10  ILLINOIS BUSINESS LEADER
THE TAKEAWAY
Illinois’ First District Appellate Court 
affirmed a Circuit Court’s decision 
that an insurer has no duty to defend 
its insured in an underlying BIPA 
lawsuit.
INTRODUCTION
The Biometric Information Priva­
cy Act (BIPA or Act) has launched 
hundreds, if not thousands, of 
lawsuits across the state and federal 
courts of Illinois. Some BIPA lawsuits 
have even made their way to other 
states,[1] with some settling for enor­
mous sums.[2] With so many BIPA 
lawsuits, insureds and insurers have 
been asking an important question: 
does an insurance policy provide 
coverage for these BIPA lawsuits?
WHAT IS BIPA?
BIPA establishes safeguards and 
procedures relating to the retention, 
collection, disclosure, and destruc­
tion of biometric data.[3] Passed in 
October 2008, BIPA is intended to 
protect a person’s unique biologi­
cal traits: the data encompassed in 
someone’s fingerprint, voice print, 
retinal scan, or facial geometry. 
Given the sensitivity of this informa­
tion[4] – unlike a stolen credit card, 
there is no replacing or reissuing 
your fingerprint – BIPA provides 
a private right of action for “[a]ny 
person aggrieved by a violation of 
this Act . . . .”[5]
THE EXCLUSION GAME
BIPA establishes that “individuals 
possess a right to privacy in and 
control over their biometric identi­
fiers and biometric information.”[6] 
A lawsuit asserting a violation of this 
right to privacy therefore falls within 
the “personal and advertising inju­
ry” provision of an insurance policy, 
triggering coverage.[7] That much is 
clear. Indeed, it is all but uncontested 
that the underlying BIPA lawsuits at 
issue “allege ‘personal and advertising 
injury.’”[8] Instead, the issue is wheth­
er a policy exception unambiguously 
applies to preclude coverage.[9] 
	
As of December 2023, there 
was no clear answer to this question 
as the federal district courts have 
reached conflicting decisions on this 
important issue,[10] even as to the 
same named insured.[11] This all 
changed with Value Pak.
	
BIPA coverage litigation has 
centered around three specific policy 
exclusions:
1.	 Statutory Violation Exclusion
2.	 Employment-Related Practices 
Exclusion
3.	 Access or Disclosure Exclusion
	
Remarkably, the federal courts 
had failed to reach uniformity with 
respect to any of these exclusions. 
Each separate exclusion found cases 
in support and against coverage. 
Value Pak has now resolved this.
EMPLOYER UPDATE
By Charles Insler
Partner
HeplerBroom LLC
BIPA establishes 
safeguards and 
procedures relating 
to the retention, 
collection, disclosure, 
and destruction of 
biometric data.
February 13, 2024
Posted in Cybersecurity
Is There Insurance Coverage for an Underlying  

View this content as a flipbook by clicking here.