LOG IN Alert Search Send Message BROKERAGE INSURANCE DELEGATED INSURANCE SUCCESS STORIES BROCHURES CLAIMS INSIGHTS ABOUT US CONTACT US COLLECTING BIOMETRIC DATA? LIABILITY MAY BE GREATER THAN YOU THINK HOME / INSIGHTS / BLOGS / COLLECTING BIOMETRIC DATA? LIABILITY MAY BE GREATER THAN YOU THINK 16 October 2019 by Richard VanSwol | Claims Attorney, Genesis & GenStar The Illinois General Assembly enacted the Biometric Information Privacy Act, 740 ILCS 14/1 et seq., in 2008.1 It was the first state law pertaining to biometrics and privacy, and it requires strict compliance. Known as the BIPA, it has more recently emerged as the next battlefront for class-action lawyers. As other states like Texas and Washington have begun to pass statutes patterned on the Illinois BIPA,2 it is important for insurance professionals to be aware of the requirements, key issues, and exclusions so that they can decide the best course of action. Requirements The Illinois BIPA requires in § 15 that private entities in possession of biometric information must develop a written policy for the retention and destruction of that information, and that they also must obtain informed written consent before collecting such information from a person. Section 20 provides a private cause of action for persons “aggrieved by a violation of this Act.” Defendants may be liable for liquidated damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, plus reasonable attorney fees. Key Issues The wave of BIPA class action suits is too recent for any declaratory judgment actions to have reached published decisions on whether an insurer owes coverage for BIPA claims. The key issue will likely be whether a BIPA claim alleges covered “personal and advertising injury.” Under standard policy forms, this coverage includes torts such as publication of material that violates a person’s right of privacy. Not every BIPA suit will involve actual “publication,” but based on some facts, a court might conclude that an alleged violation of the BIPA infringes a privacy right. Exclusions However, even if a court were to find that an Illinois BIPA claim comes within the policy’s insuring agreement, several exclusions could apply, depending on the facts of the case and the policy terms. Such exclusions may include, but are not limited to: Catch-all language in exclusions for “personal and advertising injury” arising out of statutes like the TCPA that govern the collection and distribution of material or information Exclusions that apply to liability for risks like data breaches, based on access to or disclosure of confidential or personal information Manuscript endorsements specifically excluding claims arising from the collection, possession, storage, use, transmission, disclosure, or destruction of biometric identifiers or biometric information as defined in the Act, or from related practices and policies In cases of intentional or reckless conduct, exclusions for “personal and advertising injury” caused with the knowledge that it would violate the rights of another (in some states, multiple damages may also be uninsurable as a matter of public policy) In the case of class actions brought by employees (based on the use of biometric timeclocks at, e.g., hotels, restaurants, grocery stores, or airlines), exclusions for employment-related practices, policies, acts, or omissions If a policy covers employment-related practices, the insurer may still have an exclusion for statutory claims other than claims for alleged discrimination Final Thoughts If an insured desires coverage for collecting biometric data and an insurer is willing to cover it, the broker, insurer and insured should agree on terms of an endorsement, specifically granting BIPA coverage to show that they do not intend for the exclusions mentioned here to apply to such risks. Pricing will depend on factors such as whether this coverage is subject to a sublimit, applies above a deductible, or is eroded by defense costs. As class actions often present the potential for large exposures, all parties have an interest in making the scope and limits of coverage as clear as possible. Endnotes: 1 http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57 2 https://www.nextadvisor.com/biometric-privacy-laws/ Latest Posts Facial Recognition - Is It Possible to Remain Anonymous? - May 26, 2020 DRONES, DRIVING, AND MORE: TECHNOLOGY IN CLAIMS - Nov 19, 2019 Your Insurance Experts Are Retiring. Now What? - Nov 08, 2019 Collecting Biometric Data? Liability May Be Greater Than You Think - Oct 16, 2019 Why Underwriting? - Oct 07, 2019 LOOKING FOR A SOLUTION? ...or Choose a coverage type NEED MORE HELP? SEND US A MESSAGE FIND A BROKER Terms of Use & Important Legal Information Privacy Policy General Re Corporation Genesis Insurance Berkshire Hathaway General Star Management Co. 120 Long Ridge Road, Stamford, CT 06902 (203) 328-5700 More contact info General Star National Insurance Company is licensed in the District of Columbia, Puerto Rico and all states. General Star National Insurance Company has its principal place of business in Stamford, CT and operates under NAIC Number 0031-11967. Insurance is placed with General Star National Insurance Company by licensed producers. General Star Indemnity Company is an eligible surplus lines insurer in all states, the District of Columbia, Puerto Rico, and the Virgin Islands. It has the status of an unlicensed insurer in California and operates under NAIC Number 0031-37362. Insurance is placed with the General Star Indemnity Company by licensed producers and, for risks that qualify, by licensed surplus lines brokers.