CHICAGO — A federal judge has ruled American Family Insurance isn’t obligated to defend or pay to protect a Kankakee-area McDonald’s franchisee from a class action lawsuit accusing the company of violating Illinois' biometrics privacy law in the way it required workers to scan their fingerprints when punching the clock at work.
In July 2019, Joseph Ross sued Lawrence and Judith Linman, who operate Caremel Inc. and own several McDonald’s restaurants in Kankakee, Peotone and Beecher. Ross, who worked at a Bradley restaurant from August through October 2017, said he and other employees had to use a fingerprint scanning time clock in violation of the Illinois Biometric Information Privacy Act.
According to Ross’ complaint, Caramel didn’t provide any written materials about collection, retention or disclosure of hourly workers’ fingerprints. He also said the company never required workers to submit written consent in accordance with BIPA regulations.
American Family insured Caremel from March 1, 2018, through March 1, 2020. However, the insurer denied Caremel’s request to provide coverage for the Ross lawsuit. The insurer cited an exclusionary provision in the policy concerning “access or disclosure of confidential or personal information and data related to liability.” American Family also invoked exclusions regarding employment practices and liability linked to state law violations.
In January 2020, American Family asked a federal judge to declare it had no obligation to fund Caremel's defense.
U.S. District Judge Harry Leinenweber ruled in favor of American Family in an opinion issued Jan. 7.
In his ruling, the judge declared the McDonald's franchisee's alleged failure to abide by the state biometrics law places its employees at risk, which gives the insurer an out.
Leinenweber said Illinois law dictates an insurer’s duty to defend a lawsuit depends on the underlying allegations and further noted judges are to construe the complaint and policy language in favor of the insured party.
Of the three policy exclusions American Family invoked, Leinenweber sided with Caremel on two. Caremel said the access or disclosure exclusion shouldn’t apply because it “specifically mentions patents, trade secrets, processing methods, customer lists, financial information and health information,” Leinenweber wrote, and so a reference to all other nonpublic information should exclude fingerprints, which are a different type of data.
Leinenweber agreed with Caremel’s reference to a 2021 Illinois Supreme Court opinion in West Bend Mutual Insurance v. Krishna Schaumburg Tan, which held West Bend had to defend its client because its policy provided coverage for “oral or written publication of material that violates a person’s right of privacy.” Although West Bend’s policy had an exclusion for distribution in violation of state law, several courts agreed that applied only to the federal Telephone Consumer Protection Act and the 2003 CAN-SPAM Act.
But American Family’s exclusion doesn’t cover fingerprints, Leinenweber said, because they aren’t trade secrets, financial information or even health information, but rather, at most, a physical characteristic. If the policy is at all ambiguous, he continued, the interpretation must side with the client. He said the same reasoning is “virtually identical” to the argument regarding the state statute exclusion.
However, American Family prevailed on its reading of the policy’s employment practice exclusion because of Caremel’s requirement that hourly employees use a fingerprint scanner.
“Caremel’s employees, including Ross, suffer risk of individual injuries as a result of Caremel’s failure to adhere to the statutory procedures of the BIPA,” Leinenweber wrote. “This, according to the Illinois Supreme Court, is an injury in fact.”
The policy exclusion lists practices such as “coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation,” which generally reflect practices that can legally harm individual employees. But so can BIPA violations, Leinenweber said, even if they can affect enough workers to sustain class litigation.
Based on that policy exclusion alone, American Family is not obligated to cover Caremel in this instance, Leinenweber concluded.
Under the BIPA law, the McDonald's franchisee could face damage claims of $1,000-$5,000 per violation. Courts have interpreted the law to define individual violations as each time a worker scanned a fingerprint without proper notice and consent. This could place even moderately sized companies at risk of what defense attorneys and business groups involved in other BIPA-related class actions have called "crippling damages."
Caremel has been represented in the action by attorney Christopher A. Kreid, of Evanston.
American Family has been represented by attorneys Holly A. Harrison, Michael L. Rice and Katherine A. Garceau Sobiech, of Harrison Law, of Chicago.
Ross and the class action plaintiffs have been represented by attorneys Douglas M. Wennan and Zachary C. Flowerree, of Werman Salas, of Chicago.