IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
AMERICAN FAMILY MUTUAL, ) INSURANCE COMPANY, S.I. and ) AUSTIN MUTUAL INSURANCE ) COMPANY, ) ) Plaintiffs, ) ) No. 20 C 3665 v. ) ) Judge John Z. Lee CARNAGIO ENTERPRISES, ) INC., an Illinois corporation, ) and ANGELA KARIKARI, ) individually and on behalf of all ) others similarly situated, ) ) Defendants. )
MEMORANDUM OPINION AND ORDER
Defendant Carnagio Enterprises, Inc. (“Carnagio”), is a McDonald’s franchisee insured by both Plaintiff American Family Mutual Insurance Company, S.I. (“American Family”) and Plaintiff Austin Mutual Insurance Company (“Austin Mutual”) (collectively “Plaintiffs”). In early 2019, Defendant Angela Karikari (“Karikari”) filed a class action lawsuit against Carnagio, alleging violations of Illinois’s Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1 et seq. (“BIPA”). Carnagio informed the insurance companies of the lawsuit and requested coverage.1
1 Although Plaintiffs initially raised a notice argument as part of their motion for summary judgment, they have since withdrawn that argument on the record. See ECF No. 86. The Court notes that the exact date of notice is disputed and any arguments as to notice are irrelevant for the purposes of this decision. To the extent summary judgment is granted to either party in this decision, it should be understood as ruling only on the interpretation of the exclusions invoked by Plaintiffs. Plaintiffs then brought this suit, seeking a declaratory judgment that violations of BIPA are excluded under the policies they had issued to Carnagio. As a result, Plaintiffs contend that they have no duty to defend Carnagio in Karikari’s suit.
This Court now addresses the parties’ cross-motions for summary judgment. For the reasons stated below, Plaintiffs’ motion for summary judgment is granted in part and denied in part, and Karikari’s motion for summary judgment is granted. I. Background2 A. Carnagio’s Insurance Policies Carnagio operates thirteen McDonald’s restaurant franchises in Illinois. Pls.’ Statement Material Fact (“PSOF”) ¶ 31, ECF No. 76. From March 1, 2015, to March
1, 2020, all of Carnagio’s McDonald’s locations were insured under policies issued by American Family. Id. ¶¶ 7–11. From March 1, 2020 to March 1, 2021, Carnagio’s restaurants were covered under Businessowners’ Liability Insurance policies issued by Austin Mutual. Id. ¶ 12. Each of these policies promises coverage for “the sums that the insured becomes legally obligated to pay as damages because of ‘bodily injury’, ‘property damage’ or ‘personal and advertising injury’ to which this insurance
applies.” Id. ¶ 15. The policies further acknowledge that American Family and Austin Mutual have a duty to defend Carnagio “against any ‘suit’ seeking damages for” those covered harms. Id. The policies define “personal and advertising injury” as: [Any] injury, including consequential “bodily injury”, arising out of one or more of the following offenses:
2 The following facts are undisputed or deemed admitted, unless otherwise noted. a. False arrest, detention or imprisonment;
b. Malicious prosecution;
c. The wrongful eviction from, wrongful entry into, or invasion of the right of private occupancy of a room, dwelling or premises that a person occupies, committed by or on behalf of its owner, landlord or lessor;
d. Oral or written publication, in any matter, of material that slanders or libels a person or organization or disparages a person’s or organization’s goods, products or services;
e. Oral or written publication, in any manner, of material that violates a person’s right of privacy;
f. The use of another’s advertising idea in your “advertisement”; or
g. Infringing upon another’s copyright, trade dress or slogan in your “advertisement”. Id. ¶ 19. The policies also contain identical exclusion provisions, entitled “Employment- Related Practices” (“ERP exclusion”) and “Distribution Of Material In Violation Of Statutes” (“Statutory Violation exclusion”) Id. ¶¶ 22–23. The ERP exclusion states, in relevant part: This insurance does not apply to:
a. “Bodily injury” or ‘‘personal and advertising injury” to:
i. A person arising out of any:
1. Refusal to employ that person;
2. Termination of that person’s employment; or
3. Employment-related practices, policies, acts or omissions, such as coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation or discrimination directed at that person . . . .
b. This exclusion applies:
i. Whether the insured may be liable as an employer or in any other capacity; and
ii. To any obligation to share damages with or repay someone else who must pay damages because of the injury. Id. ¶ 22. In turn, the Statutory Violation exclusion states:
This insurance does not apply to:
Distribution Of Material In Violation Of Statutes
“Bodily injury”, “property damage”, or “personal and advertising injury” arising directly or indirectly out of any action or omission that violates or is alleged to violate:
(1) The Telephone Consumer Protection Act (TCPA), including any amendment or addition to such law; or
(2) The CAN-SPAM Act of 2003, including any amendment of or addition to such law; or
(3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information. Id. ¶ 23. Additionally, the Austin Mutual policy includes an exclusion dealing with access to or disclosure of confidential or personal information (“Access/Disclosure exclusion”). The exclusion provides, in relevant part: This insurance does not apply to:
[] Access Or Disclosure Of Confidential Or Personal Information And Data-related Liability (1) Damages, other than damages because of “personal and advertising injury”, arising out of any access to or disclosure of any person’s or organization’s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information, or any other type of nonpublic information, or
(2) Damages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data. Id. ¶ 24. B. The Underlying Lawsuit Karikari alleges that she worked at one of Carnagio’s McDonald’s restaurants starting in 2017. Id. ¶ 38. According to her, Carnagio required her to clock in and out of each shift using a fingerprint scanner. Id. ¶ 35. Despite its use of fingerprints for timekeeping and identification, Karikari claims, Carnagio never informed “its employees of the complete purposes for which it collects their sensitive biometric data or to whom the data is disclosed if at all”; never gave its employees “a written, publicly available policy identifying its retention schedule, and guidelines for permanently destroying its employees’ fingerprints”; and never had her sign a release allowing Carnagio to collect her fingerprints. Id. ¶¶ 36–37, 43. In March 2019, Karikari filed a lawsuit against Carnagio in state court for violating provisions of BIPA. Id. ¶ 27. See 740 Ill. Comp. Stat. 14/20. And Carnagio tendered notice of the lawsuit to the insurance companies. Plaintiffs then filed this lawsuit, seeking a declaratory judgment that they have no duty to defend Carnagio against Karikari’s claims in state court. II. Legal Standard Summary judgment is appropriate where “the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a
matter of law.” Fed. R. Civ. P. 56(a). The evidence considered for summary judgment “must be admissible if offered at trial, except that affidavits, depositions, and other written forms of testimony can substitute for live testimony.” Malin v. Hospira, Inc., 762 F.3d 552, 554–55 (7th Cir. 2014). On cross-motions for summary judgment, the court “view[s] the facts and draw[s] reasonable inferences in favor of ‘the party against whom the motion at issue was made.’” Woodring v. Jackson Cnty., 986 F.3d 979, 984 (7th Cir. 2021) (quoting Tripp v. Scholz, 872 F.3d 857, 862 (7th Cir. 2017)).
The moving party has the initial burden of demonstrating the absence of a genuine issue of material fact. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). The nonmoving party must then “come forward with specific facts showing that there is a genuine issue for trial.” LaRiviere v. Bd. of Trs. of S. Ill. Univ., 926 F.3d 356, 359 (7th Cir. 2019) (quoting Spierer v. Rossman, 798 F.3d 502, 507 (7th Cir. 2015)). To satisfy that ultimate burden, the nonmoving party must “do more than simply show
that there is some metaphysical doubt as to the material facts,” Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 586 (1986), and instead must “establish some genuine issue for trial such that a reasonable jury could return a verdict in her favor,” Gordon v. FedEx Freight, Inc., 674 F.3d 769, 772–73 (7th Cir. 2012); see also Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986) (“[S]ummary judgment will not lie . . . if the evidence is such that a reasonable jury could return a verdict for the nonmoving party.”). III. Analysis
As a preliminary matter, the parties agree that Illinois law applies. See Pls.’ Mem. Supp. Mot. Summ. J. at 5, ECF No. 70; Def. Karikari Resp. Opp’n Pls.’ Mot. Summ. J. at 2, ECF No. 75; Def. Carnagio Resp. Opp’n Pls.’ Mot. Summ. J. at 2 (“Carnagio Resp.”), ECF No. 77. Furthermore, the parties have not conducted discovery in this case, and all facts relevant to the cross-motions are undisputed. Accordingly, the Court turns to the question at hand, namely, whether any of Carnagio’s insurance policies provide coverage for the defense of Karikari’s lawsuit.
See Roman Cath. Diocese of Springfield v. Md. Cas. Co., 139 F.3d 561, 565 (7th Cir. 1998) (“Illinois law . . . treats the interpretation of an insurance policy and the respective rights and obligations of the insurer and the insured as questions of law that the court may resolve summarily.”). To answer this question, the Court must look to the language of the insurance policies. “The goal in interpreting an insurance policy is to ascertain and give effect
to the intention of the parties, as expressed in the policy language.” Scottsdale Ins. Co. v. Columbia Ins. Grp., Inc., 972 F.3d 915, 919 (7th Cir. 2020) (cleaned up). Furthermore, under Illinois law, “insurance policies are to be liberally construed in favor of coverage, and where an ambiguity exists in the insurance contract, it will be resolved in favor of the insured and against the insurer.” United Servs. Auto. Ass’n v. Dare, 830 N.E.2d 670, 678 (Ill. App. Ct. 2005). At the same time, policy language is not ambiguous “simply because the parties disagree as to its meaning[,]” and the court should not “strain to find an ambiguity where none exists.” Founders Ins. Co. v. Munoz, 930 N.E.2d 999, 1004 (Ill. 2010).
When seeking coverage, “[a]n insured has the burden of proving that a claim falls within the coverage of the policy. . . . Once the insured satisfies this burden, the insurer has the burden of proving that the loss was limited or excluded by a contract provision.” Travelers Pers. Ins. Co. v. Edwards, 48 N.E.3d 298, 303 (Ill. App. Ct. 2016). What is more, “[a]n insurer can only refuse to defend if the allegations of the underlying complaint preclude any possibility of coverage.” Ill. Tool Works, Inc. v. Travelers Cas. & Sur. Co., 26 N.E.3d 421, 428 (Ill. App. Ct. 2015). But a single
unequivocal exclusion is sufficient to show that an insurer does not have a duty to defend the insured. See, e.g., Hartford Cas. Ins. Co. v. Dental USA, Inc., No. 13 C 7637, 2014 WL 2863164, at *4 (N.D. Ill. June 24, 2014) (applying Illinois law). Finally, to “determine whether the insurer’s duty to defend has arisen, the court must compare the allegations of the underlying complaint to the policy language.” Id. “If the court determines that these allegations fall within, or
potentially within, the policy’s coverage, the insurer has a duty to defend the insured against the underlying complaint.” Metzger v. Country Mut. Ins. Co., 986 N.E.2d 756, 761 (Ill. App. Ct. 2013) (internal quotation marks omitted). In this case, all parties agree that a lawsuit arising under BIPA constitutes a claim asserting a “personal injury” that triggers coverage under Carnagio’s policies.3
3 In light of a recent Supreme Court of Illinois decision on the matter, Plaintiffs could not reasonably argue otherwise. See W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, The dispute is whether any of the exclusions in the policies operate to preclude coverage for Karikari’s lawsuit. A. ERP Exclusion
Plaintiffs first contend that the ERP exclusion precludes coverage because “[t]he BIPA violations alleged in the Underlying Complaint unquestionably arise out of the employment relationship and occurred while [Karikari] and the other employees . . . were performing the work-related duty of using a biometric time clock to record their hours.” Pls.’ Mem. Law Supp. Summ. J. (“Pls.’ Mem.”) at 7, ECF No. 70. Not surprisingly, Defendants disagree. While Illinois courts have not yet addressed whether BIPA claims are
unambiguously excluded by the ERP exclusion, courts in this district are split on the issue. Compare Am. Fam. Mut. Ins. Co. v. Caremel, Inc., No. 20 C 637, 2022 WL 79868, at *4 (N.D. Ill. Jan. 7, 2022) (“[A] BIPA violation is of the same nature as the exemplar employment-related practices listed in the Policy. Each of ‘coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation’ reflect a practice that can cause an individual harm to an employee.”),
with State Auto. Mut. Ins. Co. v. Tony’s Finer Foods Enters., Inc., No. 20-CV-6199, 2022 WL 683688, at *7 (N.D. Ill. Mar. 8, 2022) (holding that scanning employees’ fingerprints is “categorically different” from the practices listed in the exclusion). And some courts outside of this district have found the language in the provision
Inc., ___ N.E.3d ____, 2021 WL 2005464, at *8 (May 20, 2021) (finding a violation of BIPA to be a potential violation of a person’s “right to privacy,” and bringing it within the definition of “personal injury” for insurance purposes). ambiguous, thereby finding a duty to defend. See, e.g., Perkins v. Md. Cas. Co., 388 F. App’x 641, 643 (9th Cir. 2010) (holding that it was unclear whether the ERP exclusion covered claims of false imprisonment against an employer).
With this background, the Court starts with the language of the ERP exclusion. In relevant part, it excludes coverage for ‘‘personal and advertising injury” to a person arising out of “any” (1) “refusal to employ that person”; (2) “termination of that person’s employment”; or (3) “employment-related practices, policies, acts or omissions, such as coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation or discrimination directed at that person.” PSOF ¶ 22. Karikari does not allege that Carnagio improperly refused to employ her
or wrongfully terminated her, so the first two reasons for exclusion do not apply. Instead, the insurance companies rely upon the third category, arguing that Carnagio’s practice of requiring employees to clock in and out using their handprints was an “employment-related practice” that arose out of the employer-employee relationship. In response, Carnagio and Karikari argue that the fingerprint requirement
does not fall within the third exclusionary clause, because it is not the type of “employment-related practice” intended by the ERP exclusion. Whether explicitly or not, Defendants invoke the canon of interpretation noscitur a sociis—which counsels that the meaning of neighboring words can help guide a word’s meaning. See CFTC v. Worth Bullion Grp., Inc., 717 F.3d 545, 550-51 (7th Cir. 2013) (“Under the principle of noscitur a sociis, the fact that several items in a list share an attribute counsels in favor of interpreting the other items as possessing that attribute as well.” (cleaned up)). Here, the first two clauses—refusal to hire and termination—address an action
that an employer takes against a particular employee or prospective employee. Similarly, the examples offered in the third clause—coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation or discrimination— also consist of actions that an employer or someone else in the workplace takes against a particular employee. In fact, the third clause expressly describes this conduct as conduct “directed at that person” (i.e., the person claiming injury). By contrast, Carnagio’s practice of requiring its employees to provide their fingerprints
when clocking in or out is one that applies generally to all employees. Accordingly, applying the interpretative tool noscitur a sociis, the Court concludes that Carnagio’s practice does not fall within the scope of the activities described in the ERP exclusion. This interpretation finds support in Illinois cases that construe the ERP exclusion in other contexts. From them, it is clear that just because an alleged injury takes place at work does not by itself trigger the exclusion. See Am. All. Ins. Co. v.
1212 Rest. Grp., L.L.C., 794 N.E.2d 892, 900 (Ill. App. Ct. 2003) (holding “the fact that the [allegations giving rise to the underlying claim] arose out of [an insured’s] business does not necessarily mean they were an employment-related act within the meaning of the exclusion”); see also Peterborough Oil Co. v. Great Am. Ins. Co., 397 F. Supp. 2d 230, 238 (D. Mass. 2005) (“If every injury arising out of an act that somehow related to an employee were to be excluded, the exclusion would effectively swallow the coverage. The term is therefore necessarily narrower.”); Diversified Commc’ns Servs., Inc. v. Landmark Am. Ins. Co., No. CV 08-7703 PSG (SSX), 2009 WL 772952, at *8 (C.D. Cal. Mar. 17, 2009).
Rather, “the salient question is whether the alleg[ations giving rise to the underlying complaint] were made in the context of employment and related to . . . employment performance.” 1212 Rest. Grp., 794 N.E.2d at 900 (emphasis added); see also Am. Econ. Ins. Co. v. Haley Mansion, Inc., No. 3-12-0368, 2013 WL 1760600, at *4 (Ill. App. Ct. Apr. 23, 2013) (holding that an employment relationship between plaintiff and defendant alone was not enough to invoke the ERP coverage exclusion). In other words, it is not enough that the underlying claim simply arise out of an
employer-employee relationship, as Plaintiffs argue. The claim must involve an action related to an employee’s performance. Finally, the insurance companies rely on the word “any” that precedes “employment-related practice” to argue that the latter term should be given wide breadth. And to be sure, “any” is a broad term. But, here, “any” modifies “employment-related practice,” followed by a list of examples. And, as Carnagio
points out, “such as,” like including, is “a phrase of general similitude indicating that there are includable other matters of the same kind which are not specifically enumerated by the standard.” White v. United Airlines, Inc., 416 F. Supp. 3d 736, 740 (N.D. Ill. 2019) (cleaned up), rev’d on other grounds, 987 F.3d 616 (7th Cir. 2021) (emphasis added). To put it another way, the scope of “any” in this exclusion is only as broad as the definition of “employment-related practices” allows it to be. For these reasons, the Court concludes that Carnagio’s practice of requiring its employees to provide their fingerprints when clocking in and out of work does not fall within the ERP exclusion. At a minimum, there is significant ambiguity as to
whether the exclusion disavows coverage of Karikari’s claims. And, under Illinois law, such ambiguity must be resolved in the insured’s favor. See United Servs. Auto., 830 N.E.2d at 678. B. Statutory Violation Exclusion The Statutory Violation exclusion precludes coverage for injuries arising out of: (1) The Telephone Consumer Protection Act (TCPA), including any amendment or addition to such law; or
(2) The CAN-SPAM Act of 2003, including any amendment of or addition to such law; or
(3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information. PSOF ¶ 23. In West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., the Supreme Court of Illinois held that a nearly identical provision did not exclude violations of BIPA from coverage. 2021 WL 2005464, at *10. But Plaintiffs contend the result in Krishna does not control this case, because the provision in Krishna, although otherwise identical, had a more specific title: “Violation of Statutes that Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or Information.” Pls.’ Mem. at 9. Because the Supreme Court of Illinois began its Krishna analysis with the title of the exclusion, see 2021 WL 2005464, at *10, Plaintiffs contend that Krishna should have no bearing on the interpretation of the exclusion here.
At the outset, this Court is not convinced that the difference in the titles makes these exclusions substantively different. See, e.g., First Mercury Ins. Co. v. Triple Location LLC, 536 F. Supp. 3d 326, 331–32 (N.D. Ill. 2021) (referring to the exclusion at issue in Krishna as “materially identical” to one with the title “Distribution of Material in Violation of Statutes,” and otherwise identical substance). But even if the change in title were material, the Supreme Court of Illinois’s analysis in Krishna would remain the appropriate starting point for this Court’s understanding of the
Statutory Violation exclusion here. The Krishna court, in interpreting the list of statutory violations that would be excluded, explained: [T]o the extent that the “other than” language . . . may be viewed as ambiguous, it must be construed in favor of finding coverage for the insured. . . . Therefore, under the doctrine of ejusdem generis and our rules of insurance contract construction, we construe the violation of statutes exclusion to apply only to statutes like the TCPA and the CAN- SPAM Act. 2021 WL 2005464, at *10. Here, too, because the general words “other than” follow a list of specific statutes in the exclusion, ejusdem generis can inform the Court’s understanding of the exclusion.4 See id. at *9 (“[W]here general words follow an
4 Plaintiffs insist that ejusdem generis is not appropriate here because the “other than” language in their exclusions is not ambiguous at all, and it “plainly applies” to BIPA claims. Pls.’ Mem. at 9. But the Krishna court found the “other than” language to be ambiguous enough to require the application of ejusdem generis. 2021 WL 2005464, at *10. And in Krishna, the Supreme Court of Illinois was interpreting identical language in an identical enumeration of persons or things, by words of a particular and specific meaning, such general words are to be held as applying only to persons or things of the same general kind or class as those specifically mentioned.” (quoting BLACK’S LAW DICTIONARY 517
(6th ed. 1990))). Notwithstanding the different titles, the application of ejusdem generis in this instance yields the same result as in Krishna: only violations of statutes, ordinances, or regulations “like the TCPA and the CAN-SPAM Act” are excluded from coverage. Thus, the Court must determine whether BIPA is “like the TCPA and the CAN-SPAM Act.” Plaintiffs contend that this is so, because BIPA protects an individual’s privacy
rights just as the TCPA and the CAN-SPAM Act do. But, even so, BIPA is materially different from the other two. The TCPA and the CAN-SPAM Act protect privacy by regulating communications in order to give private citizens control over the information that they receive. See generally 47 U.S.C. § 227 and 15 U.S.C. § 7701. By contrast, BIPA protects privacy by regulating the information that private citizens give away. See generally 740 Ill. Comp. Stat. 14/15 (regulating, among other things,
how private entities must handle “a person[‘s]” biometric information that they “collect, capture, purchase, receive through trade, or otherwise obtain”).5 As such,
list of excluded statutory claims. Thus, the Court finds that the application of ejusdem generis is appropriate here. 5 This distinction tracks closely with the commonly understood definitions of “privacy,” a term that can mean both “freedom from unauthorized intrusion,” and “secrecy” or “a private matter.” Privacy, MERRIAM-WEBSTER.COM, https://www.merriam-webster.com/dictionary /privacy (last visited Nov. 22, 2021). the Court concludes that BIPA is not like the TCPA and the CAN-SPAM Act, because BIPA protects a different kind of privacy and uses a different method to do so. See Evanston Ins. Co. v. Gene by Gene, Ltd., 155 F. Supp. 3d 706, 713 (S.D. Tex. 2016)
(interpreting an identical insurance provision and finding that the TCPA and CAN- SPAM Act were not like a statute regulating disclosure of genetic information because, unlike the enumerated statutes in the exclusion, the genetic information statute “d[id] not concern unsolicited communication to consumers.”) At a minimum, coverage for Karikari’s claims is not unambiguously excluded by the Statutory Violation exclusion. For these reasons, the Court holds that the underlying claims under BIPA are
at least potentially covered by Carnagio’s policies. Additionally, because American Family raised only the ERP exclusion and Statutory Violation exclusion, neither of which unambiguously exclude coverage in this case, Plaintiffs’ motion for summary judgment is denied as to American Family, and Karikari’s cross-motion for summary judgment as to American Family is granted with respect to these exclusions. C. Access/Disclosure Exclusion
Austin Mutual argues that a third exclusion in its policy, the Access/Disclosure exclusion, precludes coverage in this case. As noted above, the exclusion, entitled “Access Or Disclosure Of Confidential Or Personal Information and Data-related Liability,” states: This insurance does not apply to . . . “Personal and advertising injury” arising out of any access to or disclosure of any person’s or organization’s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information.
PSOF ¶ 24. The first clause in this provision is unequivocal. “This insurance does not apply to . . . “personal and advertising injury” arising out of . . . any access to or disclosure of any person’s . . . personal information[.]” PSOF ¶¶ 24 (emphasis added). And the word “any” has a broad meaning. See, e.g., United States v. Gonzales, 520 U.S. 1, 5 (1997) (“Read naturally, the word ‘any’ has an expansive meaning, that is, ‘one or some indiscriminately of whatever kind.’” (quoting WEBSTER’S THIRD NEW INTERNATIONAL DICTIONARY 97 (1976))). Because this language is clear and unambiguous, the Court ascribes to it its plain and ordinary meaning. See Sanders v. Ill. Union Ins. Co., 157 N.E.3d 463, 467 (Ill. 2019). Carnagio attempts to circumscribe the phrase “any access to or disclosure of any person’s . . . confidential or personal information” by pointing to the words that follow the word “including” and invoking the interpretative canon of ejusdem generis (“of the same kind”).6 As explained above, under this doctrine, “general words are
construed to embrace only objects similar in nature to those . . . specific words.” 2A N. SINGER & S. SINGER, SUTHERLAND STATUTES AND STATUTORY CONSTRUCTION § 47:17 (7th ed. 2021). But this argument is unpersuasive for several reasons. First, ejusdem generis does not apply when the language at issue is unambiguous. See Tourdot v. Rockford Health Plans, Inc., 439 F.3d 351, 353 (7th Cir.
6 Defendant Karikari does not oppose summary judgment on these grounds. See Def. Karikari Resp. Opp’n Pls.’ Mot. Summ. J. at 1 n. 1. 2006) (“Ejusdem generis provides guidance on how to interpret language where the meaning is not plain.”). Here, nothing is ambiguous about the phrase “any access to or disclosure of any person’s . . . personal information.”
Second, when items are introduced by the word “including,” the list that follows is not exclusive. See In re Schwartz, 799 F.3d 760, 763 (7th Cir. 2015) (“If you tell your maid to iron your clothes, including your Bond Street tuxedo and its cummerbund, there is no implication that she is not to iron your other clothes.”). In other words, the term “‘[i]nclude’ is a word of illustration, not limitation.” Richardson v. Nat’l City Bank of Evansville, 141 F.3d 1228, 1232 (7th Cir. 1998). Therefore, the words in the Access/Disclosure exclusion that appear after “including” cannot limit
the scope of the preceding clause “any access to or disclosure of any person’s . . . personal information.”7 Third, “the interpretive canon of ejusdem generis . . . attribute[s] to the last item . . . the same characteristic of discreteness shared by all the preceding items.” Norton v. S. Utah Wilderness All., 542 U.S. 55, 63 (2004). But the canon does not apply when the items “are not sufficiently similar to belong to one identifiable class.”
Hugh v. Amalgamated Tr. & Sav. Bank, 602 N.E.2d 33, 38 (Ill. App. Ct. 1992). Here, the items that are listed have no readily identifiable common thread (at least, not in the way that Carnagio ascribes). For example, the first items in the list,
7 “Authorities have traditionally agreed that . . . [ejusdem generis] does not apply to a general-specific sequence.” Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 203 (2012). “In all contexts other than the pattern of specific- to-general, the proper rule to invoke is the broad associated-words canon, not the narrow ejusdem generis canon.” Id. at 205. “patents,” are publicly available information. 37 C.F.R. § 1.11 (2021) (“The specification, drawings, and all papers relating to the file of . . .[a] published application; a patent; or a statutory invention registration are open to inspection by
the public . . . .”). By contrast, “credit card information” is not. See, e.g., 815 Ill. Comp. Stat. 530/5(1)(C) (defining “nonpublic personal information” as including a person’s credit card number). Indeed, despite its insistence that ejusdem generis applies in this case, Carnagio fails to point to any characteristic that is common to all items listed in the exclusion. See Carnagio Resp. at 9. Similarly, the Court finds that the items on the list are not sufficiently similar to belong to one identifiable class, thereby rendering ejusdem generis inapplicable. See CSX Transp., Inc. v. Ala. Dep’t of
Revenue, 562 U.S. 277, 295 (2011) (“A canon meaning literally ‘of the same kind’ has no application to provisions directed toward dissimilar subject matter.”). Nevertheless, say that the Court were to apply the interpretive canon of noscitur a sociis, a broader variation of ejusdem generis, which “means literally ‘it is known from its associates,’ and means practically that a word may be defined by an accompanying word, and that, ordinarily, the coupling of words denotes an intention
that they should be understood in the same general sense.” 2A SINGER & SINGER, supra, § 47.16; see also United States v. Williams, 553 U.S. 285, 294 (2008) (describing noscitur a sociis as “a commonsense canon . . . which counsels that a word is given more precise content by the neighboring words”); Beecham v. United States, 511 U.S. 368, 371 (1994) (“That several items in a list share an attribute counsels in favor of interpreting the other items as possessing that attribute as well.”). The only readily discernible resemblance is that several of the items, such as trade secrets, processing methods, customer lists, financial information, credit card information, and health information, denote certain categories of information which individuals and
companies have a heightened interest in keeping from third-parties or the public at large, whether for financial reasons or otherwise. The biometric data that BIPA protects certainly falls within this category.8 And the Access/Disclosure exclusion not only applies to “confidential” information, but to an individual’s “personal” information as well, and Carnagio does not explain why biometric information would not constitute “personal” information as that term appears in the exclusion. The Court next turns to the allegations in the underlying litigation to
determine whether they clearly fall within the Access/Disclosure exclusion. In the state-court case, Karikari alleges a wide range of BIPA violations. BIPA provides an action for damages against a private entity if it “disclose[s], redisclose[s], or otherwise disseminate[s] a person’s . . . biometric identifier or biometric information” without the person’s consent. 740 Ill. Comp. Stat. 14/15(d)(1); id. 14/20. BIPA’s definition of
8 Other courts in this district have applied ejusdem generis or noscitur a sociis to an identical or similar provision and have arrived at the opposite conclusion. See, e.g., Am. Fam. Mut. Ins. Co. v. Caremel, Inc., No. 20 C 637, 2022 WL 79868, at *3 (N.D. Ill. Jan. 7, 2022); Citizens Ins. Co. of Am. v. Thermoflex Waukegan, LLC, No. 20-CV-05980, 2022 WL 602534, at *6–7 (N.D. Ill. Mar. 1, 2022). The Caramel court, applying ejusdem generis, held that biometric data is unlike “health information” or “financial information,” but it did little to assess whether the enumerated items share a common attribute. 2022 WL 79868, at *3. In Citizens, the court applied noscitur a sociis, relying on its interpretation of the BIPA to find that the exclusion did not unambiguously exclude coverage. 2022 WL 602534, at *7. For the reasons discussed herein, the Court respectfully disagrees. “biometric identifier” includes fingerprint scans. Id. 14/10.9 The legislative findings state that such data requires protection because: [b]iometrics . . . are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.
Id. 14/5(c). The stated purpose of BIPA is to regulate the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information in order to protect public welfare, security, and safety. Id. 14/5(g). Karikari alleges, among other things, that Carnagio owes damages for disclosing Karikari’s fingerprint-scan information to a third-party vendor without Karikari’s consent. PSOF Ex. 7, ¶¶ 62–82, ECF No. 71-8. Indeed, the Seventh Circuit has described the invasion of privacy as “personal and real,” where, as here, a plaintiff alleges the full panoply of BIPA violations. Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149 (7th Cir. 2020); see id. at 1155 (stating that biometric identifiers “are immutable, and once compromised, are compromised forever”). Simply put, the state- court litigation seeks damages arising out of a third-party’s access to or Carnagio’s disclosure of Karikari’s personal information, placing it clearly within the scope of the exclusion. Carnagio also argues that any construction that excludes coverage for damages based on the access to or disclosure of biometric information would consume the
9 Additionally, BIPA’s definition of “biometric information” means “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.” 740 Ill. Comp. Stat. 14/10. coverage grant for “personal and advertising injury.” Carnagio Resp. at 9–10; see PSOF ¶ 24. But this is an overstatement. A “policy need not provide coverage against all possible liabilities; if it provides coverage against some, the policy is not illusory.”
Nicor, Inc. v. Associated Elec. & Gas Ins. Servs. Ltd., 841 N.E.2d 78, 86 (Ill. App. Ct. 2005), aff’d, 860 N.E.2d 280 (Ill. 2006); see Liberty Mut. Fire Ins. Co. v. Statewide Ins. Co., 352 F.3d 1098, 1101 (7th Cir. 2003) (rejecting the argument that the limitations were so broad that the policy provided no tangible coverage and holding that, under Illinois law, merely because coverage is limited does not make it illusory). Here, the policy defines “personal and advertising injury” to cover a broad range of claims that do not fall within the scope of the exclusion. See PSOF ¶ 14 (listing, among other
things, false arrest, detention, imprisonment, malicious prosecution, and copyright and trade dress infringement). As a result, the exclusion at issue does not render coverage for “personal and advertising injury” meaningless. Along these same lines, Carnagio argues that the Court’s construction of the Access/Disclosure exclusion would swallow completely any coverage the policy provides for lawsuits alleging “[p]ersonal and advertising injury . . . arising out of . . .
[o]ral or written publication, in any manner, of material that violates a person’s right of privacy.” But this too is incorrect. Under Illinois law, the right to privacy encompasses more than a person’s right to maintain the confidentiality of their personal information. Take, for example, a person’s right not to be placed in a false light. Illinois law recognizes this as a privacy right: One who gives publicity to a matter concerning another that places the other before the public in a false light is subject to liability to the other for invasion of his privacy, if (a) the false light in which the other was placed would be highly offensive to a reasonable person, and (b) the actor had knowledge of or acted in reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed.
Lovgren v. Citizens First Nat’l Bank of Princeton, 534 N.E.2d 987, 989 (Ill. 1989) (quoting RESTATEMENT (SECOND) OF TORTS § 652E) (cleaned up). Claims for false light invasion of privacy seek damages arising out of a publication of material that violates a person’s right of privacy, and, therefore, would satisfy the definition of “personal and advertising injury” in the policy. Yet, such claims would not fall under the Access/Disclosure exclusion because they would not seek damages arising out of any access to or disclosure of any person’s confidential or personal information. Therefore, contrary to Carnagio’s contention, the Court’s construction of the Access/Disclosure exclusion would not render coverage under the policy illusory. For all of these reasons, the Court holds that the policy’s Access/Disclosure provision precludes coverage of the Karikari lawsuit.10
10 Because coverage is excluded outright under Austin Mutual’s policy, the issue of notice is moot as to this policy. IV. Conclusion For the foregoing reasons, the cross-motions for summary judgment are each granted in part and denied in part as follows: The Court hereby issues a declaratory judgment that the Karikari lawsuit does not implicate the Austin Mutual policy issued to Carnagio and Austin Mutual has no obligation to defend or indemnify Carnagio in connection with the Karikari lawsuit. Furthermore, Karikari's suit is not excluded under the policy issued to Carnagio by American Family.
IT IS SO ORDERED. ENTERED: 3/30/22
John Z. Lee United States District Judge