere in the exclusion, that indicated or even mentioned privacy. In order to reach the conclusion drawn by Citizens, a policyholder would have to take hints from the nature of the named acts, meaning the terms would be ascribed a meaning beyond their face value, which is frowned upon in the insurance world. 

The Seventh Circuit looked to an earlier Illinois case, West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 183 N.E.3d 47 (Ill. 2021), for guidance. In that case, whose facts were similar to those in Citizens, the Illinois Supreme Court resolved an ambiguity concerning whether the catch-all provision of an exclusion precluded coverage for BIPA violations through ejusdem generis. The exclusion in question was under a heading that referenced multiple forms of communication. The specific acts named in the exclusion also regulated methods of communication. The court concluded that the catch-all provision of the exclusion referred to statutes that regulated communication. BIPA did not regulate methods of communication, so the exclusion did not apply.

The judges of the Seventh Circuit reasoned that, based on Krishna, when there is an exclusion for statutory violations, and the heading indicates a particular type of statute, and the statutes named in the exclusion are part of the same category, and the scope of a catch-all provision immediately following the named statutes is unclear, it is reasonable to use ejusdem generis to interpret the broader language of the catch-all as including only the same category of statutes as the heading and named statutes.  

Citizens argued that the named acts all addressed privacy, so BIPA-related claims would be excluded but not claims for libel, slander, and copyright or trademark infringement, but the Seventh Circuit was not convinced. Nothing in the exclusion's heading, "Distribution of Material in Violation of Statutes," indicated the regulation of privacy. The exclusion specifically named the TCPA and CAN-SPAM Act, but it also included the FCRA and FACTA, which regulated the reporting of consumer credit information. The information needed to make the leap that the TCPA, CAN-SPAM Act, FCRA, and FACTA were all connected by privacy was not obvious to those purchasing the policy. 

Since the privacy connection between the named acts and the catch-all provision in the exclusion went beyond what was readily apparent, and the policy definition for personal and advertising injury included injuries arising from any manner of oral or written publication that violates another person's right to privacy, at least some of the allegations in the class actions against Wynndalco could be covered under the Citizens policy. Therefore, the court affirmed the verdict that Citizens was obligated to defend Wynndalco. 

Editor's Note: Though the court didn't say Citizens was flat-out wrong in claiming that all of the statutes named in the exclusion were united by privacy, they brought up the gap between the acts named in the exclusion, with TCPA and CAN-SPAM Act on one side and the FCRA and FACTA on the other. The principle of ejusdem generis is important to the interpretation of insurance policies, especially when ambiguities are found in favor of the insured. Policies must be carefully worded and drafted in such a way that the intent and meaning is clear. 

Read More: