In a landmark decision, the Appellate Court of Illinois has reversed a lower court's ruling that required an insurance company to defend a grocery chain in a class action lawsuit. The case, filed by Tony’s Finer Foods Enterprises, Inc. against Certain Underwriters at Lloyd’s, London, was heard in the Circuit Court of Cook County on September 10, 2024.
The dispute began when Charlene Figueroa filed a class action lawsuit against Tony’s on December 19, 2018. She alleged that during her employment from March 8, 2017, to September 17, 2018, Tony’s violated the Biometric Information Privacy Act (BIPA) by improperly collecting and storing employees' biometric data without their consent. Specifically, she claimed that Tony’s failed to publish a schedule for deleting biometric data and did not obtain written consent from employees before collecting or sharing their fingerprints with third parties like Kronos.
Tony’s sought defense and indemnification from Lloyd’s under two “Cyber, Data Risk, and Media Insurance” policies covering periods from March 15, 2018, to March 15, 2020. However, Lloyd’s denied coverage on June 6, 2019, arguing that Tony’s had failed to notify them of the lawsuit within the policy period and that the allegations did not fall within the scope of their coverage.
Tony’s subsequently filed for declaratory judgment on September 22, 2022. The Circuit Court ruled in favor of Tony’s on summary judgment grounds but did not provide detailed reasoning for its decision. Lloyd’s appealed this ruling.
On appeal, Lloyd's contended that they had no duty to defend because the claims did not potentially fall within policy coverage and because Tony's had failed to report the lawsuit timely. The appellate court agreed with Lloyd's arguments. They found that the insurance policies covered losses due to unauthorized data breaches or security failures but did not cover violations arising from authorized actions by Tony's itself or its subcontractors like Kronos.
Furthermore, the appellate court highlighted an exclusion clause in the insurance policy which stated that it would not cover any loss arising out of unauthorized collection or use of personally identifiable information in violation of law unless no senior management knew about it. Since Figueroa's complaint centered around these exact issues—unauthorized collection and use—the court found these exclusions applicable.
As a result of these findings, the appellate court reversed the circuit court's decision and directed it to enter summary judgment in favor of Lloyd's regarding their duty to defend.
The attorneys representing Lloyd's were Geoffrey J. Repo from Gordon Rees Scully Mansukhani LLP while Eamon P. Kelly and Clayton Faits from Sperling & Slater LLC represented Tony's Finer Foods Enterprises. The case was presided over by Judge Joel Chupack with Justices Van Tine delivering the opinion and D.B Walker concurring; Justice Reyes dissented.