Court Opinion

ID: 4681822
Source: CourtListenerOpinion
Date Created: 2021-04-28 19:04:01.550901+00
Date Added: 2024-06-11T08:04:03.555712
License: Public Domain

Digitally signed
                                                                           by Reporter of
                                                                           Decisions
                                                                           Reason: I attest
                           Illinois Official Reports                       to the accuracy
                                                                           and integrity of
                                                                           this document
                                   Appellate Court                         Date: 2021.04.28
                                                                           09:46:51 -05'00'

           West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc.,
                              2020 IL App (1st) 191834

Appellate Court        WEST BEND MUTUAL INSURANCE COMPANY, Plaintiff-
Caption                Appellant and Cross-Appellee, v. KRISHNA SCHAUMBURG TAN,
                       INC., and KLAUDIA SEKURA, Defendants-Appellees (Krishna
                       Schaumburg Tan, Inc., Cross-Appellant).

District & No.         First District, Sixth Division
                       No. 1-19-1834

Filed                  March 20, 2020

Decision Under         Appeal from the Circuit Court of Cook County, No. 16-CH-7994; the
Review                 Hon. Franklin Ulysses Valderrama, Judge, presiding.

Judgment               Affirmed.

Counsel on             Thomas F. Lucas, Kristin D. Tauras, and Kelly E. Purkey, of McKenna
Appeal                 Storer, of Chicago, for appellant.

                       Ryan D. Andrews, Roger Perlstadt, Benjamin S. Thomassen, and
                       Alexander G. Tievsky, of Edelson PC, of Chicago, for appellee
                       Klaudia Sekura.

                       Richard M. Burgland and Robert Marc Chemers, of Pretzel &
                       Stouffer, Chtrd., of Chicago, for other appellee.
     Panel                     PRESIDING JUSTICE MIKVA delivered the judgment of the court,
                               with opinion.
                               Justices Connors and Harris concurred in the judgment and opinion.

                                               OPINION

¶1        Plaintiff West Bend Mutual Insurance Company (West Bend) appeals from the circuit
      court’s partial grant of summary judgment in favor of defendants—its insured, Krishna
      Schaumburg Tan, Inc. (Krishna), and Klaudia Sekura, who sued Krishna for violating her
      statutory rights to privacy. Krishna sought coverage from West Bend in connection with that
      suit. West Bend agreed to defend Krishna under a reservation of rights, then filed the instant
      case, seeking a declaration that it had no duty to defend or indemnify Krishna. In its partial
      grant of summary judgment for defendants, the circuit court found that West Bend had a duty
      to defend Krishna in the underlying lawsuit. Krishna has also filed a cross-appeal from the
      circuit court’s grant of summary judgment in favor of West Bend on the issue of relief for a
      bad-faith denial of coverage under section 155 of the Insurance Code (215 ILCS 5/155 (West
      2016)). For the following reasons, we affirm the rulings of the circuit court.

¶2                                        I. BACKGROUND
¶3                                           A. The Policies
¶4        The policies relevant to this appeal were issued by West Bend to Krishna, effective
      December 1, 2014, to December 1, 2015, and December 1, 2015, to December 1, 2016
      (policies). Although there are two separate policies, the relevant provisions are identical except
      where noted. Under the “Businessowners Liability Coverage Form,” the policies provided that
      West Bend would pay “those sums that [Krishna] becomes legally obligated to pay as damages
      because of *** ‘personal injury’ *** to which this insurance applies” and that West Bend
      would have a duty to defend Krishna against “any ‘suit’ seeking those damages.” The policies
      further provided that the coverage would apply to “ ‘personal injury’ caused by an offense
      arising out of your business, excluding advertising, publishing, broadcasting or telecasting
      done by or for you.”
¶5        The policies defined “[p]ersonal injury” as:
                  “[I]njury, other than ‘bodily injury,’ arising out of one or more of the following
              offenses:
                                                  ***
                      d. Oral or written publication of material that slanders or libels a person or
                  organization ***; or
                      e. Oral or written publication of material that violates a person’s right of
                  privacy.”
¶6        The policies included an exclusion (violation of statutes exclusion) that provided as
      follows:
                  “EXCLUSION—VIOLATION OF STATUTES THAT GOVERN E-MAILS,
              FAX, PHONE CALLS OR OTHER METHODS OF SENDING MATERIAL OR
              INFORMATION

                                                  -2-
                                                     ***
                   This insurance does not apply to:
                   DISTRIBUTION OF MATERIAL IN VIOLATION OF STATUTES
                   ‘Bodily injury’, ‘property damage’, ‘personal injury’ or ‘advertising injury’ arising
               directly or indirectly out of any action or omission that violates or is alleged to violate:
                       (1) The Telephone Consumer Protection Act (TCPA), including any
                   amendment of or addition to such law; or
                       (2) The CAN-SPAM ACT of 2003, including any amendment of or addition to
                   such law; or
                       (3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM
                   Act of 2003, that prohibits or limits the sending, transmitting, communicating or
                   distribution of material or information.”
¶7         The 2015-16 policy also included an endorsement titled “Illinois Data Compromise
       Coverage” (data compromise endorsement). That endorsement provided “an Additional
       Coverage” for “personal data compromise” under certain conditions. The definition section of
       that endorsement read as follows:
                   7. ‘Personal Data Compromise’ means the loss, theft, accidental release or
               accidental publication of ‘personally identifying information’ or ‘personally sensitive
               information’ as respects one or more ‘affected individuals.’ *** This definition is
               subject to the following provisions:
                                                     ***
                       b. ‘Personal Data Compromise’ includes disposal or abandonment of
                   ‘personally identifying information’ or ‘personally sensitive information’ without
                   appropriate safeguards such as shredding or destruction, subject to the following
                   provisions:
                            1) The failure to use appropriate safeguards must be accidental and not
                       reckless or deliberate.”
¶8         The parties’ arguments focus on these three provisions of the policies: the coverage for
       suits seeking damages for personal injury based on publication of material that violates a right
       to privacy, the violation of statutes exclusion, and the data compromise endorsement.

¶9                                     B. The Underlying Lawsuit
¶ 10       Ms. Sekura filed her proposed class action complaint against Krishna in April 2016,
       alleging in part that Krishna had violated her rights and the rights of those similarly situated
       under the Biometric Information Privacy Act (Act) (740 ILCS 14/1 et seq. (West 2014)).
       According to Ms. Sekura’s complaint, Krishna is an Illinois corporation and a franchisee of
       L.A. Tan Enterprises, Inc. Ms. Sekura alleged that when someone first purchases a service at
       Krishna, that customer is enrolled in the L.A. Tan national membership database to allow them
       to use their membership at any L.A. Tan location. Ms. Sekura further alleged that “Krishna
       Tan’s customers are required to have their fingerprints scanned” for the purpose of verifying
       their identification. Ms. Sekura alleged that she signed up for a membership with Krishna in
       April 2015, that she was enrolled by Krishna in the L.A. Tan corporate membership database
       at that time, and that Krishna required her to provide a scan of her fingerprint. Ms. Sekura

                                                    -3-
       further stated that she was never provided with, nor signed, a written release allowing Krishna
       to disclose her biometric data to any third party.
¶ 11       Ms. Sekura alleged that Krishna violated the Act by, among other things, disclosing her
       fingerprint data to an out-of-state third-party vendor, SunLync, without her consent in violation
       of section 15(d)(1) of the Act (740 ILCS 14/15(d)(1) (West 2014)).
¶ 12       Ms. Sekura alleged three claims in total: (1) violation of the Act, for which she sought an
       injunction, statutory damages, and attorney fees; (2) unjust enrichment, for which she sought
       restitution; and (3) negligence based on Krishna’s violation of the Act, for which she sought
       damages for mental anguish and mental injury.

¶ 13                                       C. Procedural History
¶ 14       On June 14, 2016, West Bend filed its complaint for declaratory judgment against Krishna
       and Ms. Sekura. According to the complaint, Krishna tendered Ms. Sekura’s complaint to West
       Bend, seeking a defense and indemnity under its policies, and West Bend agreed to defend
       Krishna under a reservation of rights. West Bend then sought a declaration that it had no such
       duties. West Bend argued that Ms. Sekura’s lawsuit was not covered by the policies either
       because (1) her underlying allegations did not describe an “advertising injury” or a “personal
       injury,” (2) her allegations did not qualify for coverage under the data compromise
       endorsement, and (3) in the alternative, coverage for the underlying lawsuit was barred by the
       policies’ violation of statutes exclusion.
¶ 15       On January 18, 2017, Krishna filed an answer and counterclaim in response to West Bend’s
       complaint. In the counterclaim, Krishna sought a declaration that West Bend had a duty to
       defend it in the underlying lawsuit and also counterclaimed for attorney fees under section 155
       of the Insurance Code (215 ILCS 5/155 (West 2016)). The counterclaim alleged that Ms.
       Sekura’s complaint “clearly create[d] the potential that West Bend ha[d] an obligation to
       provide a defense to Krishna,” that West Bend’s argument to the contrary had no good faith
       basis in law or fact, and that West Bend’s refusal to recognize its obligation to defend Krishna
       was vexatious and unreasonable.
¶ 16       In the fall of 2017, the parties filed cross-motions for summary judgment. Following a
       hearing on those motions, on May 14, 2018, the circuit court issued a 22-page written order.
       The court denied West Bend’s motion in part and granted Krishna’s motion in part, finding
       that West Bend had a duty to defend Krishna against Ms. Sekura’s claims. The circuit court
       found that those claims fell within the policies’ coverage for “personal injury” as a “publication
       which violates a person’s right to privacy” and that the noted exclusion did not preclude
       coverage. The court declined to reach the issue of whether the endorsement applied.
¶ 17       The circuit court denied Krishna’s motion for summary judgment with respect to its request
       for damages pursuant to section 155 of the Insurance Code and granted West Bend’s motion
       for summary judgment on this counterclaim, finding that “Krishna’s bare assertion that West
       Bend ha[d] engaged in what constitute[d] a ‘capricious’ denial of coverage [wa]s insufficient
       to meet the [s]ection 155 standard.”

¶ 18                                      II. JURISDICTION
¶ 19      West Bend appealed, and Krishna cross-appealed. Initially, this court dismissed those
       appeals for a lack of jurisdiction because the case was still pending relative to the duty to

                                                   -4-
       indemnify. On August 28, 2019, the circuit court granted West Bend’s request for a finding
       under Illinois Supreme Court Rule 304(a) (eff. Mar. 8, 2016) that there was no just reason to
       delay enforcement or appeal of its orders dated May 14, 2018. On September 9, 2019, West
       Bend filed its notice of appeal from the circuit court’s orders of May 14, 2018. Krishna filed
       its notice of cross-appeal from the same orders on the same day. We thus have jurisdiction
       pursuant to Rule 304(a).

¶ 20                                         III. ANALYSIS
¶ 21       This case was resolved in the circuit court on cross-motions for summary judgment.
       “Summary judgment is appropriate when there is no genuine issue of material fact and the
       moving party is entitled to judgment as a matter of law.” Virginia Surety Co. v. Northern
       Insurance Co. of New York, 224 Ill. 2d 550, 556 (2007). We review de novo a circuit court’s
       rulings on cross-motions for summary judgment. A.B.A.T.E. of Illinois, Inc. v. Quinn, 2011 IL
       110611, ¶ 22. This is also our standard of review here because this case turns on interpreting
       the policies, which is a question of law that we always review de novo. Travelers Insurance
       Co. v. Eljer Manufacturing, Inc., 197 Ill. 2d 278, 292 (2001).

¶ 22                                      A. West Bend’s Appeal
¶ 23       In its appeal, West Bend argues that the court erred in finding it had a duty to defend
       Krishna because (1) the allegations in the underlying complaint do not come within the
       policies’ definition of “personal injury,” (2) even if the allegations in the underlying complaint
       do allege a “personal injury,” the violation of statutes exclusion applies to bar coverage, and
       (3) the data compromise endorsement is inapplicable to the underlying allegations.
¶ 24       In response, Krishna and Ms. Sekura argue that the circuit court’s finding a duty to defend
       was proper because (1) the underlying allegations do potentially fall under the policies’
       definition of “personal injury,” (2) the violation of statutes exclusion does not apply, and
       (3) the data compromise endorsement does apply and also provides coverage. Because the
       issue of the duty to defend can be resolved based on the first two issues, we do not reach this
       third issue on West Bend’s appeal.

¶ 25                     1. The Underlying Complaint Alleged a Personal Injury
¶ 26       We first consider whether the allegations in Ms. Sekura’s complaint potentially come
       within the policies’ definition of “personal injury.” “Because an insurance policy is a contract,
       the rules applicable to contract interpretation govern the interpretation of an insurance policy.”
       Founders Insurance Co. v. Munoz, 237 Ill. 2d 424, 433 (2010). The court’s primary objective
       in interpreting an insurance policy is “to ascertain and give effect to the intentions of the parties
       as expressed by the language of the policy.” Valley Forge Insurance Co. v. Swiderski
       Electronics, Inc., 223 Ill. 2d 352, 362 (2006). “To determine whether an insurer has a duty to
       defend its insured from a lawsuit, a court must compare the facts alleged in the underlying
       complaint to the relevant provisions of the insurance policy” and the allegations “must be
       liberally construed in favor of the insured.” Id. at 363. If the underlying allegations “fall within,
       or potentially within, the policy’s coverage, the insurer is obligated to defend its insured.” Id.
¶ 27       West Bend’s policies provided that West Bend would defend Krishna in a lawsuit that
       alleged a “personal injury,” which the policies defined as “injury, other than ‘bodily injury,’

                                                     -5-
       arising out of *** oral or written publication of material that violates a person’s right of
       privacy.” The parties argue, and we agree, that whether West Bend has a duty to defend
       specifically turns on the meaning of “publication” in the policies.
¶ 28        In the underlying complaint, Ms. Sekura alleged that Krishna violated the Act by providing
       her fingerprint data to a single third-party vendor, SunLync. The parties agree that this is the
       allegation that could potentially be considered “publication.” The policies do not define the
       term “publication.” “Undefined terms will be given their plain, ordinary and popular meaning,
       i.e., they will be construed with reference to the average, ordinary, normal, reasonable person.”
       Gillen v. State Farm Mutual Automobile Insurance Co., 215 Ill. 2d 381, 393 (2005). “If the
       policy language is susceptible to more than one reasonable meaning, it is considered
       ambiguous and will be construed against the insurer.” Id.
¶ 29        West Bend relies on our supreme court’s decision in Valley Forge to support its argument
       that “publication” requires communication of information to the public at large, not simply a
       single third party, and that Ms. Sekura’s allegation therefore does not charge Krishna with a
       “publication.” We reject West Bend’s argument that in Valley Forge our supreme court
       “defined” “publication” in the narrow manner that West Bend contends is controlling.
¶ 30        The underlying plaintiff in Valley Forge brought a proposed class action lawsuit against
       the insured for violating the Telephone Consumer Protection Act of 1991 (TCPA) (47 U.S.C.
       § 227 et seq. (2000)) by faxing advertisements to the proposed plaintiffs “without first
       obtaining the recipients’ permission to do so.” Valley Forge, 223 Ill. 2d at 355. The insurers
       argued that they had no duty to defend the insured in the underlying lawsuit because the claims
       in that lawsuit were not covered by their policies as an “advertising injury.” Id. at 358. The
       policies defined an “advertising injury” as “written *** publication *** of material that
       violates a person’s right of privacy.” (Internal quotation marks omitted.) Id. at 364.
¶ 31        The circuit and appellate courts found that the insurers had a duty to defend. Valley Forge
       Insurance Co. v. Swiderski Electronics, Inc., 359 Ill. App. 3d 872, 875 (2005). Before the
       appellate court, the parties argued about the definition of “publication,” specifically with
       respect to what scope of distribution was required. The insurers argued that “ ‘publication’ in
       the context of the polic[ies] require[d] injurious communication to a third party,” not simply
       an injurious communication to the party itself. Id. at 885.
¶ 32        On appeal, our supreme court also looked to the dictionary definitions of the term
       “publication.” The court acknowledged that the insurers had “abandoned” their argument that
       the underlying allegations “did not constitute ‘publication,’ ” but decided to discuss the issue
       nonetheless:
                “[I]n the interest of coherently interpreting all the relevant terms of the ‘advertising
                injury’ provision, we observe that [the underlying] complaint alleges conduct by [the
                insured] that amounted to ‘publication’ in the plain and ordinary sense of the word. By
                faxing advertisements to the proposed class of fax recipients as alleged in [the
                underlying] complaint, [the insured] published the advertisements in both the general
                sense of communicating information to the public and in the sense of distributing copies
                of the advertisements to the public.” Id. at 367.
¶ 33        West Bend seizes on this communicating “to the public” language in Valley Forge to argue
       that our supreme court conclusively “defined ‘publication’ to mean the communication or
       distribution of information to the public.” Putting aside whether the discussion in Valley Forge
       is a holding or is mere dicta, it is clear to us that the supreme court did not define the term

                                                   -6-
       “publication” as being limited to requiring communication to any number of persons. Rather,
       the court recognized that “publication” included the actions alleged in the underlying
       complaint—sending numerous unsolicited faxes to the plaintiffs in the underlying case. Our
       supreme court specifically recognized that the complaint in the underlying case alleged a
       violation of the “fax recipient’s privacy interest in seclusion” and that there was “publication”
       by “faxing advertisements to the proposed class of fax recipients.” Id. at 366-67.
¶ 34        As the circuit court observed in this case, both the appellate and supreme courts in Valley
       Forge looked to what a reasonable person would understand the plain, ordinary meaning of
       the word “publication” to be and consulted dictionary definitions and common understanding.
       Id. at 367; Valley Forge, 359 Ill. App. 3d at 885. As our supreme court recognized in Valley
       Forge, where policy terms are not defined, the courts must give them their “plain, ordinary,
       and popular meanings,” consulting “dictionary definitions.” Valley Forge, 223 Ill. 2d at 366
       (citing Outboard Marine Corp. v. Liberty Mutual Insurance Co., 154 Ill. 2d 90, 115-17 (1992)).
¶ 35        Common understandings and dictionary definitions of “publication” clearly include both
       the broad sharing of information to multiple recipients that the court viewed a “publication” in
       Valley Forge and a more limited sharing of information with a single third party. The Oxford
       English Dictionary, for example, defines “publication” as both “[t]he action of making
       something publicly known” and “Law. Notification or communication to a third party or to a
       limited number of people regarded as representative of the public.” Oxford English Dictionary
       (3d ed. 2007). Black’s Law Dictionary defines “publication” as “[g]enerally, the act of
       declaring or announcing to the public” and, in the defamation context, as “communication of
       defamatory words to someone other than the person defamed” and says specifically that “ ‘[a]
       letter sent to a single individual is sufficient.’ ” Black’s Law Dictionary (11th ed. 2019)
       (quoting Rollin M. Perkins & Ronald N. Boyce, Criminal Law 489 (3d ed. 1982)).
¶ 36        To the extent that West Bend suggests that “publication” means something different in the
       context of defamation than it does in the context of privacy rights, the policies use the exact
       same terminology of “[o]ral or written publication of material” as the basis for both a
       defamation-related injury and a privacy-related injury. These two definitions are immediately
       sequential in the policies. When construing insurance policies, “ ‘it is a general rule that absent
       language to the contrary, a word or phrase in one part is presumed to have the same meaning
       when it is used in another part of a policy.’ ” Universal Underwriters Insurance Co. v. LKQ
       Smart Parts, Inc., 2011 IL App (1st) 101723, ¶ 19 (quoting Hartford Accident & Indemnity
       Co. v. Case Foundation Co., 10 Ill. App. 3d 115, 123 (1973)). This should be particularly true
       where, as here, the two policy provisions are in the same section of the policies.
¶ 37        We also note that if West Bend wished the term “publication” to be limited to
       communication of information to a large number of people, it could have explicitly defined it
       as such in its policy. But it did not, choosing instead not to provide any definition of
       “publication.” “There is a strong presumption against provisions that easily could have been
       included in the contract but were not.” Wright v. Chicago Title Insurance Co., 196 Ill. App. 3d
       920, 925 (1990).
¶ 38        The parties do not dispute that Ms. Sekura alleges facts that fit within the rest of the
       “personal injury” definition—that there was a provision of material in violation of her right to
       privacy. Because a common understanding of “publication” encompasses Krishna’s act of
       providing Ms. Sekura’s fingerprint data to a third party, there also exists potential that Ms.
       Sekura’s claim against Krishna is covered by the policies. As such, West Bend has a duty to

                                                    -7-
       defend Krishna against the underlying complaint pursuant to the “personal injury” coverage
       provision.

¶ 39                2. The Violation of Statutes Exclusion Does Not Apply to Bar Coverage
¶ 40        West Bend next argues that, even if we find Ms. Sekura’s allegations come within the
       “personal injury” provision of the policies, coverage is barred by the violation of statutes
       exclusion. This exclusion specifically bars coverage for personal injuries “arising directly or
       indirectly out of any action or omission that violates or is alleged to violate” the TCPA, the
       CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq. (2012)), or “[a]ny statute, ordinance or
       regulation *** that prohibits or limits the sending, transmitting, communication or distribution
       of material or information.”
¶ 41        West Bend argues that this exclusion applies because the Act is a statute that “prohibits or
       limits the sending *** of material or information.” West Bend relies on section 15(d) of the
       Act, which provides that “[n]o private entity in possession of a biometric identifier or biometric
       information may disclose, redisclose, or otherwise disseminate a person’s or a customer’s
       biometric identifier or biometric information unless” at least one of four specific conditions
       are met. 740 ILCS 14/15(d) (West 2014). West Bend claims that “[t]he only way to read” this
       section is that it “limits or prohibits the communication of biometric information unless the
       conditions set forth therein are met.”
¶ 42        The violation of statutes exclusion read in its entirety makes clear, however, that it was not
       intended to bar coverage for a violation of a statute like the Act. In fact, the exclusion is meant
       to bar coverage for the violation of a very limited type of statute that is evidenced first from
       the exclusion’s title, which West Bend conveniently shortens to “Violation of Statutes.” The
       title, as a whole, is: “Violation of Statutes That Govern E-Mails, Fax, Phone Calls or Other
       Method of Sending Material or Information.” (Emphasis added.) The title makes clear that the
       exclusion applies to statutes that govern certain methods of communication, i.e., e-mails, faxes,
       and phone calls, not to other statutes that limit the sending or sharing of certain information.
¶ 43        The text of the exclusion can easily be read consistently with the title. The exclusion
       explicitly applies to the TCPA and the CAN-SPAM Act—both statutes that regulate certain
       methods of communication. See, e.g., Standard Mutual Insurance Co. v. Lay, 2013 IL
       114617, ¶ 27 (“The purposes of the TCPA are to protect the privacy interests of residential
       telephone customers by restricting unsolicited automated telephone calls to the home, and
       facilitating interstate commerce by restricting certain uses of fax machines and automatic
       dialers.”); Martin v. CCH, Inc., 784 F. Supp. 2d 1000, 1004 (N.D. Ill. 2011) (noting that the
       purpose of the CAN-SPAM Act is to, in part, “ ‘prohibit senders of [e-mail] for primarily
       commercial advertisement or promotional purposes from deceiving intended recipients or
       Internet service providers as to the source or subject matter of their e-mail messages’ ” (quoting
       S. Rep. No. 108-102, at 1 (2003), as reprinted in 2004 U.S.C.C.A.N. 2348, 2348). So only
       after listing two specific statutes—the violation of which the exclusion applies to—each with
       a clear purpose of governing methods of communication such as e-mails and phone calls, does
       the exclusion include a final catch-all provision for a statute “that prohibits or limits the
       sending, transmitting, communication or distribution of material or information.” In light of
       the title and the two specific statutes listed in the exclusion, the more reasonable reading of
       this third item is that it is meant to encompass any State or local statutes, rules, or ordinances
       that, like the TCPA and the CAN-SPAM Act, regulate methods of communication.

                                                    -8-
¶ 44       We are also unconvinced by West Bend’s argument that the exclusion was meant to apply
       to statutes that “lend themselves to class action litigation [and] pose serious insurance risks.”
       Nothing in the exclusion’s language suggests that was the purpose of the exclusion; if West
       Bend wanted the exclusion to have such an application, it could have written it so. As we stated
       above, “[t]here is a strong presumption against provisions that easily could have been included
       in the contract but were not.” Wright, 196 Ill. App. 3d at 925.
¶ 45       In short, the violation of statutes exclusion applies to bar coverage to violations of statutes
       that regulate methods of communication. The Act says nothing about methods of
       communication. It instead regulates “the collection, use, safeguarding, handling, storage,
       retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g) (West
       2014). As Ms. Sekura’s complaint alleges a violation of the Act, this exclusion does not apply
       to bar coverage to Krishna.

¶ 46                3. We Need Not Reach the Data Compromise Endorsement Issue
¶ 47       Because Ms. Sekura’s allegations against Krishna potentially fall within the policies’
       definition of “personal injury” and the violation of statutes exclusion does not apply to bar
       coverage, we need not consider whether the data compromise endorsement would also provide
       coverage. West Bend has a duty to defend Krishna against Ms. Sekura’s lawsuit, and the circuit
       court correctly granted summary judgment in favor of defendants on that issue.

¶ 48                                     B. Krishna’s Cross-Appeal
¶ 49       On cross-appeal, Krishna argues that the circuit court erred in finding that West Bend did
       not violate section 155 of the Insurance Code (215 ILCS 5/155 (West 2016)). Initially, the
       parties disagree about the standard of review on this issue. Krishna argues that we should
       review this issue de novo, while West Bend argues that an abuse of discretion standard should
       be used. As we recently recognized in Evergreen Real Estate Service, LLC v. Hanover
       Insurance Co., 2019 IL App (1st) 181867, ¶¶ 34-35, Illinois courts have used both standards
       in reviewing section 155 rulings. See id. (and cases cited therein). Like the Evergreen court,
       however, we need not decide which standard of review is appropriate because, here, under
       either standard, we find the circuit court did not err in denying Krishna’s request for relief
       under section 155.
¶ 50       Section 155 provides “that an insured may collect attorney fees and costs where an insurer
       creates a ‘vexatious and unreasonable’ delay in settling a claim.” Illinois Founders Insurance
       Co. v. Williams, 2015 IL App (1st) 122481, ¶ 31 (quoting 215 ILCS 5/155(1) (West 2010)).
       When deciding whether an insurer’s conduct was vexatious and unreasonable, “[a] court
       should consider the totality of the circumstances” “including the insurer’s attitude, whether the
       insured was forced to sue to recover, and whether the insured was deprived of the use of his
       property.” (Internal quotation marks omitted.) Id. But where a bona fide coverage dispute
       exists, section 155 costs and sanctions are inappropriate. Id. ¶ 32. A bona fide dispute “is one
       that is real, actual, genuine, and not feigned.” (Internal quotation marks omitted.) Id. If an
       insurer reasonably relied upon such a bona fide dispute, that insurer did not act vexatiously or
       unreasonably. Id.
¶ 51       On appeal, Krishna only argues for section 155 damages based on the data compromise
       endorsement, apparently conceding that West Bend’s other defenses to coverage, while not

                                                    -9-
       successful, were bona fide. Neither the circuit court nor this court have considered the issue of
       whether coverage is even available under the endorsement.
¶ 52        Under the endorsement, coverage is provided for a civil suit based on a “personal data
       compromise.” The endorsement defines “personal data compromise” as “the loss, theft,
       accidental release or accidental publication of ‘personally identifying information’ or
       ‘personally sensitive information.’ ” The endorsement also provides that “personal data
       compromise” “includes disposal or abandonment of ‘personally identifying information’ or
       ‘personally sensitive information’ without appropriate safeguards such as shredding or
       destruction.” The endorsement also states that “[t]he failure to use appropriate safeguards must
       be accidental and not reckless or deliberate.” The endorsement does not define “accidental,”
       but the parties point out that the term “accident” has been consistently defined by Illinois courts
       as “an unforeseen occurrence.” Aetna Casualty & Surety Co. v. Freyer, 89 Ill. App. 3d 617,
       619 (1980).
¶ 53        Krishna now argues that there is no bona fide defense to coverage under this endorsement.
       Krishna’s articulation as to why the endorsement provides coverage was not put forward until
       its reply brief on the cross-appeal. For that reason alone, we could disregard it. See Ill. S. Ct.
       R. 341(h)(7) (“points not argued are forfeited and shall not be raised in the reply brief”). We
       choose to address this argument, as forfeiture is a limitation on the parties, not on the court.
       City of Highland Park v. Bryan, 2019 IL App (2d) 180662, ¶ 19. But we note that Krishna’s
       delay in articulating this understanding of the endorsement undermines any suggestion this is
       an obvious and irrefutable interpretation of the endorsement.
¶ 54        Krishna’s argument for coverage under the endorsement is that Ms. Sekura’s complaint
       alleges a “personal data compromise” by “disposal” of Ms. Sekura’s personally identifying or
       personally sensitive information to SunLync without appropriate safeguards. According to
       Krishna, the appropriate “safeguards” would have been following the data protection
       requirements of the Act, and the complaint alleges that the negligent failure to take note of
       changes in the law was “accidental.”
¶ 55        Krishna’s interpretation of the endorsement hinges on an interpretation of disposal as
       including the deliberate sharing of Ms. Sekura’s data with SunLync. It also would require an
       interpretation that “safeguards such as shredding or destruction” includes following new legal
       requirements. A court would have to also find that “accidental” means the failure to keep up
       on the law. None of these interpretations are necessarily correct and West Bend has compelling
       arguments to the contrary.
¶ 56        For example, West Bend argues that there is nothing in Ms. Sekura’s complaint that
       suggests that the lack of safeguards in this transfer of her biometric information was
       “accidental.” Instead, as West Bend points out, Krishna was alleged to have collected and used
       Ms. Sekura’s biometric data as part of its membership program, and thus, there was nothing
       “unforeseen” about it. Certainly, keeping up on the law is different than shredding or
       destroying confidential data so it is not at all clear that following the Act is a “safeguard” in
       the sense that word is used in the endorsement. In short, there is nothing in this interpretation
       that is so compelling that it renders West Bend’s defense frivolous or without merit. It is clear
       to us that West Bend has a bona fide argument for why the endorsement does not apply.
       Therefore, fees, costs, and damages under section 155 are not appropriate.

                                                   - 10 -
¶ 57                                         IV. CONCLUSION
¶ 58       Ms. Sekura’s allegations that Krishna violated the Act when it provided her fingerprint data
       to a third party potentially fall within the policies’ definition of “personal injury,” and Krishna
       is not barred from coverage by the violation of statutes exclusion. West Bend thus has a duty
       to defend Krishna in the underlying lawsuit. Additionally, there is a bona fide dispute as to
       whether Krishna would be entitled to coverage under the data compromise endorsement;
       therefore, Krishna is not entitled to damages under section 155 of the Insurance Code. We
       affirm the judgment of the circuit court—both in granting summary judgment in favor of
       defendants on the duty to defend issue and in favor of West Bend on the section 155 issue.

¶ 59      Affirmed.

                                                   - 11 -