Twin City Fire Ins. Co. v. Vonachen Servs.

Full title: TWIN CITY FIRE INSURANCE CO., Plaintiff, v. VONACHEN SERVICES, INC.…

Court: United States District Court, Central District of Illinois

Date published: Oct 19, 2021

20-cv-1150-JES-JEH (C.D. Ill. Oct. 19, 2021)

Opinion

20-cv-1150-JES-JEH

10-19-2021

TWIN CITY FIRE INSURANCE CO., Plaintiff, v. VONACHEN SERVICES, INC., ANNASTASIA RODRIGUEZ, individually and on behalf of all others similarly situate and JESSI GUMM, individually and on behalf of all others similarly situated, [1] Defendants. VONACHEN SERVICES, INC., Counter Claimant, v. TWIN CITY FIRE INSURANCE CO., Counter Defendant.

James E. Shadid, United States District Judge

ORDER AND OPINION

James E. Shadid, United States District Judge

This matter is now before the Court on Defendant Vonachen Services, Inc.'s Motion (Doc. 20) for Summary Judgment, Memorandum (Doc. 21) in Support, and Statement (Doc. 22) of Undisputed Facts, and Plaintiff Twin City Fire Insurance Company's Cross Motion (Doc. 24) for Summary Judgment and Response to Vonachen's Motion, Memorandum (Doc. 25) in Support, and Statement (Doc. 23) of Undisputed Facts and Response to Vonachen's Statement. Vonachen has also filed a Response (Doc. 27) in Opposition to Twin City's Cross Motion for Summary Judgment and Reply, also (Doc. 27), to Twin City's Response to Vonachen's Motion. Twin City has filed a Reply (Doc. 28) to Vonachen's Response. For the reasons set forth below, Vonachen's Motion (Doc. 20) for Summary Judgment is GRANTED and Twin City's Cross Motion (Doc. 24) for Summary Judgment is GRANTED in part and DENIED in part.

I. Background

This insurance coverage dispute concerns a policy issued by Twin City to Vonachen and two class actions that were filed against Vonachen in Illinois circuit courts alleging violations of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (2018) (“BIPA”). Both Parties have moved for summary judgment and agree the following facts are undisputed.

A. Underlying Lawsuits

On November 1, 2019, Annastasia Rodriguez filed a putative class action lawsuit against Caterpillar, Inc. in the Circuit Court of Cook County, Illinois - Chancery Division, No. 2019-CH-12773 (“the Rodriguez Action”). Doc. 23, at 5. On March 3, 2020, the Rodriguez Action was amended to dismiss without prejudice the action against Caterpillar and to convert Vonachen from a respondent in discovery to the sole named defendant. Id. In her complaint, Rodriguez alleged various statutory violations of BIPA: Vonachen required its workers to use their fingerprints “as a means of authentication” via a biometric tracking system; Vonachen violated its employees' rights to privacy when it captured, collected, stored, used and/or disclosed those fingerprints; and Vonachen failed to inform its workers of the extent and purposes for which it collected their biometric data and whether the data was disclosed to third parties. Id. at 6, 10. The complaint also listed requirements imposed upon an entity under 740 ILCS 14/15(b) ²: (1) inform the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) inform the subject in writing of the specific purpose and length of time for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receive a written release executed by the subject. Id. at 5-6 (citing Doc. 22-3, at 25-26).³

2 The Rodriguez Action erroneously cites “714 ILCS 14/15(b).” The relevant provision of BIPA is 740 ILCS 14/15(b), which is cited elsewhere in the complaint.

3 Twin City marks this statement undisputed to the extent these requirements are set forth upon persons or entities, rather than “employers, ” which is the phrase Vonachen ascribed. Additionally, Twin City oddly disputes that the Rodriguez and Gumm complaints are limited to employees of Vonachen because the putative class is described “all individuals” whose fingerprints were obtained by Vonachen. Doc. 23, at 10.

On November 6, 2019, Vonachen provided notice of the Rodriguez Action to Twin City. Id. at 6. Twin City responded to Vonachen with a denial letter on January 20, 2020, which disclaimed any obligations to defend or indemnify Vonachen regarding the Rodriguez Action. Id. After the Rodriguez Action was amended, counsel for Vonachen provided the amended complaint to Twin City on March 18, 2020. At that time, counsel disputed the previous coverage denial and provided a copy of Vonachen's Employee Handbook. Id. at 7. On April 10, 2020, Twin City acknowledged counsel's submission and again denied coverage to Vonachen. Id. at 8, 11. Twin City further stated, “Underlying Action ha[s] no relationship to any alleged violation of the Employee Handbook and BIPA is a statute unrelated to any employee-employer relationship.”⁴ Id. at 11-12. That same day, Twin City filed the instant lawsuit seeking a declaration that Twin City owes no insurance obligations to Vonachen with respect to the Rodriquez Action. Id. at 8.

4 See Id. at 12. Twin City incorrectly assumes “BIPA is unrelated to any employee-employer relationship.” In fact, BIPA contemplates that relationship regarding informed consent which is the basis for the underlying complaints and the context which gave rise to a vast No. of BIPA cases. See 740 ILCS 14/10 (“‘Written release' means informed written consent or, in the context of employment, a release executed by an employee as a condition of employment.” (emphasis added).

On June 12, 2020, Jessi Gumm filed a putative class action suit against Vonachen in the Tenth Judicial Circuit, Peoria County, Illinois, No. 20-CH-00139 (“the Gumm Action”). Id. at 5. Like Rodriguez, Gumm alleged B I P A violations in that Vonachen used, collected, and indefinitely stored employees' fingerprints without informed consent and failed to inform its employees of the specific purpose and length of time for which their biometric identifiers or information would be collected, stored, and used. Id. at 10-11. Gumm also accused Vonachen of “invad[ing] Plaintiff's statutorily protected right to privacy in her biometrics.” Id.

On July 10, 2020, Vonachen provided notice of the Gumm Action to Twin City. Id. at 8. Thereafter, Twin City issued a coverage denial letter to Vonachen and filed an Amended Complaint seeking a declaration that it additionally owes no insurance obligations to Vonachen regarding the Gumm Action. Id. at 9.

B. The Employee Handbook⁵

5 The Parties discuss two copies of the Handbooks from different years but agree that the Handbooks are substantially similar, therefore, the Court refers to the employee handbooks as “the Handbook.” See Doc. 23, at 8. Additionally, Twin City repeatedly asserts it cannot confirm whether the “Handbooks are true and correct copies.” The Court addresses Twin City's assertion in the Discussion section of this Opinion and explains why the Court considered the Handbook in rendering its summary judgment decisions in this case. See infra sec. III(A)(2)(B).

It is undisputed that both Rodriguez and Gumm signed a copy of Vonachen's Employee Handbook (the “Handbook”). Id. at 7-8 (citing Doc. 22-2).⁶ The Parties do not dispute the stated portions of the Handbook but disagree on the effect of such wording and their relevance to this lawsuit.

6 In its Response to Vonachen's statement of material fact 18, Twin City states:

Undisputed that this statement accurately quotes parts of the Handbooks attached, that the proffered versions of the Handbook are substantially similar, and that the Handbooks do not disclose privacy risks related to the collection, storage, use, or disclosure of the employees' biometric information. Twin City is unable to confirm whether the Employee Handbooks are true and correct copies and accordingly submits the accompanying Fed.R.Civ.P. 56(d) Affidavit.

However, Twin City does not address whether it disputes that Rodriguez and Gumm signed the 2017 Handbook, therefore, the Court considers this fact undisputed. Fed.R.Civ.P. 56(e)(2) provides that when a party fails to properly address another party's assertion of fact as required by Rule 56(c), the court may, inter alia, “consider the fact undisputed for the purposes of the motion.” Likewise, Local Rule 7.1(D)(2)(b)(6) cautions, “[a] failure to respond to any numbered fact will be deemed an admission of the fact.” Id.

The Handbook require all employees to record their working hours through the use of a designated time system to “punch-in” and “punch-out.” Doc. 22-2, at 28. An employee who fails to punch in or out within seven minutes before or after her designated work time “will be subject to progressive discipline up to and including termination.” Id. The “Employee Conduct and Disciplinary Action” section of the Handbook also lists misuse of timekeeping records as a basis for progressive disciplinary action. Id. at 14.

The Handbook does not discuss privacy risks related to the collection, storage, use, or disclosure of the employees' biometric information. Doc. 23, at 8. The “Ethical Standards and Conduct” section states, “[w]e will comply with all applicable laws and regulations and we expect our leadership and employees to conduct business in accordance with the letter, spirit and intent of all relevant laws and to refrain from any illegal, dishonest or unethical conduct.” Doc. 22-2, at 13. There is also statement set forth in the “Overview and Employment Policies” section noting, “[p]olicies set forth in this handbook are not intended to create a contract, nor are they to be construed to constitute contractual obligations of any kind or a contract of employment between Vonachen Group and any of its employees.” Id. at 11. That same paragraph ends with the statement, “The provisions of this handbook are subject to any limitations required by federal or state law.” Id.

C. The Insurance Policy⁷

7 The Policy is reproduced throughout Parties' summary judgment briefing. For the purposes of clarity, the Court cites to the Policy as Doc. 22-1, at __.

Twin City issued a Private Choice Premier Policy to Vonachen, Policy No. 83 KB 0336944-19, with a policy period of May 17, 2019 to May 17, 2020 (the “Policy”). Doc. 23, at 2. It is undisputed by the Parties that the Rodriguez Action and the Gumm Action are considered a single Claim under the Policy because they are based upon the same “Wrongful Act” or “Interrelated Wrongful Acts”⁸ as defined by the Policy's Common Terms and Conditions section. Id. at 9 (citing Doc. 22-1, at 17). Other common definitions include:

8 “Interrelated Wrongful Acts” are “Wrongful Acts that have as a common nexus any fact, circumstance, situation, event or transaction, or series of causally connected facts, circumstances, situations, events, or transactions.” Doc. 22-1, at 11.

● “Damages” shall have the meaning specified for such term in each Coverage Part.

* * *

● “Defense Costs” means:

(1) Reasonable legal fees and expenses including but not limited to e-discovery expenses, incurred in the defense or appeal of a Claim;

* * *

● “Loss” means Defense Costs and Damages.

Doc. 22-1, at 10-11. The Policy contains two coverage parts at issue here, the Directors, Officers and Entity Liability Coverage Part and the Employment Practices Liability Coverage Part.

1. Directors, Officers and Entity Liability Coverage Part

The Directors, Officers and Entity Liability Coverage Part (“D&O”) has four “insuring agreements” contained within it. The agreement at issue as it relates to D&O coverage is “(C) Entity Liability, ” which states, in part, “the Insurer shall pay Loss on behalf of an Insured Entity resulting from an Entity Claim first made against such Insured Entity during the Policy Period or Extended Reporting Period, if applicable, for a Wrongful Act by an Insured Entity.” Id. at 23. Relevant definitions from the D&O coverage include the following:

● “Claim” means any:

(1) Insured Person Claim;

(2) Entity Claim;

(3) Derivative Demand.

* * *

● “Entity Claim” means any:

(2) Civil proceeding, including an arbitration or other alternative dispute proceeding, commenced by the service of a complaint, filing of a demand for arbitration, or similar pleading;

* * *

● “Insured Person” means any:

(1) Manager; or

(2) Employee.

* * *

● “Insured(s)” means any:

(1) Insured Entity; or

(2) Insured Person.

* * *

● “Whistleblowing” means an Insured Person's lawful act of providing information, causing information to be provided, or otherwise assisting in an investigation

regarding any conduct which the Insured Person reasonable believes constitutes a violation of any federal, state or foreign law.

● “Wrongful Act” means any actual or alleged:

(1) Error, misstatement, misleading statement, act, omission, neglect, or breach of duty committed by an Insured Person in their capacity as such or in their Outside Capacity, or, with regard to Insuring Agreement (C) an Insured Entity;

* * *

Id. at 25-27. D&O also contains “exclusions appliable to all insuring agreements, ” which states the “Insurer shall not pay Loss”:

* * *

(G) in connection with any Claim brought or maintained by or on behalf of any Insureds (in any capacity) or any security holder of an Insured Entity, provided that this exclusion shall not apply to the portion of Loss directly resulting from:

* * *

(9) a civil proceeding as a result of Whistleblowing, however, notwithstanding (G)(5) above, this carve back shall not apply if such whistleblower is a Manager and the proceeding is brought against the Insured Entity;

Id. at 27-29 (emphasis added). Following the general exclusions, there are exclusions specific to “Insuring Agreement (C)”:

(A) The Insurer shall not pay Loss under Insuring Agreement (C) in connection with any Claim based upon, arising from, or in any way related to any actual or alleged:

* * *

(2) employment-related Wrongful Act;

* * *

(4) false arrest or imprisonment, abuse of process, malicious prosecution, defamation (including libel and slander), invasion of privacy, trespass, nuisance or wrongful entry or eviction, assault, battery or loss of consortium;

Id. at 30 (emphasis added).

2. Employment Practices Liability Coverage Part

The Policy includes Employment Practices Liability Coverage (“EPL”), which provides:

The Insurer shall pay Loss on behalf of the Insureds resulting from an Employment Practices Claim first made against Insureds during the Policy Period or Extended

Reporting Period, if applicable, for an Employment Practices Wrongful Act by the Insureds.

Id. at 33. The EPL Policy defines the following terms:

● “Damages” means the amounts, other than Defense Costs, that the Insureds are legally liable to pay solely as a result of a Claim covered by this Liability Coverage Part, including:

(1) compensatory damages, including front pay and back pay award;

(2) settlement amounts;

(3) pre- and post-judgment interest;

(4) costs awarded pursuant to judgments

(5) punitive and exemplary damages;

(6) the multiple portion of any multiplied damage award; or

(7) liquidated damages under the Age Discrimination in Employment Act, the Family and Medical Leave Act and the Equal Pay Act.

* * *

● “Employee Data Privacy Wrongful Act” means: . . .

(2) the failure to notify any Employee or applicant for employment with the Insured Entity of any actual or potential unauthorized access to or use of Private Employment Information of any Employee or applicant for employment with the Insured Entity, if such notice was required by state or federal regulation or statute.

● “Employment Practices Claim” means any of the following if made by or on behalf of an Employee, an applicant for employment with an Insured Entity, or an Independent Contractor . . .

(2) a civil proceeding, including an arbitration or other alternative dispute proceeding, commenced by the service of a complaint, filing of a demand for arbitration, or similar pleading;

* * *

● “Employment Practices Wrongful Act” means any:

(1) wrongful dismissal, discharge, or termination of employment (including constructive dismissal, discharge, or termination), wrongful failure or refusal to employ or promote, wrongful discipline or demotion, failure to grant tenure, negligent employment evaluation, or wrongful deprivation of career opportunity;

(2) sexual or other workplace harassment, including bullying in the workplace, quid pro quo and hostile work environment;

(3) employment discrimination, including discrimination based upon age, gender, race, color, national origin, religion, creed, marital status, sexual orientation or preference, gender identity or expression, genetic makeup, or refusal to submit to genetic makeup testing, pregnancy, disability, HIV

or other health status, Vietnam Era Veteran or other military status, or other protected status established under federal, state, or local law, including any such discrimination as a result of disparate treatment;

(4) Retaliation;

(5) breach of any oral, written, or implied employment contract, including, without limitation, any obligation arising from a personnel manual, employee handbook, or policy statement;

(6) employment-related defamation (including libel and slander) or misrepresentation;

(7) employment-related violation of the Age Discrimination in Employment Act, the Family and Medical Leave Act and the Equal Pay Act; or

(8) violation of the Uniformed Services Employment and Reemployment Rights Act.

Employment Practices Wrongful Act also means the following, but only when alleged in addition to or as part of any Employment Practices Wrongful Act described above:

(a) an employment-related wrongful infliction of mental anguish or emotional distress;

(b) the failure to create, provide for or enforce adequate or consistent employment-related policies and procedures;

(c) the negligent retention, supervision, hiring or training of Employees or Independent Contractors;

(d) employment-related: false arrest or imprisonment;

(e) an employment-related invasion of privacy, including, without limitation, an Employee Data Privacy Wrongful Act;

or

(f) the breach of an Independent Contractor Agreement.

* * *

● “Insured Person” means any: (1) Employee (2) Manager; or (3) Independent Contractor but only (a) While she/he is acting on behalf of an Insured Entity . . .

● “Insureds” means any Insured Entity or Insured Person.

* * *

● “Private Employment Information” means any information regarding an Employee or applicant for employment with the Insured Entity, which is collected or stored by an Insured for the purposes of establishing, maintaining or terminating an employment relationship.

● “Retaliation” means adverse treatment of an Employee or Independent Contractor based upon such person:

* * *

(3) assisting, testifying, or cooperating with a proceeding or investigation regarding alleged violations of law by any Insured;

(4) disclosing or threatening to disclose alleged violations of law to a superior or to any governmental agency;

Id. at 33-36 (emphasis added). The “Exclusions Applicable To All Insuring Agreements” state:

* * *

(C) The Insurer shall not pay Loss in connection with any Claim based upon, arising from, or in any way related to liability incurred for breach of any oral, written, or implied employment contract; provided, however, that this exclusion shall not apply to liability that would have been incurred in the absence of such contract nor shall it apply to the portion of Loss representing Defense Costs incurred to defend against such liability.

Id. at 37-38.

D. Cross Motions for Summary Judgment

Both Parties have filed claims for declaratory relief based on the D&O and EPL coverage parts of the Policy. Docs. 14; 18. However, Vonachen only moves for summary judgment under the EPL coverage whereas Twin City moves for summary judgment under both the D&O and EPL coverage parts. Vonachen opposes Twin City's position on both.

In its Motion and Memorandum in Support of Summary Judgment, Vonachen asks this Court to issue a declaration that Twin City has a duty to defend Vonachen in the underlying actions. Doc. 21, at 16. It asserts the underlying actions allege “Employment Practices Wrongful Acts, ” which are covered under the EPL section of the Policy and Twin City cannot meet it burden to demonstrate an exclusion bars coverage. Id. In contrast, in Twin City's Cross Motion for Summary Judgment, it contends it owes no insurance obligations to Vonachen based on the D&O and EPL coverage parts. Docs. 24; 25. Therefore, Twin City requests a declaration finding it has no duty to defend and no duty to indemnify Vonachen under either coverage part.

II. Legal Standard

Summary judgment is appropriate where the movant shows, through “materials in the record, including depositions, documents, electronically stored information, affidavits or declarations, stipulations … admissions, interrogatory answers, or other materials” that “there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed.R.Civ.P. 56. In order to withstand a motion for summary judgment, the nonmovant must “set forth specific facts showing that there is a genuine issue for trial.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 250 (1986). In considering cross-motions for summary judgment, the Court views all facts and draw all reasonable inferences “in a light most favorable to the party against whom the motion under consideration is made.” Gazarkiewicz v. Town of Kingsford Heights, Indiana, 359 F.3d 933, 939 (7th Cir. 2004). Additionally, when there is no material factual dispute, contract interpretation is a question of law that the court may decide on summary judgment. Citadel Group Ltd. v. Wash. Reg'l Med. Cntr., 692 F.3d 580, 587 (7th Cir. 2012).

III. Discussion

At issue in this case is whether Twin City owes insurance coverage to Vonachen for two BIPA lawsuits initiated against Vonachen: the Rodriguez Action and the Gumm Action. Based on the Court's review and the Parties' lack of citations, hardly any courts have addressed an insurer's duty to defend regarding an underlying lawsuit for BIPA violations.⁹ Here, the Parties have asked the Court to determine whether Twin City has a duty to defend and/or indemnify Vonachen under the D&O or EPL coverage parts. For the reasons set forth below, the Court finds Twin City does not have duty to defend based on the D&O coverage, but it does have a duty to defend under the EPL coverage. The Court further finds the issue of indemnification is not ripe for adjudication.

9 After the Parties' submitted their briefs, the Supreme Court of Illinois issued an opinion in W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, addressing an insurer's duty to defend a class action lawsuit for B I P A violations. The opinion has not yet been released . However, that case did not involve an underlying “employer v. employee” BIPA lawsuit and the insurance policy was different. It addressed a personal or advertising injury falling within or potentially within coverage for a business liability policy. The Court also found a recent opinion from Massachusetts Bay Insurance Company, The Hanover American Insurance Company, & The Hanover Insurance Company, v. Impact Fulfillment Services, LLC, & LFS Holdings, LLC, No. 1: 20CV926, 2021 WL 4392061, at *7 (M.D. N.C. Sept. 24, 2021) (distinguishing Krishna Schaumburg Tan, Inc., 2021 IL 125978, on basis of its sounding in Illinois law as opposed to North Carolina law and holding the plaintiff had no duty to defend because the BIPA violations fell under the “recording and distribution of material or information exclusion” to the policy coverage for “personal and advertising injuries”). There are other cases at different procedural postures. See e.g., Citizens Ins. Co. of Am. v. Wynndalco Enterprises, LLC, No. 20 C 3873, 2021 WL 269842, at *1 (N.D. Ill. Jan. 27, 2021) (denying a motion to stay in a duty-to-defend BIPA case pending resolution of the underlying suits); Zurich Am. Ins. Co. v. Omnicell, Inc., No. 18-CV-05345-LHK, 2019 WL 570760, at *2 (N.D. Cal. Feb. 12, 2019) (granting a motion to stay as to the defend to duty pending resolution in an underlying case); Am. Fam. Mut. Ins. Co., S.I. v. Caremel, Inc., No. 20 C 637, 2020 WL 8093501, at *3 (N.D.Ill. Oct. 16, 2020) (denying a motion to dismiss); Church Mutual Ins. Co. v. Prairie Village Supportive Living LLC et al., No. 21-cv-3752, (N.D.Ill. July 14, 2021) (involving an EPL policy but no motions have been filed yet).

A. Duty to Defend

In Illinois, an insurer's duty to defend is “much broader” than its duty to indemnify. Outboard Marine Corp. v. Liberty Mutual Ins. Co., 607 N.E.2d 1204, 1220 (Ill. 1992). “An insurer has a duty to defend its insured ‘unless it is clear from the face of the underlying complaint that the facts alleged do not potentially fall within the policy's coverage.'” Zurich Am. Ins. Co. v. Ocwen Fin. Corp., 990 F.3d 1073, 1078 (7th Cir. 2021) (quoting G.M. Sign, Inc. v. State Farm Fire & Cas. Co., 18 N.E.3d 70, 77 (Ill.App.Ct. 2014)); accord General Agents Ins. Co. of America, Inc. v. Midwest Sporting Goods Co., N.E.2d 1092 (Ill. 2005); Connecticut Indem. Co. v. DER Travel Serv., Inc., 328 F.3d 347, 349 (7th Cir. 2003). Illinois courts will find a duty to defend even if only one theory alleged in the underlying complaint is potentially within the policy's coverage. U.S. Fid. & Guar. Co. v. Wilkin Insulation Co., 578 N.E.2d 926 (Ill. 1991). To determine whether the duty has been triggered, the Court must look to the allegations in the underlying complaints and compare those allegations to the relevant provisions of the insurance policy. Outboard Marine, 607 N.E.2d at 1220. The focus is on the factual allegations in the complaint rather than the legal labels a plaintiff may use. Health Care Indus. Liab. Ins. Program v. Momence Meadows Nursing Ctr., 566 F.3d 689, 696 (7th Cir. 2009) (citing Lexmark Int'l, Inc. v. Transportation Ins. Co., 761 N.E.2d 1214, 1221 (Ill.App.Ct. 2001)). The allegations in the underlying complaints and the insurance policy “must be construed liberally, and any doubt as to coverage must be resolved in favor of the insured.” Ill. State Med. Ins. Servs., Inc. v. Cichon, 629 N.E.2d 822, 826 (Ill.App.Ct. 1994).

1. Underlying Complaints

In determining whether Twin City has a duty to defend, the Court first turns to the allegations in the underlying complaints where the factual allegations, not the legal labels control. Momence Meadows Nursing Ctr., 566 F.3d at 696 (citing Lexmark Int'l, Inc., 761 N.E.2d at 1221). But the allegations “are only important insofar as they point to a theory of recovery.” Id. (citing Wilkin Insulation, 578 N.E.2d at 932).

The underlying complaints alleged Vonachen violated B I PA when it required employees to use a fingerprint-based timekeeping system without obtaining informed consent, failed to inform employees of the risks associated with that data collection including whether it was disclosed to third parties, and failed to maintain and adhere to a public retention policy. B I P A “codifies persons' right to privacy in their biometric identifiers and information.” Krishna Schaumburg Tan, Inc., 2021 IL 125978, ¶ 51 (citing 740 ILCS 14/10; Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197 (Ill. 2019)). It imposes various requirements on private entities in possession of biometric identifiers or information including the following: Section 15(a) requires the establishment of a publicly available biometric data retention and destruction policy; (2) Section 15(b) requires certain disclosures and the obtainment of the subject's informed consent prior to collection; and (3) Section 15(d) prohibits private entities from disclosing an individual's biometric data without their consent. 740 ILCS 14/15. The Act creates a private right of action that permits individuals to seek injunctive relief and statutory or actual damages, whichever is greater. 740 ILCS 14/20.

2. The Employee Handbook

Although not mentioned in the underlying complaints specifically, the timekeeping requirements Vonachen imposed on employees are memorialized in the Employee Handbook. Likewise, the Policy specifically mentions “obligations arising from the handbooks” may give rise to coverage. Before addressing the Policy, the Court must address a preliminary matter: Twin City's attempt to dispute the authenticity of the Handbook and Twin City's contention that the Court cannot consider the Handbook in determining whether a duty to defend exists.

A. Authenticity

In Twin City's Statement of Undisputed Material Facts and Additional Statement of Undisputed Facts, it discreetly remarks, “Twin City is unable to confirm whether the Employee Handbooks are true and correct copies and accordingly submits the accompanying Fed.R.Civ.P. 56(d) Affidavit.” Doc. 23 at 7-8. Rule 56(d) allows a district court to delay considering a summary judgment motion and order additional discovery if the non-movant demonstrates that “it cannot present facts essential to justify its opposition.' Fed.R.Civ.P. 56(d). “The Rule places the burden on the non-movant that believes additional discovery is required to state the reasons why the party cannot adequately respond to the summary judgment motion without further discovery.” MAO-MSO Recovery II, LLC v. State Farm Mut. Auto. Ins. Co., 994 F.3d 869, 877 (7th Cir. 2021) (quoting Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 628 (7th Cir. 2014); Deere & Co. v. Ohio Gear, 462 F.3d 701, 706 (7th Cir. 2006) (internal quotation marks omitted)). It “requires more than a fond hope that more fishing might net some good evidence.” Smith v. OSF HealthCare Sys., 933 F.3d 859, 864 (7th Cir. 2019).

Notably, Twin City did not file an independent Rule 56(d) motion asking the Court to defer ruling on Vonachen's Motion for summary judgment so that Twin City could obtain additional discovery. Rather, Twin City responded to Vonachen's summary judgment motion and likewise moved for judgment based on the same policy provision as Vonachen. Twin City then referenced a Rule 56(d) submission in its statement of facts, which is a separate document from its Response to Vonachen's Motion. See Docs. 23; 25. In essence, Twin City either seeks a declaratory judgment is in its favor or, at least, the denial of judgment in favor of Vonachen by claiming it cannot confirm the authenticity of the Handbook. Rule 56(d) is not meant to be a procedural tactic. Rather, it is generally a mechanism invoked when a party cannot adequately respond to a summary judgment motion, thereby justifying a stay in ruling on the motion while the party can conduct discovery. Twin City attempts to use Rule 56(d) to dispute a discrete fact but does not claim “it cannot adequately respond to the summary judgment motion without further discovery.” See MAO-MSO Recovery II, 994 F.3d at 877. Therefore, Twin City likely waived its opportunity to file a Rule 56(d) motion based on the timing of its submission and failure to clearly articulate it was indeed filing a Rule 56(d) motion. See Deere & Co., 462 F.3d at 706 (stating the non-movant should have filed a Rule 56(d) motion when it became clear that the parties' discovery dispute was not going to be resolved prior to the expiration of its deadline to respond to the summary judgment motion).

Even if Twin City has not waived its request for discovery as to the Handbook, its motion is denied. “Rule 56(d) motions are inappropriate if they are ‘based on nothing more than mere speculation and would amount to a fishing expedition.'” Davis v. G.N. Mortg. Corp., 396 F.3d 869, 885 (7th Cir. 2005) (holding the plaintiffs failed to set forth any specific evidence that might have been obtained from further discovery, which would create a genuine issue as to a material fact). Twin City's Rule 56(d) affidavit does not explain the steps it undertook to authenticate the Handbook or why further discovery is needed on the authenticity of the Handbook. See Woods v. City of Chi., 234 F.3d 979, 990 (7th Cir. 2000) (holding a court can deny a Rule 56(d) motion if the non-movant fails to file an affidavit outlining the party's reasons for needing further discovery). Furthermore, a Rule 56(d) motion must provide a “compelling argument why discovery should be continued.” Balderston v. Fairbanks Morse Engine Div. of Coltec Indus., 328 F.3d 309, 318 (7th Cir. 2003) (discussing former rule 56(f)). An argument raised solely in a statement of facts section in response to summary judgment after a non-movant also submitted a cross motion on the same policy is hardly compelling, particularly, where the litigant could and should have verified the authenticity prior to commencing litigation. See also O'Grady v. Garrigan, No. 20-3357, 2021 WL 4622256, at *2 (7th Cir. Oct. 7, 2021) (“O'Grady did not actually move for a discovery extension until summary-judgment briefing was complete, and he has not justified that delay.”); Kalis v. Colgate-Palmolive Co., 231 F.3d 1049, 1058-59 (7th Cir. 2000) (holding a court did not err in denying motion to compel filed after deadline to respond to summary-judgment motion because movant was “lax in asserting her rights”).

Here, Twin City had ample opportunity to authenticate the Handbook, such as when it agreed to issue Vonachen a policy covering breaches based on employee handbooks, when it repeatedly denied coverage regarding the underlying actions, or when it filed the instant litigation. For example, Twin City conceded that it considered the Handbook when it decided to deny coverage for both the Gumm and Rodriquez Actions. See Doc. 23, at 11-12. Twin City does not dispute that Vonachen responded to Twin City's coverage denial through a letter on March 18, 2020, stating, “[t]he existence and content of Vonachen's Employee Handbooks covering the relevant period of conduct alleged in the Rodriguez Action are hereby provided . . . Vonachen is of course open to any further investigation Twin City requires to verify the existence and content of the Employee Handbooks and the dates they were in force.” Id. at 7, 13-14. Twin City also attempts to use the language in the Handbook against Vonachen where it describes disclaimer language in its “additional material facts” statement in support of its cross motion. Id. at 28. Thus, a prudent insurer would likely have reviewed an employee handbook and verified its contents prior to providing EPL coverage to an employer, so as not to sign up for risks it was not willing to cover. It stands to reason Twin city either obligated itself to unknowns in the Handbook or it reviewed the Handbook before it provided coverage. In light of these considerations, Twin City's veiled attempt to dispute the authenticity of the Handbook is unreasonable.

Assuming Twin City properly raised a Rule 56(d) motion, its motion is denied for failure to explain the steps, if any, it undertook to authenticate the Handbook, articulate why further discovery is needed on the authenticity of the Handbook, or provide a compelling argument why discovery should be continued.

B. Extrinsic Evidence

Vonachen maintains the Court must consider the Handbook because one of the coverage parts explicitly provides coverage for violations of obligations arising from the handbook. Doc. 21, at 7, 9-11. Therefore, it is impossible to know whether there is potential liability arising from the Handbook without reviewing it. Id. (citing Pekin Ins. Co. v. Wilson, 930 N.E.2d 1011, 1020 (Ill. 2010); Illinois Emcasco Ins. Co. v. Waukegan Steel Sales Inc., 2013 IL App (1st) 120735). T w i n City urges the Court to ignore Vonachen's extrinsic evidence of the Handbook because it is irrelevant to the duty to defend inquiry. Doc. 25, at 11, 13 (citing State Farm Fire & Cas. Co. v. Young, 968 N.E.2d 759, 764-65 (Ill.App.Ct. 2012); National Fire Ins. of Hartford v. Walsh Construction Co., 909 N.E.2d 285, 292-93 (Ill.App.Ct. 2009)).

To the extent Twin City asserts the Court cannot view extrinsic evidence, that restriction is not applicable here. Such restriction only applies when an insurer “den[ies] coverage without seeking a declaratory judgment or defend[s] under a reservation of rights” and a court is deciding the limited question of whether “the insurer justifiably refused to defend the action based solely on the allegations in the complaint.” Landmark Am. Ins. Co. v. Hilger, 838 F.3d 821, 824 (7th Cir. 2016). Here, Twin City sought a declaratory judgment and already conceded that it considered the handbook when it denied coverage. See Doc. 25, at 14 n.4 (“[Twin City] considered [the Employee Handbooks] and rejected their relevance to the coverage.”). Therefore, the parties may present extrinsic evidence beyond the complaint so long as “doing so will not decide an ultimate issue in the underlying actions.” Landmark Am. Ins. Co., 838 F.3d at 825 (citing Fid. & Cas. Co. of N.Y. v. Envirodyne Eng'rs, Inc., 461 N.E.2d 471, 474-75 (Ill.App.Ct. 1983)); Pekin Ins. Co., 930 N.E.2d at 1020 (“If a crucial issue will not be determined, we see no reason why the party seeking a declaration of rights should not have the prerogative to present evidence that is accorded generally to a party during a motion for summary judgment in a declaratory proceeding.”). That right to present extrinsic evidence beyond the pleadings flows to both the insurer and insured. Pekin Ins., 930 N.E.2d at 1022; Federated Mut. Ins. Co. v. Coyle Mech. Supply Inc., 983 F.3d 307, 314 (7th Cir. 2020). “An ‘ultimate issue' is one that would collaterally estop the plaintiff in the underlying lawsuit from raising a theory of recovery or be crucial to the insured's liability.” Landmark Am. Ins. Co., 838 F.3d at 825 (citing Envirodyne Eng'rs, 461 N.E.2d at 475 474-75).

The Court agrees with Vonachen on this issue. As later discussed, the Policy covers “obligations arising from the handbooks.” Thus, it is impossible to know whether there is potential liability arising from the Handbook without reviewing it and both Parties rely on provisions of the Handbook for their respective arguments. The Court's mere consideration of whether obligations arising from the handbooks potentially give rise to coverage under the Policy will not determine an ultimate issue in the underlying actions. It will not preclude the plaintiffs from raising a theory of recovery or determine Vonachen's liability in those actions. Thus, the Court will consider the Handbook in determining whether Twin City has a duty to defend Vonachen.

3. Insurance Policies

With the above allegations in mind, the Court now turns to the D&O and EPL insurance policies. Under Illinois law, the Court must review the language of the policy to ascertain and give effect to the intention of the parties. Founders Ins. Co. v. Munoz, 930 N.E.2d 999 (Ill. 2010). The policy must be considered as a whole, and every provision rather than an isolated part, should be examined to determine whether an ambiguity exists. Id. at 1004. If there are no ambiguities, then the policy must be construed according to the plain and ordinary meaning of its terms. River v. Commercial Life Ins. Co., 160 F.3d 1164, 1169 (7th Cir. 1998). Any ambiguities in the provisions of an insurance policy and doubts as to coverage are construed against the drafter of the contract, the insurer, and in favor of the insured. Wilkin Insulation, 578 N.E.2d at 930. A policy provision may be considered ambiguous if the policy language is susceptible to more than one reasonable interpretation. Founders, 930 N.E.2d at 1004. In assessing the parties' intentions in an insurance contract, courts consider “the type of insurance purchased, the nature of the risks involved, and the overall purpose of the contract.” Nicor, Inc. v. Associated Elec. & Gas Ins. Servs. Ltd., 860 N.E.2d 280, 286 (Ill. 2006) (internal citations omitted). See e.g., BASF AG v. Great Am. Assur. Co., 522 F.3d 813, 822 (7th Cir. 2008) (“It seems extremely unlikely to us that the parties intended antitrust and racketeering claims to be covered-or even potentially covered-by a policy definition that sounds in libel, slander, and disparagement.”).

A. D&O Coverage

Vonachen claims the underlying actions are covered under the D&O coverage part. This portion of the Policy states, “the Insurer shall pay Loss on behalf of an Insured Entity resulting from an Entity Claim first made against such Insured Entity during the Policy Period or Extended Reporting Period, if applicable, for a Wrongful Act by an Insured Entity.” Doc. 22-1, at 23. A “Wrongful Act” is described, in part, as an “[e]rror, misstatement, misleading statement, act, omission, neglect, or breach of duty . . .” Id. at 27. In applying the above definitions, Vonachen contends the underlying actions are Entity Claims within the meaning of Policy because they are civil proceedings commenced by the service of a complaint and the BIPA allegations meet the broad definition of Wrongful Act. Doc. 27, at 7. Twin City does not contest the allegations in the underlying complaints fall within the D&O coverage, rather, it claims two exclusions apply.¹⁰

10 The full wording of these exclusions is laid out in the background section of this Opinion. See supra sec. I(C).

The insurer has the burden to affirmatively demonstrate that a coverage exclusion applies. Am. Bankers Ins. Co. of Fla. v. Shockley, 3 F.4th 322, 330 (7th Cir. 2021) (citing Pekin Ins. Co. v. Miller, 854 N.E.2d 693, 697 (Ill.App.Ct. 2006)). “A decision to excuse an insurer's duty to defend based on an exclusionary clause in the contract ‘must be clear and free from doubt.'” Zurich, 990 F.3d at 1078 (quoting Evergreen Real Est. Servs., LLC v. Hanover Ins. Co., 142 N.E.3d 880, 887 (Ill.App.Ct. 2019)). Exclusions are construed against the insurer and reasonable disagreement as to the applicability of an exclusion must be resolved in favor of the insured. Id.

Here, Twin City asserts both the “Insured v. Insured Exclusion” and “Invasion of Privacy Exclusion” bar coverage. Docs. 25, at 17; 28, at 5. Meanwhile, Vonachen maintains Twin City has not met its heavy burden to demonstrate an exclusion bars coverage, therefore it must defend Vonachen under the D&O coverage. Doc. 27, at 7. The Court will address the exclusions in turn.

1. Insured v. Insured Exclusion

a. The Parties' Positions

The “Insured v. Insured Exclusion, ” states: “[t]he Insurer shall not pay Loss. . . (G) in connection with any Claim brought or maintained by or on behalf of any Insureds (in any capacity) or any security holder of an Insured Entity . . .” Doc. 25, at 17. Twin City claims employees qualify as “Insureds” and Vonachen is considered an “Insured Entity” under the Policy. Id. Therefore, because an employee has brought a claim on behalf of herself and other employees, against Vonachen, it falls under the Insured v. Insured Exclusion. Id.

Vonachen does not disagree with Twin City's interpretation but argues an exception to the exclusion applies. Within the “Insured v. Insured Exclusion, ” there is an exception to the exclusion stating, “this exclusion shall not apply to the portion of Loss directly resulting from . . . (9) a civil proceeding as a result of Whistleblowing.” Doc. 22-1, at 29. “Whistleblowing” is defined as “an Insured Person's lawful act of providing information, causing information to be provided, or otherwise assisting in an investigation regarding any conduct which the Insured Person reasonably[sic] believes constitutes a violation of any federal, state or foreign law.” Id. at 26. In Vonachen's view, the plaintiffs in the underlying actions fit the definition of “whistleblowing” because they are “insured persons” under the Policy who lawfully provided information by way of their complaints for alleged BIPA violations. Doc. 27, at 10. Vonachen further remarks the “Seventh Circuit has repeatedly noted that an insured vs. insured exclusion is meant to remove ‘from coverage both ‘collusive suits-such as suits in which a corporation sues its officers or directors in an effort to recoup the consequences of their business mistakes' … as well as ‘suits arising out of those particularly bitter disputes that erupt when members of a corporate, as of a personal, family have a falling out and fall to quarreling.'” Id. at 11 (citing Miller v. St. Paul Mercury Ins. Co., 683 F.3d 871, 874 (7th Cir. 2012) (internal quotation marks and citation omitted). Therefore, Vonachen's interpretation of the whistleblower exception is reasonable as the underlying actions do not fall under either category articulated by the Seventh Circuit. Id.

Twin City disagrees with Vonachen's interpretation. Doc. 28, at 5-6. It argues the class representatives are not “providing information” or “assisting in an investigation, ” rather, they are litigating their own rights in seeking redress for invasions of privacy. Id. at 5. Furthermore, by ignoring the phrase “as a result of whistleblowing” in the exception, Vonachen's interpretation would render the exception to the exclusion meaningless because then virtually any claim by an insured against another insured regarding an alleged violation of law would be included. Id. at 6 (citing Jackson Martindell v. Lake Shore Nat'l Bank, 15 Ill.2d. 272, 283, for the principle that contracts must be construed as a whole).

b. Analysis

At first blush, the Court would agree with Twin City's interpretation of the whistleblower exception if it were defined more narrowly. Twin City overlooks that its definition of “whistleblowing” is broad and where there is reasonable disagreement as to the applicability of an exclusion, it must be resolved in favor of the insured. Zurich, 990 F.3d at 1078 (quoting Evergreen Real Est. Servs., 142 N.E.3d at 887). Unlike the Illinois whistleblower statute, the Policy does not define whistleblowing as providing information to a “government or law enforcement agency” but rather uses the term “investigation” without any qualifiers. Compare 740 ILCS 174/10 Whistleblower Act (“An employer may not make, adopt, or enforce any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency if the employee has reasonable cause to believe that the information discloses a violation of a State or federal law, rule, or regulation.”), with the Policy, Doc. 22-1, at 26 (“‘Whistleblowing' means an Insured Person's lawful act of providing information, causing information to be provided, or otherwise assisting in an investigation regarding any conduct which the Insured Person reasonable believes constitutes a violation of any federal, state or foreign law.”) (emphasis added). Although one may typically think of a whistleblower in the context of providing information in a government or law enforcement investigation, the whistleblowing definition here is much broader. Twin City's definition of “Retaliation, ” which is often related to the notion of whistleblowing, in the EPL coverage, likewise uses similarly broad language as Twin City's “Whistleblowing” definition. It states “Retaliation” means the adverse treatment of an Employee “(3) assisting, testifying, or cooperating with a proceeding or investigation regarding alleged violations of law by any Insured.” Doc. 22-1, at 33-36. The next inclusion also covers “(4) disclosing or threatening to disclose alleged violations of law to a superior or to any governmental agency.” Id. Notably, Twin City did not use this language of disclosing alleged violations “to a superior or to any governmental agency” in its whistleblowing definition. Therefore, based on a plain reading of the Policy and considering it as a whole, “whistleblowing” is broad and does not require disclosure to a government or law enforcement as one might typically view the concept of whistleblowing.

Twin City also takes issue with the phrase “as a result of whistleblowing” in the exception. In applying the Policy's definition, the class representatives in the underlying actions provided information for investigation by way of their civil complaints initiating the lawsuits which would undoubtedly involve some type of discovery and based on their complaints they believed Vonachen violated a state law, BIPA. Arguably a class action for BIPA violations could be considered a whistleblowing action under this broad definition. Rodriguez is not only adjudicating her own rights as class representative but also the rights of others and bringing to light numerous alleged violations of Illinois law.

As to rendering the exclusion meaningless, Twin City chose to draft the definition in this manner, therefore, it could have chosen a narrower definition but did not. Moreover, the exception further states, “this carve back shall not apply if such whistleblower is a Manager and the proceeding is brought against the Insured Entity.” While there is no assertion that a manager brought the underlying actions, the latter language suggests the whistleblowing exception applies to proceedings against an insured entity, or here the employer, which is often the context in which whistleblowing is discussed. Therefore, there could still be insured v. insured suits for a violation of the law that may not be covered. However, in another section of Twin City's briefing, it contends the putative class action may include non-employees. See Doc. 23, at 10. T o the extent Twin City asserts the underlying actions are not limited to employees, the Court questions how that affects Twin City's position as to the Insured v. Insured Exception. The Parties have not addressed whether this exclusion bars coverage where the underlying lawsuit has been brought by insured and non-insured individuals, as D&O policies are generally intended to provide coverage for claims by third parties. As whole, it seems the D&O was not meant to coverage employment claims based on the exclusions. Ye t, it does include the whistleblower exception, which often include employees.

Based on the above considerations, Vonachen has shown the exception to the “Insured v. Insured Exclusion” applies. However, as discussed below the Court finds Twin City has met its burden to show it is clear and free from doubt that the “Invasion of Privacy Exclusion” in the D&O coverage applies, thereby defeating coverage under the D&O. With that said, the Court takes issue with how the insured v. insured exclusion/whistleblower exception in the general exclusions and exclusions appliable to “Insuring Agreement (C)” are to be read together, specifically the “Invasion of Privacy Exclusion.” Doc. 22-1, at 30. In the next section of Policy, there are also exclusions for claims involving employment-related wrongful acts, discrimination or sexual harassment, and unfair trade practices or any violation of the Federal Trade Commission Act or any similar laws, intellectual property, and categories of products liability. This begs the question of what does the whistleblower exception include? Does the combination mean the whistleblower coverage becomes extremely narrow? The Parties did not address how these exclusions are to be read together. Therefore, the Court declines to do so.

2. Invasion of Privacy Exclusion

a. The Parties' Positions

Twin City further claims the invasion of privacy exclusion applies, which states the insurer “shall not pay Loss under Insuring Agreement (C) in connection with any Claim based upon, arising from, or in any way related to any actual or alleged . . . invasion of privacy.” Doc. 25, at 16. In Twin City's view, the allegations in the underlying complaints clearly implicate an invasion of privacy exclusion based on the language of the complaints themselves.

In Paragraph 43 of the Amended Complaint in the Rodriquez Action the Plaintiffs allege “By capturing and collecting, storing, using and/or disclosing Plaintiff's and the Class member's biometric identifiers and information described herein, Defendant violated Plaintiff's and the Class member's rights to privacy”. In Paragraph 33 of the Complaint in the Gumm Action the Plaintiffs allege “By collecting Plaintiff's unique biometric identifiers or biometric information without

her consent . . . Defendant invaded Plaintiff's statutory right to privacy in her biometric[s].”

Id. (internal citations omitted).

Regarding the “Invasion of Privacy” exclusion, Vonachen argues “Illinois law is clear that procedural BIPA violations do not constitute an ‘invasion of privacy,' as that term is used in the D&O section of the policy.” Doc. 27, at 7. According to Vonachen, a person's right to privacy is only violated under BIPA if the biometric information is “collected surreptitiously or disseminated to third parties without the person's consent.” Id. (citing Colon v. Dynacast, LLC, No. 19-cv-4561, 2019 WL 5536834 (N.D.Ill. Oct. 17, 2019) (involving violation of 740 ILCS 14/15(a), (b)). Vonachen then proclaims the underlying actions did not allege any disclosure, release, or misuse violations. Id. at 8. Rather, the plaintiffs only alleged procedural violations where they did not face an appreciable risk of harm to their privacy interests because, like the employees in Dynacast, they were aware that Vonachen collected and used their biometric information for timekeeping purposes. Id.

b. Analysis

The exclusions specific to “Insuring Agreement (C)” for Entity Claims, provides,

(A) The Insurer shall not pay Loss under Insuring Agreement (C) in connection with any Claim based upon, arising from, or in any way related to any actual or alleged:

* * *

(4) false arrest or imprisonment, abuse of process, malicious prosecution, defamation (including libel and slander), invasion of privacy, trespass, nuisance or wrongful entry or eviction, assault, battery or loss of consortium;

Doc. 22-1, at 30. At issue here is application of the phrases “invasion of privacy” and “in any way related to any actual or alleged.” “Invasion of Privacy” is not defined by the Policy, but it is listed among various common law torts such as malicious prosecution, defamation, and nuisance.

i. Invasion of Privacy

Vonachen attempts to re-write the underlying complaints and distance the complaints from the term “invasion of privacy” by asserting the actions do not allege any potential disclosure, release, or misuse violations. Doc. 27, at 7-8. However, the underlying complaints invoke BIPA violations based on provisions 15(a), 15(b), and 15(d) regarding informed consent and disclosure violations. The Gumm complaint further alleged that Vonachen invaded the plaintiffs' right to privacy, which is statutorily protected by BI PA .

Vonachen's argument that a person's right to privacy is only violated under BIPA if the biometric information is “collected surreptitiously or disseminated to third parties without the person's consent” is absurd in light of the ample caselaw from the Illinois Supreme Court and federal courts, which recognize BIPA violations as invasions of privacy. In particular, Vonachen claims “Illinois law” is clear that “procedural BIPA violations” are not invasions of privacy. Vonachen is wrong for three reasons.

First, the notion of a “procedural violation” regards an Article III standing inquiry. Vonachen focuses on Article III standing, which is not the relevant inquiry. The contract is governed by Illinois law. Illinois' definition of a right to privacy in the context of BIPA and insurance policies should be the focus, not the interpretation of Article III standing. Even if it were the appropriate focus, the Seventh Circuit has held a plaintiff meets Article III standing when alleging a failure to provide requisite notices and obtain informed consent as enumerated in sub-section 15(b). See Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), as amended on denial of reh'g and reh'g en banc (June 30, 2020) (holding an entity's failure to comply with the informed-consent requirements of section 15(b) gave rise to both an informational injury and invasion of the plaintiff's private domain, which met Article III standing requirements); Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1154 (7th Cir. 2020) (citing Bryant, 958 F.3d 617 at 623-24) (“[In Bryant], we reasoned that BIPA protects individual privacy interests in biometric data, and a violation of some of its provisions was akin to a tortious invasion of privacy. . . ‘Bryant was asserting a violation of her own rights-her fingerprints, her private information,' which ‘was an invasion of her private domain, much like an act of trespass would be.'”) (emphasis added)). Furthermore, the Seventh Circuit's opinion in Bryant arguably overruled the district court's opinion in Dynacast, 2019 WL 5536834 as it relates to the Article III standing regarding BIPA's informed-consent provision, section 15(b). The opinion in Bryant was issued months before summary judgment briefing in this case commenced and Bryant specifically cited to Dynacast as a case that oppositely held the plaintiffs lacked standing for a section 15(b) violation without a further alleged harm. Therefore, Vonachen's reliance on Dynacast is ill-timed.

Second, Illinois caselaw establishing BIPA violations as an invasions of privacy was available prior to the initiation of this lawsuit. In 2019, the Supreme Court of Illinois issued a landmark opinion interpreting BIPA, Rosenbach, 129 N.E.3d at 1206.

Through the Act, our General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information. See Patel v. Facebook Inc., 290 F.Supp.3d 948, 953 (N.D. Cal. 2018). The duties imposed on private entities by section 15 of the Act (740 ILCS 14/15 (West 2016)) regarding the collection, retention, disclosure, and destruction of a person's or customer's biometric identifiers or biometric information define the contours of that statutory right. Accordingly, when a private entity fails to comply with one of section 15's requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach.

* * *

The Act vests in individuals and customers the right to control their biometric information by requiring notice before collection and giving them the power to say no by withholding consent. Patel, 290 F.Supp.3d at 953. . . When a private entity fails to adhere to the statutory procedures, as defendants are alleged to have done here, “the right of the individual to maintain his or her biometric privacy vanishes

into thin air. The precise harm the Illinois legislature sought to prevent is then realized.” Id. This is no mere “technicality.” The injury is real and significant.

Id. (emphasis added). These sentiments from the Illinois Supreme Court have reverberated throughout Illinois state courts and federal courts. See e.g., Acaley v. Vimeo, Inc., 464 F.Supp.3d 959, 969 (N.D.Ill. 2020) (“BIPA claims generally relate to or arise from invasion of privacy. . . Federal district courts, including this Court, also have described the Illinois legislature as creating a “legal right to privacy” in BIPA and have characterized lawsuits brought under BIPA as “[i]nvasion of privacy lawsuits.”); Dixon v. Washington & Jane Smith Cmty.-Beverly, No. 17 C 8033, 2018 WL 2445292, at *9 (N.D.Ill. May 31, 2018); Patel v. Facebook Inc., 290 F.Supp.3d 948, 953-54 (N.D. Cal. 2018)). Recently, in Krishna, the Illinois Supreme Court reiterated BIPA protects an individual's right to privacy which includes “a secrecy interest-here, the right of an individual to keep his or her personal identifying information like fingerprints secret.” Krishna Schaumburg Tan, Inc., 2021 IL 125978, ¶ 46 (citing 740 ILCS 14/15(d); Meegan v. NFI Industries, Inc., No. 20 C 465, 2020 WL 3000281, at *3 (N.D.Ill. June 4, 2020)). Therefore, “disclosing a person's biometric identifiers or information without their consent or knowledge necessarily violates a person's right to privacy in biometric information.” Id. (citing Dixon, No. 17 C 8033, 2018 WL 2445292, at *9).

Finally, to the extent Vonachen claims an “invasion of privacy” within the meaning of BIPA has been analyzed by a court interpreting a D&O policy, no such caselaw existed at the time the Parties' submitted their briefs. Likewise, the caselaw that exists now does not address a D&O policy. See Krishna Schaumburg Tan, Inc., 2021 IL 125978 (addressing whether a personal or advertising injury falling within or potentially within coverage for a business liability policy).

In conclusion, there are a number of cases that have held a BIPA violation is an invasion of privacy so regardless of whether the plaintiffs in the underlying actions even used the terminology “invasion of privacy, ” there is caselaw establishing it. Rosenbach, 129 N.E.3d at 1206. Similarly, in Krishna, the insurer did not define the phrase “right to privacy.” Id. at ¶ 45. After considering dictionary definitions, courts' recognition of privacy interests, and the General Assembly's codification of an individual's right to privacy in and control over one's biometrics through BIPA, the court held the underlying plaintiff's allegation that her biometrics were disclosed to a third party potentially fell within the meaning of a “right to privacy” covered by the policy. Id. at ¶ 46.

ii. “Based Upon, Arising From, or in Any Way Related to Any Actual or Alleged”

Turning back to the language in the Policy, there is broad language preceding the callout for an invasion of privacy, which states “based upon, arising from, or in any way related to any actual or alleged[.]” Illinois courts have consistently found that the language “arising out of is a broad and vague phrase. Dash Messenger Serv., Inc. v. Hartford Ins. Co. of Illinois, 582 N.E.2d 1257, 1262 (Ill.App.. Ct. 1991); G.M. Sign, Inc, 18 N.E.3d at 78.

This case presents the converse of Mesa Lab 'ys, Inc. v. Fed. Ins. Co., where the Seventh Circuit was presented with: “When an insurance policy provides that the insurer has no duty to defend its insured against any claim ‘arising out of the TCP A, does that exclusion extend to common-law claims arising from the TCPA-violating conduct?” 994 F.3d 865, 866 (7th Cir. 2021). There, the court held the common-law claims of conversion, nuisance, and trespass to chattels arose out of the same underlying conduct as the statutory claims, which was the sending of unsolicited faxes. Id. at 869. “[T]he ‘arising out of phrase presents a ‘but-for' inquiry: if the plaintiff would not have been injured but for the conduct that violated an enumerated law, then the exclusion applies to all claims flowing from that underlying conduct regardless of the legal theory used.” Id. (quoting Zurich Am. Ins., 990 F.3d at 1079). Moreover, as Vonachen repeatedly reminds the Court, the focus is the conduct alleged in the underlying complaints, not the legal theory. See Docs. 21, at 12; 27, at 2-3. The Policy here uses even broader language, “based upon, arising from, or in any way related to any actual or alleged . . . invasion of privacy.” In applying the “but-for” inquiry, none of the underlying plaintiffs' alleged injuries would have occurred but for Vonachen collecting employees' data without their consent, therefore the common law exclusion applies to the statutory claim as well.

The further language “in any way related to any actual or alleged” is incredibly broad, suggesting only a minimal connection is necessary. See R & B Kapital Dev., LLC v. N. Shore Cmty. Bank & Tr. Co., 832 N.E.2d 246, 252 (Ill.App.Ct. 2005); Hanover Ins. Co. v. R.W. Dunteman Co., 446 F.Supp.3d 336, 346 (N.D.Ill. 2020) (citing People ex rel. Scott v. Silverstein, 418 N.E.2d 1087, 1089 (Ill.App.Ct. 1981)). The plain reading of that phrase demonstrates the invasion need not even be alleged; it can be “any actual.” Therefore, the exclusion broadly encompasses invasions beyond common-law torts with the phrase anything “in any way related to any actual or alleged” invasion of privacy. The above discussion of courts' interpretations of BIPA demonstrate violations are actual invasions of privacy (whether one likens it to a statutory claim or common law claim). Thus, the BIPA violations alleged here are at least, “related to any actual or alleged” common law invasion of privacy.

Therefore, based on the Illinois Supreme Court's interpretation of BIPA and the Seventh Circuit's holdings in Zurich and Mesa, the exclusion for invasions of privacy is clearly broad enough to exclude the BIPA violations alleged here.

B. EPL Coverage

Employment Practices Liability Insurance is growing area of insurance that responds to the dramatic increase in lawsuits arising from employment relationship. § 4:57. In general, Law of Corp. Officers & Dir.: Indemn. & Ins. § 4:57 (West 2021). Likewise, this lawsuit here involves another growing area of the law, data privacy statutes, in particular, Illinois' BIPA statute, which allows for a private right of action. Coverage in EPLI policies typically include claims arising as a result of discrimination, sexual harassment, wrongful termination, and other workplace torts. § 4:58. Employment practices liability insurance-What is covered, Law of Corp. Officers & Dir.: Indemn. & Ins. § 4:58 (West 2021). Here, it is a close call as to whether the underlying actions are within the EPL Coverage. But any doubts as to coverage must be construed in favor of the insured. Wilkin Insulation, 578 N.E.2d at 930; United Fire & Cas. Co. v. Prate Roofing & Installations, LLC, 7 F.4th 573, 580 (7th Cir. 2021).

1. Breach of Employee Handbook Obligations

a. The Parties' Positions

Vonachen argument for EPL coverage is as follows: an “Employment Practices Wrongful Act” includes a “breach of any oral, written, or implied employment contract, including, without limitation, any obligation arising from a personnel manual, employee handbook.” Doc. 21, at 9 (emphasis added). Vonachen's Handbook requires employees to use the designated timekeeping system or face penalties for non-compliance including termination. Id. The Handbook also states Vonachen “will comply with all applicable laws and regulations.” Id. Therefore, because the Handbook requires Vonachen to use the timekeeping system, and Vonachen has obligated itself to comply with all laws associated with that system, including BIPA, Twin City's duty to defend has been triggered based on the alleged B I P A violation in the underlying complaints. Id. at 8-9.

In response, Twin City disclaims EPL coverage because the Handbook does not support a breach of contract claim based on the disclaimer in the Handbook that it does not create contractual obligations and the underlying complaints do not implicate the Handbook or a breach of contract claim. Doc. 25, at 14. Additionally, Twin City contends Vonachen's interpretation of the policy is patently unreasonable because it assumes that “any lawsuit alleging any violation of any state or federal law or regulation” constitutes a claim for breach of the Handbook, thereby creating a “moral hazard.” Id. at 15 (emphasis in original). For support, Twin City cites Farmers Auto Ins. Ass'n v. St Paul Mercury Ins. Co., 482 F.3d 976, 978 (7th Cir. 2007) for the proposition that “insurance policies are presumed not to insure against breaches of contract” and “[n]o insurance company would knowingly write a policy that would enable the insured to trigger coverage any time it wanted a windfall.” Id.

In reply, Vonachen distinguishes cases cited by Twin City, reiterates that the legal labels characterizing the underling allegations are not determinative but rather the facts themselves, and asserts the disclaimer in the Handbook does not affect the Twin City's duty to defend. Doc. 27, at 4. On the issue of the disclaimer, Vonachen emphasizes, “[a]n insurer cannot escape its duty to defend just because the claim triggering its obligation is defensible, ” then quotes the Policy where Twin City agreed it “shall have the right and duty to defend Claims covered under the Policy, even if such Claim is groundless, false or fraudulent.” Id. (citing Doc. 22-1, at 15). Vonachen further claims that it is unclear whether it would even prevail on a disclaimer defense based on Illinois caselaw. Id. at 5 (citing Wheeler v. Phoenix Co. of Chicago, 276 Ill.App.3d 156, 160-162 (1995); Hicks v. Methodist Med. Ctr., 229 Ill.App.3d 610 (1992); Perman v. ArcVentures, Inc., 196 Ill.App.3d 758 (1990)). Twin City replies to this argument to remark that the disclaimer is not merely a defense that Vonachen can raise, rather, the disclaimer prevents establishing the elements for a prima facie breach of contract claim. Doc. 28, at 3-4.

b. Analysis

In comparing the allegations in the Complaint to the insurance policies, the Court finds the conduct alleged in the underlying complaints potentially falls within the EPL coverage.

i. The Complaints and Handbook

Vonachen is essentially relying on the notion that the facts give rise to a breach of written or implied contract based on the agreement that the employees clocked-in using biometrics as required by the Handbook, and Vonachen agreed to comply with all laws. Here, the underlying complaints repeatedly alleged that Vonachen required employees to clock-in and clock-out of a shift or for breaks using finger-print timekeeping system which collects biometrics:

3. . . . Defendant uses a biometric time-tracking system that requires its workers throughout Illinois to use their fingerprints as a means of authentication. When Defendant's Illinois workers begin their time with Defendant, Defendant requires them to scan their fingers into a time management database.

* * *

18. . . . Defendant uses a time-tracking system that requires its workers to use their fingerprints as a means of authentication. Unlike a traditional timeclock, workers are required to use their fingerprints to “punch” in and out of work.

* * *

26. Defendant required Plaintiff to use a fingerprint-based timekeeping system. Thus, every time Plaintiff clocked in or out of a shift, or for a rest or meal break, Defendant captured, collected, or otherwise obtained Plaintiff's biometric identifier.

* * *

38. Every time Plaintiff and the Class members clocked in or out for a shift, or for a rest or meal break, Defendant obtained a scan of their fingerprints. Those scans mapped the geometry of Plaintiff's and the Class members' fingers, and Defendant used that geometry to identify them as they clock and out of work.

Rodriquez Complaint ¶¶ 3, 18, 26, 38 (emphasis added).

8. . . . Defendant collected . . . associated personally identifying information of hundreds of its employees (and former employees), who are being required to “clock in” with their fingerprints and/or handprints.

* * *

9. This practice of requiring employees to “clock in” using their fingerprints and/or handprints was in place at least since approximately February 2017.

* * *

22. . . . Defendant scanned and collected, and then indefinitely stored in an electronic database, digital copies of each employee's fingerprints and/or handprints during the employee onboarding process from at least approximately February 2017 to at least approximately October 2017 . . .

* * *

26. During the course of plaintiff's employment, Defendant required Plaintiff to place her fingers and hand on a fingerprint scanner, at which point Defendant scanned and collected, and stored in an electronic database, digital copies of Plaintiff's fingerprints and/handprints.

* * *

27. Plaintiff worked for Defendant until approximately October 2017. During her employment tenure, Plaintiff was required to place her fingers and hand on a fingerprint scanner, which scanned, collected and stored her fingerprints and/or hand geometry each time she “clocked” in and out as part of the timekeeping system.

Gumm Complaint ¶¶ 8, 9, 22, 26, 27 (emphasis added). The Gumm Complaint further alleged that scanning their fingerprints gave them access to Defendant's facility to work and Defendant collected their fingerprints during the employee on-boarding process. ¶ 29.

The Handbook sheds light on where that requirement imposed on employees originates. There is a section dedicated to the timekeeping requirements. See Doc. 22-2, at 28. It states, “All hourly-paid employees are required to record their time worked by a designated system (phone-in, time clock, or time-card). Employees are required to record their time (‘punch-in') at the beginning of the work day and to record their time (‘punch-out') at the end of the work day.” Id. The section references discipline associated with this requirement. “Employees must also use the approved method or device to punch in and out. Violations of the policy will be subject to progressive discipline up to and including termination.” Id. (emphasis added). Similarly, “Employee Conduct and Disciplinary Action” section of the Handbook lists misuse of timekeeping records as a basis for progressive disciplinary action. Id. at 14. The Parties agree that this section fails to discuss privacy risks related to the collection, storage, use, or disclosure of the employees' biometric information. Doc. 23, at 8.

ii. The Policy

Turning to the Policy, as a whole, Twin City agreed to provide coverage based on any obligation arising from an employee handbook in its Policy titled “Employment Practices Liability.” If it was not willing to do so, then it could have omitted it from its Policy. As the Court remarked earlier, a prudent insurer would have reviewed an employee handbook prior to providing EPL coverage to employers so as not to sign up for risks it was not willing to cover. The purpose of an insurance contract is risk management. Moreover, contracts are construed against the drafter.

Here the drafter included three notable inclusions that covered “employments practices wrongful act”: “(5) breach of any oral, written, or implied employment contract, including, without limitation, any obligation arising from a personnel manual, employee handbook, or policy statement.” Doc. 22-1, at 35 (emphasis added). Based on the plain language of the Policy, it assumes a (1) personnel manual, (2) employee handbook, or (3) policy statement can give rise to a contractual obligation. The section is silent on whether those obligations apply to the employer or employee. A plain reading of the provision would indicate that obligations could be imposed on either. The Policy specifically states there are no limitations on the inclusion of those obligations. It uses the broad terms “arising from” and “obligation.” The coverage is also broad in that includes implied employment contracts. If the section only included “oral, written, and implied employment contracts” then the outcome in this case may be different. However, the Policy went further to specifically include “without limitation, obligations arising from a[n]. . . employee handbook”, thereby crossing the line into “arguably providing coverage” based on the allegations in the underlying complaint.

iii. Comparison

Although the Handbook may not have been intended to create a contract or contractual obligations through its inclusion of a disclaimer, that does mean a court could not make a finding that the Handbook did. The Illinois Supreme Court has held that “an employee handbook or other policy statement creates enforceable contractual rights if the traditional requirements for contract formation are present.” Duldulao v. Saint Mary of Nazareth Hosp. Ctr., 505 N.E.2d 314, 318 (Ill. 1987). There are three requirements:

First, the language of the policy statement must contain a promise clear enough that an employee would reasonably believe that an offer has been made. Second, the statement must be disseminated to the employee in such a manner that the employee is aware of its contents and reasonably believes it to be an offer. Third, the employee must accept the offer by commencing or continuing to work after learning of the policy statement. When these conditions are present, then the employee's continued work constitutes consideration for the promises contained in the statement, and under traditional principles a valid contract is formed.

Id.

Here, the Court makes no finding as to whether the Handbook is a contract, that is an issue for the state court to decide. It is not lost on the Court that the Handbook may indeed have little relevance in the underlying actions. However, the standard is whether the conduct alleged in the complaint is “potentially” or “at least arguably within one or more of the categories of wrongdoing that the policy.” Zurich Am. Ins. Co., 990 F.3d at 1078; Del Monte Fresh Produce N.A., Inc. v. Transportation Ins. Co., 500 F.3d 640, 644 (7th Cir. 2007). Additionally, the allegations of the underlying complaints and the insurance policy “must be construed liberally, and any doubt as to coverage must be resolved in favor of the insured.” Cichon, 629 N.E.2d at 826. The Handbook arguably creates obligations on both parties - employees agree to clock-in and out as described and that the entity has obligated itself to comply associated laws applying to the handbook. The Policy assumes that Handbook and obligations arising from them can become written or implied contracts. This is interrelated to the next issue of an “employment-related invasion of privacy” addressed in the next section of this Opinion.

While there is a disclaimer in the Handbook, there are other provisions that suggest a Court could determine the Handbook, or a portion of it, is a contract. The “Employee Acknowledgment” section includes various “terms of employment” to which an employee “agrees.” For example, the jury waiver reflects an agreement applying to both the employee and Vonachen, emphasized in capital letters: “I ALSO AGREE, AS DOES Vonachen Group, TO WAIVE ALL RIGHTS TO A TRIAL BY JURY ON ANY CLAIM ONE MAY ASSERT AGAINST THE OTHER IN A COURT OF LAW.” Doc. 22-2, at 31. That section also includes language that an employee agrees to file any lawsuit related to his or her employment or termination of employment with Vonachen within six months of the date the action arose. Id. A severability clause as to the invalidity or unenforceability of any provisions of the “Acknowledgment/Agreement” also appears in this section. Id. Again, the Court makes no finding as to whether the Handbook is a contract but notes that it could be construed as such by a state court.

iv. Twin City's Other Arguments

Tw i n City misapplies the term “windfall” as it was used by the Seventh Circuit in Farmers Auto. Ins. Ass'n, 482 F.3d at 978. There, the court remarked that an employer would unjustly enrich itself or receive a “windfall” by saving money in shorting employees overtime wages then invoking insurance coverage to cover the cost of overtime the employer failed to pay. Twin City fails to explain how Vonachen would be receiving a windfall by violating BIPA. For example, it does not allege Vonachen has profited from the data it collected in some way. As to the windfall in a breach of contract suit mentioned in Farmers Auto. Ins. Ass'n, that scenario typically means a party will profit more by breaking a contract than keeping it. Thereby, receiving a windfall for a breach of contract. However, again, that is not the same situation as presented here. In fact, Twin City has a provision to avoid the windfall described in Farmers Auto - it excludes coverage for losses in connection with any claim related to unpaid wages, including overtime, in both its D&O and EPL coverage parts. See Docs. 22-1, at 28, 44.

Twin City cites to Del Monte for the position that theoretical or implied claims need not be considered in determining whether a duty to defend exists. Docs. 25, at 11-12; 28, at 2-3. However, a review of that case reveals a notable context for those statements. The Del Monte court was concerned with differing levels of “intent” and “culpability” as it relates to intentional conduct versus some level of negligent conduct because there was a “knowledge of falsity” exclusion. As the Seventh Circuit emphasized, “what is important is not the legal label that the plaintiff attaches to the defendant's (that is, the insured's) conduct, but whether that conduct as alleged in the complaint is at least arguably within one or more of the categories of wrongdoing that the policy covers.” Del Monte Fresh Produce N.A, 500 F.3d at 644 (quoting Cincinnati Ins. Co. v. E. Atl. Ins. Co., 260 F.3d 742, 745 (7th Cir. 2001) (internal quotation marks omitted). In the context of the Del Monte court, the “legal labels” referred to “negligence” versus “fraud.” Id. Culpability is not at issue here; therefore, Del Monte is not a factually helpful comparison. Notably, the Parties' briefs do not support their positions by discussing any defend-to-duty case where a court distinguished a statutory claim from a breach of contract claim.

Likewise, Twin City selectively quotes from DER Travel Serv., Inc., 328 F.3d at 350-51 to reinforce the idea that a hypothetical version of a complaint should not be considered. The full quote reads, “[w]hile the district court correctly observed that negligent conduct is actionable under the Consumer Fraud Act, it is the actual complaint, not some hypothetical version, that must be considered.” Id. The context of this quote means while negligent conduct may be actionable under the act, the complaint itself only alleged intentional fraud based on the conduct described. In considering the above, the important question becomes: if the facts in the underlying complaints are proven as true, is it plausible that the committed acts would fall within the policy coverage? Based on the Court's discussion above, it does; based on the Handbook requiring employees to sign in using the approved device or face discipline and the employer's commitment to comply the laws associated with the Handbook coupled with the broad policy language covering obligations arising from the Handbook without limitation.

Lagestee-Mulder, Inc. v. Consol. Ins. Co., 682 F.3d 1054, 1057-58 (7th Cir. 2012) is instructive in explaining the distinction between the Parties' interpretations of the duty to defend standard, where they discuss the notion of an “implied claim.” It also discusses Microplastics and Del Monte, which are cited by Twin City. In Lagestee-Mulder, Inc., the Seventh Circuit affirmed the insurer had no duty to defend because the underlying complaint described faulty constructions including specific deficiencies in materials, workmanship, and the building's construction, but did not allege facts describing damage to something other than the defective structure. Id. at 1057-58. The court noted it was not obligated to infer property damage occurred as a result of the defective construction. Id. at 1059. Here, the underlying complaints do not require the Court infer or imply any other harm. The facts demonstrate Vonachen required employees to clock-in using their fingerprint and Vonachen failed to meet certain duties associated with that collection. The Handbook merely adds context to the relationship and the Court would not be considering it but for Twin City including it as a basis for coverage regarding wrongful employment practices. The Lagestee-Mulder court also used the unjust enrichment analogy to explain if a CGL policy covered defective workmanship then an insured could be paid for the entirety of its work then invoke coverage and be paid by the insurance company to repair or replace the work, thus transforming the CGL policy into a performance bond. Id. at 1057 (citing Travelers Ins. Co. v. Eljer Mfg., Inc., N.E.2d 481 (Ill. 2001); CMK Development Corp. v. West Bend Mut. Ins. Co., 917 N.E.2d 1155, 1163 (Ill.App.Ct. 2009)). The unjust enrichment analogy is not applicable here as Twin City has not asserted any monetary benefit associated with the collection of data.

As to the notion of a “moral hazard” argued by Twin City, other provisions of the Policy demonstrate Twin City agreed to cover certain types of alleged law violations, in particular those related to employment practices. For example, the “Employment Practices Wrongful Act” section includes coverage for employment discrimination-based on a protected status established under federal, state, or local law; employment-related violation of the Age Discrimination in Employment Act, the Family and Medical Leave Act and the Equal Pay Act; and violations of the Uniformed Services Employment and Reemployment Rights Act. Doc. 22-1, at 35. In contrast, Twin City excludes certain types of violations related to employment, such as wage and hour violations and violations of the National Labor Relations Act, the Occupational Safety and Health Act, ERISA, and any similar law. Doc. 22-1, at 37. Further, the excerpt describing an “Employee Data Privacy Wrongful Act” and an “employment-related invasion of privacy” as additional wrongful employment acts that are covered “when alleged in addition to or as part of, ” demonstrate Twin City agreed to cover certain privacy violations. Doc. 22-1, at 35. Therefore, Twin City's argument that Vonachen's interpretation of the Policy is so broad as to require Twin City to cover all breaches of contract or applicable laws loses force where it clearly described certain violations it was and was not willing to cover.

In sum, the cases cited by Twin City are not persuasive to its position. Plausibility is the standard here and duty to defend does not hinge on the drafting skills of the plaintiff in the underlying complaint. See Cincinnati Ins. Co. v. E. Atlantic Ins. Co. & Integrity Underwriters, Inc., 260 F.3d 742, 745 (7th Cir. 2001). Based on the repeated allegations that Vonachen required employees to record their time using their biometrics; the Handbook describing the employees' required compliance with timekeeping obligations or face discipline as well as Vonachen's agreement to comply laws associated with the Handbook, which could be construed as a contract; and the language in the Policy covering “breach[es] of any oral, written, or implied employment contract, including, without limitation, any obligation arising from a personnel manual, employee handbook, or policy statement, ” the Court finds the allegations in the underlying complaints potentially fall within the EPL coverage.

2. Employee Data Privacy Wrongful Act

a. The Parties' Positions

Vonachen further claims the underlying complaints encompass an “Employee Data Privacy Wrongful Act, ” which is covered under the EPL coverage. Doc. 21, at 13. Following the coverage section defining “Employment Practices Wrongful Acts, ” the policy states “Employment Practices Wrongful Acts also means the following, but only when alleged in addition to or as part of any Employment Practices Wrongful described above.” Doc. 22-1, at 35. The wrongful acts described in this list include “an employment-related invasion of privacy, including without limitation, an Employee Data Privacy Wrongful Act.” Id. (emphasis added)

The EPL coverage, in part, describes an “Employee Data Privacy Wrongful Act” as,

(2) The failure to notify any Employee or applicant for employment with the Insured Entity of any actual or potential unauthorized access to or use of Private Employment Information of any Employee or applicant for employment with the Insured Entity, if such notice was required by state or federal regulation or statute.

Id. at 34. Vonachen argues the allegations in the underlying complaints fit the above definition because they allege “Vonachen violated its employees' ‘right to privacy' by ‘capturing and collecting, storing, using, and/or disclosing' their biometric data without their informed consent[, ]'” and BIPA requires entities collecting this data “to provide notice of those risks.” Doc. 21, at 13. Thus, Vonachen claims the conduct described in the allegations of the underlying complaints include an “Employee Data Privacy Wrongful Act, ” which is alleged “as part of” the “Employment Practices Wrongful Act” of breaching an employee handbook obligation. Id.

b. Analysis

Notably, Vonachen is careful not to claim the underlying complaints allege an “invasion of privacy” but fit within the specified “Data Privacy Wrongful Act” definition, so as not to impact its argument for D&O coverage, which excludes coverage for invasions of privacy. In response, Twin City does not address whether the conduct fits the definition of an “Employee Data Privacy Wrongful Act.” Instead, it argues any allegations of employment related invasions of privacy are not covered because “they are not ‘alleged in addition to or as part of” any enumerated Employment Practices Wrongful Act.” Doc. 25, at 16.

Based on the Court's earlier discussion of BIPA and the term invasion of privacy regarding the D&O coverage, the underlying complaints clearly alleged an “employment-related invasion of privacy.” See supra sec. III(A)(3)(A)(2). The alleged invasion occurred at work, for work purposes (timekeeping), and as a result of the employer/employee relationship. Further, the “Employee Data Privacy Wrongful Act includes the failure to notify any employee of the “potential unauthorized access to or use of Private Employment Information of any Employee . . . if such notice was required by state or federal regulation or statute.” Doc. 22-1, at 34. This fits within the requirements enumerated in sections 15(b) and 15(d) of BIPA to obtain written consent prior to collecting or disseminating a person's biometric information including the purposes for which the data will be used and length for its storage, coupled with the allegations in the underlying complaints that Vonachen failed to inform the plaintiffs of whom Vonachen would disclose the data to or what would happen to their data in the future. Rodriguez Complaint ¶ 22. The data privacy violations are an integral part of the wrongful employment practice of a breaching an employee handbook obligation because the Handbook imposed the requirements for employees to clock-in and clock-out using the approved device.

In conclusion, Twin City has a duty to defend under the EPL coverage part based on the allegations in the underlying complaints and the broad language it chose to include in its coverage.

B. Duty to Indemnify

As to indemnification, the Parties disagree as to whether the Breach of Contract Exclusion in the EPL coverage forecloses indemnification and whether the issue of indemnification is ripe.

1. EPL - Breach of Contract Exclusion

In its Cross Motion, Twin City claims even if it has a duty to defend, it has no duty to indemnify because the EPL Coverage Part contains a “Breach of Contract Exclusion” from coverage for any liability arising from an alleged breach of an employment contract or the employment handbook. Doc. 25, at 17-18. Vonachen offers three reasons why this exclusion does not apply: (1) the exclusion does not bar indemnity coverage because its ambiguities must be construed in favor of coverage, (2) Vonachen could be liable under BIPA regardless of an employment contract, and (3) the exclusion allows for the recovery of defense costs which is the only loss Vonachen seeks to recoup at this time, therefore, Twin City must pay based on the plain language of the policy. Doc. 21, at 14-16.

As stated above, Twin City, as the insurer, has the burden of demonstrating an exclusion applies. The provision at issue states the following:

III. EXCLUSIONS APPLICABLE TO ALL INSURING AGREEMENTS

(C) The Insurer shall not pay Loss ¹¹in connection with any Claim based upon, arising from, or in any way related to liability incurred for breach of any oral, written, or implied employment contract; provided, however, that this exclusion shall not apply to liability that would have been incurred in the absence of such contract nor shall it apply to the portion of Loss representing Defense Costs incurred to defend against such liability.

Doc. 22-1, at 38 (emphasis added).

11 The common definitions section of the Policy, defines “Loss” as “Defense Costs and Damages.” Doc. 26, at 12.

As to Vonachen's third argument that it only seeks defense costs, Twin City initially claimed the EPL Breach of Contract Exclusion excluded coverage entirely. See Doc. 14, at 157-58. However, at summary judgment, Twin City now concedes that the exclusion does not apply to defense costs, but maintains it applies to indemnification. Doc. 25, at 17-18. Thus, because the Court has determined Twin City has a duty to defend under the EPL policy, the defense costs are recoverable.

Relatedly, to the extent Vonachen still maintains its position that the exclusion is ambiguous, the Court disagrees. Vonachen contends the Employment Practices Wrongful Act expressly includes a “breach of any oral, written, or implied employment contract” therefore it is contradictory to simultaneously exclude coverage for breaches of contract and any ambiguity must be construed in Vonachen's favor. Doc. 21, at 14. It may be an odd provision or seemingly unfair but “a court should not search for ambiguity where none exists. Mere disagreement about the interpretation of an insurance contract does not render it ambiguous.” River, 160 F.3d at 1169. The provision is not ambiguous because there is only one reasonable interpretation. The exclusion allows for defense costs associated with a breach of contract, but not indemnification obligations. Further, the provision cuts both ways, Twin City can financially protect itself where it must defend a breach of contract claim while an insured can have some coverage for defending a breach of contract, subject to any further restrictions listed elsewhere in the Policy. However, this further diminishes Twin City's earlier argument that “insurance policies are presumed not to insure against breaches of contract.” Doc. 25, at 16.

Finally, there is an exception to the exclusion provision stating that that it does not apply “to liability that would have been incurred in the absence of such contract.” Doc. 22-1, at 38. Twin City fails to respond to Vonachen's argument regarding the exception, therefore any argument as to the interpretation of this contractual language is waived. See Berg v. New York Life Ins. Co., 831 F.3d 426, 428 (7th Cir. 2016). Elsewhere, Twin City argues “[r]egardless of whether the Employee Handbooks existed, the Plaintiffs in the Underlying Actions could recover under BIPA.” Doc. 25, at 13. Accordingly, the Court finds the exception to the exclusion applies as the Parties agree Vonachen could be liable for the alleged B I P A violations absent a contract.

2. Ripeness of Indemnification

Twin City also argues it not premature to decide indemnification. Doc. 25, at 18; Doc. 28, at 6. However, its argument is premised on a finding that Twin City does not have a duty to defend. As stated above, the Court finds there is a duty to defend. Thus, Twin City's argument fails on that basis.

Vonachen further asserts there are scenarios where an insurer will have a duty to indemnify even if it does not have a duty to defend. Doc. 27, at 11-12 (citing Sokol & Co. v. Atl. Mut. Ins. Co., 430 F.3d 417, 421 (7th Cir. 2005)). For example, Vonachen asserts if the Court finds a duty to defend does not exist without an explicit breach of contract theory, the plaintiffs in the underlying actions could amend their pleadings and obtain a recovery, thereby triggering Twin City's indemnification duty. Id. The Court need not reach this issue because it has determined Twin City has a duty to defend.

Additionally, there has been no indication from the Parties that the underlying actions have been resolved. A duty to indemnify, which is narrower than the duty to defend, does not arise until the insured becomes obligated to pay damages in the underlying action. Zurich Ins. Co. v. Raymark Indus., Inc., 514 N.E.2d 150, 163 (Ill. 1987); Outboard Marine Corp., 607 N.E.2d at 1221. Otherwise, the issue is not ripe for adjudication. Eljer Mfg., Inc., 757 N.E.2d at 492. At that point, an insurer must indemnify only if the insured's activity and resulting damage “actually fall within” the policy's coverage. Shockley, 3 F.4th at 331 (citing Madison Mut. Ins. Co. v. Diamond State Ins. Co., 851 F.3d 749, 753 (7th Cir. 2017)). Upon these considerations, it is indeed premature to decide the issue of indemnification. See Id. (refusing to reach the merits of the duty to indemnify because such determination would require the court to adjudicate facts in the underlying lawsuit in violation of the Peppers doctrine set forth in Maryland Cas. Co. v. Peppers, 355 N.E.2d 24, 30 (Ill. 1976)). Therefore, that portion of Twin City's claim is dismissed, without prejudice, as premature at this stage. Shockley, 3 F.4th at 332 (citing Travelers Ins. Cos. v. Penda Corp., 974 F.2d 823, 833-34 (7th Cir. 1992); Tews Funeral Home, Inc. v. Ohio Cas. Ins. Co., 832 F.2d 1037, 1047 (7th Cir. 1987)). Tw i n C ity may re-file its claim following liability determinations in the underlying actions, if necessary.

CONCLUSION

For the reasons set forth above, Defendant Vonachen's Motion (Doc. 20) for Summary Judgment is GRANTED and Plaintiff Twin City's Cross Motion (Doc. 24) for Summary Judgment is GRANTED in part and DENIED in part.

The Court finds the Rodriguez and Gumm Actions are a single, interrelated claim under the Policy. Twin City has a duty to defend Vonachen with respect to the underlying lawsuits, the Rodriguez Action, Case No. 2019-CH-12773, pending in the Circuit Court of Cook County, Illinois - Chancery Division, and the Gumm Action, Case No. 20-CH-00139, pending in the Tenth Judicial Circuit, Peoria County, Illinois, pursuant to the terms of Twin City's Private Choice Premier Policy to Vonachen, Policy Number 83 KB 0336944-19. Twin City's remaining claims for indemnification are dismissed without prejudice.

The Clerk is directed to close this case and enter judgment as set forth in the preceding paragraph.