Opinion
1-21-1097 1-22-0308 (cons.)
03-31-2023
REMPREX, LLC, Plaintiff-Appellant, v. CERTAIN UNDERWRITERS AT LLOYD'S LONDON, SYNDICATES 2623/623, Defendant-Appellee.
Appeal from the Circuit Court of Cook County. No. 20 CH 5507 The Honorable Anna M. Loftus, Judge, Presiding.
JUSTICE ODEN JOHNSON delivered the judgment of the court, with opinion. Presiding Justice Mikva & Justice C.A. Walker concurred in the judgment and opinion.
OPINION
ODEN JOHNSON JUSTICE
¶ 1 This appeal stems from a declaratory judgment action filed by plaintiff, Remprex, LLC, against defendants, Certain Underwriters at Lloyd's London, Syndicates 2623/623 (Lloyd's), in which plaintiff sought a declaration that Lloyd's had a duty to defend it with regard to alleged violations of the Illinois Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq. (West 2018)). Remprex's complaint also alleged breach of contract, bad-faith claims practices, vexatious and unreasonable conduct, violations of the Illinois Consumer Fraud and Deceptive Business Practices Act (815 ILCS 505/1 et seq. (West 2018)), and common law fraud. The circuit court granted Lloyd's section 2-615 (735 ILCS 5/2-615 (West 2020)) motion to dismiss the complaint in its entirety, and Remprex appeals from that order. On appeal, Remprex contends that Lloyd's had a duty to defend it in the two underlying lawsuits that alleged BIPA violations pursuant to two provisions of the policy which provided coverage for claims based on the dissemination of information to the public and for claims based on a loss for which Remprex was liable. For the reasons that follow, we affirm in part, reverse in part and remand for calculation of damages.
Oral arguments were held in this appeal on January 12, 2023.
¶ 2 I. BACKGROUND
¶ 3 Briefly stated, this case concerns a dispute over whether Remprex had insurance coverage for costs sustained by it with regard to two class action lawsuits involving alleged violations of BIPA. The facts are taken from the parties' pleadings filed during the course of Remprex's declaratory judgment action, which was initially filed on August 24, 2020.
¶ 4 A. BNSF Lawsuit
¶ 5 According to Remprex, it was implicated by BNSF Railway Company (BNSF) in a class action suit initiated by truck driver Richard Rogers (Rogers) against BNSF (BNSF lawsuit) in April 2019. the suit alleged that BNSF violated his privacy rights by collecting, capturing, storing, transferring, using, or otherwise obtaining his biometric information in a negligent or reckless manner. Remprex was never a named defendant in the BNSF suit, however, BNSF's answer and affirmative defenses alleged that it contracted with Remprex to provide a number of services at BNSF facilities, including automated gate systems, since July 1, 2007. Additionally, BNSF indicated in an affirmative defense that any alleged use of fingerprints would have been provided to and at the request of Remprex. Remprex's letter to Lloyd's requesting coverage for this matter indicated that BNSF sought indemnification pursuant to the terms of a contract between Remprex and BNSF.
¶ 6 In March 2020, Remprex indicated that it attended an unsuccessful mediation session between the named parties to the BNSF lawsuit before JAMS (a provider of mediation, arbitration, and alternate dispute resolution services) at the request of both Rogers' counsel and BNSF. Remprex believed that, based on communication between the parties before and after the mediation, it would be expected to contribute to any proposed settlement.
¶ 7 On August 5, 2020, Remprex received a broad subpoena for records, and in response it produced thousands of documents to the parties. Additionally, two of Remprex's principals received deposition notices from Rogers' counsel and were deposed. Remprex further contended that its continued participation was sought by the parties in the ongoing BNSF lawsuit, and it participated in a second unsuccessful mediation on April 7, 2021. We take judicial notice that the BNSF lawsuit went to trial and resulted in a jury award in favor of the class and against BNSF on October 12, 2022. Beyond the actions mentioned here, Remprex was never otherwise involved in the BNSF lawsuit.
¶ 8 B. CN Lawsuit
¶ 9 On July 26, 2019, Rogers filed a second class action lawsuit for alleged violations of BIPA against Remprex, Illinois Central Railroad Company (ICRC) and CN Transportation, Ltd., an affiliate of the Canadian National Railway Company (CN lawsuit). The suit raised similar allegations to those raised in the BNSF lawsuit. With respect to Remprex, Rogers alleged that it engineered, designed, installed, operated, and managed biometric technology software and hardware. Additionally, Rogers alleged that CN used Remprex's technology at its railyards and the two companies acted jointly in violating his privacy rights by collecting, capturing, storing, transferring, using, or otherwise obtaining his biometric information in a negligent or reckless manner. Further, Rogers alleged that Remprex used and shared his and other truck drivers' fingerprint scans in an unauthorized manner as part of a biometric-based automated gate system at Illinois railyards for companies like CN, and improperly disseminated that information.
¶ 10 Remprex moved to dismiss Rogers' complaint on August 30, 2019, and on November 14, 2019, Rogers voluntarily dismissed Remprex from the case.
¶ 11 C. Remprex's Claims and Circuit Court Proceedings
¶ 12 Remprex maintained a "Beazley Breach Response" (BBR) policy, underwritten by Lloyd's that covered a policy period of July 30, 2018, to July 30, 2019. Among other things, the policy provided coverage for data & network liability and media liability. The policy also contained a choice of law provision which provided that New York law governed disputes about its terms.
¶ 13 In June 2019, Remprex notified Lloyd's of its claims under its policy, namely under the Data &Network Liability and Media Liability provisions, which Remprex contended were applicable to the BNSF and CN lawsuits. In its correspondence to Lloyd's, Remprex explained that both suits concerned the unlawful creation, collection, dissemination, and unauthorized disclosure of private personal information in the form of fingerprint data, by or on behalf of Remprex, which triggered the coverage and Lloyd's corresponding responsibility to cover all reasonable and necessary legal costs and expenses resulting from the investigation and defense of those suits.
¶ 14 Lloyd's responded in writing on November 19, 2019, denying coverage because it determined that neither the CN lawsuit nor the BNSF lawsuit implicated the policy's coverage. Specifically, Lloyd's stated that neither the Data &Network Liability nor the Media Liability provisions covered the circumstances in the two underlying lawsuits. Both parties engaged in correspondence back and forth for a few months, with Lloyd's final correspondence about the matter occurring in April 2020.
¶ 15 Remprex filed suit against Lloyd's on August 24, 2020. Lloyd's responded by filing its appearance on November 20, 2020, and a section 2-615 (735 ILCS 5/2-615 (West 2020)) motion to dismiss on December 21, 2020. Remprex subsequently filed its six-count, first amended complaint on April 19, 2021. Count I sought a declaration that Lloyd's had a duty to defend and indemnity it in the CN and BNSF lawsuits; count II alleged breach of contract; count III alleged bad faith; count IV alleged vexatious and unreasonable conduct; count V alleged a violation of the Illinois Consumer Fraud Act (815 ILCS 505/1 et seq. (West 2020)); and count VI alleged common law fraud. Remprex based the allegations of its complaint on the underlying CN and BNSF complaints, the BNSF answer and subpoena, and Lloyd's written denials of its claims for coverage.
¶ 16 Lloyd's responded with a second section 2-615 motion to dismiss. Lloyd's first contended that it had no duty to defend Remprex for either the CN or BNSF complaints because a comparison of the underlying complaint and the insurance policy showed that there was no duty to defend under the Media Liability or Data & Network Liability coverages.
¶ 17 With respect to the CN lawsuit, Lloyd's noted that the policy's definition of Media Liability covered liability for creating, displaying, broadcasting, disseminating, or releasing Media Material to the public, and the CN complaint did not allege that Remprex did any of those things. Rather, the CN complaint alleged that Remprex violated BIPA by "capturing and obtaining" and "collecting and storing" biometric information without appropriate consents, and there was no allegation that any information was released to the public or that Remprex took any action directed to the public. Lloyd's disagreed with Remprex's wide interpretation of "to the public," namely that an allegation of dissemination to certain select entities would be sufficient to satisfy the policy language requiring dissemination to the public. Lloyd's concluded that because there was no allegation in the CN complaint that Remprex disseminated any information to the public, it had no duty to defend the CN complaint under the Media Liability coverage of the policy.
¶ 18 Lloyd's further contended that it had no duty to defend the CN lawsuit under the Data & Network Liability coverage of the policy because there was no allegation of a data breach or security breach in the CN complaint. Lloyd's noted that the CN complaint was not a claim against Remprex for the theft or loss of information that in Remprex's care, custody or control, or the disclosure of such information without Remprex's authorization. Rather, the CN complaint alleged that Remprex collected information from Rogers without his consent; thus, it was not covered or potentially covered as a data breach. Nor did the CN complaint allege behaviors that would constitute a security breach as it was not a claim for the failure of computer security to prevent unauthorized access or use of computer systems, nor was there any allegation against Remprex that its computer security failed to prevent unauthorized access or use of its computer systems. Because the CN complaint did not mention Remprex's computer security, Lloyd's concluded that the CN complaint was not covered or potentially covered as a security breach.
¶ 19 With respect to the BNSF suit, Lloyd's initially noted that Remprex was not a party to the suit and that although Remprex sought coverage for the BNSF complaint, the BNSF answer, and for a third-party subpoena for documents received by Remprex from Rogers, those items were not covered by the policy. First, Lloyd's contended that the BNSF complaint, answer and subpoena were not claims made against Remprex as Remprex was not named in the complaint and the complaint sought no money or services from Remprex. Similarly, Lloyd's argued that the BNSF answer to the complaint and the subpoena were not claims against Remprex as they were not filed against Remprex and demanded no money or services from Remprex. Lloyd's acknowledged that Remprex received a letter from BNSF requesting indemnity for the claims brought by Rogers pursuant to an indemnification provision in a contract between BNSF and Remprex; however, the first amended complaint did not make any claims in connection with BNSF's request for contractual indemnification, and further, such claim would not be covered as the policy specifically excluded any loss arising from a contractual liability or obligation. Additionally, Lloyd's noted that Remprex did not notify it of the subpoena when Remprex received it and never attempted to claim coverage for the subpoena, thus Lloyd's had no duty to defend Remprex in connection with the subpoena.
¶ 20 Lloyd's also contended that Remprex failed to state a claim in count III (bad faith) under 215 ILCS 5/154.6 (West 2020)), because the complaint pled no facts to support its "bare assertion" of improper claims handling, and because the statute relied upon was regulatory, Remprex had no cause of action as a policyholder.
¶ 21 With respect to count IV (vexatious and unreasonable conduct) under 215 ILCS 5/155 (West 2020)), Lloyd's argued that Remprex failed to state a claim because: (1) disputes under the policy were governed by New York law so a claim could not be brought under an Illinois statute; (2) a section 155 claim could not proceed when there was no duty to defend; (3) Remprex alleged no facts showing that Lloyd's position was not reasonable and bona fide; and (4) the only fact alleged in support of the claim was that Lloyd's issued its letter denying coverage in November 2019, several months after Remprex first provided notice of its claims in June 2019, which was insufficient to support its claim because the two entities were in communication throughout that time period.
¶ 22 With respect to Remprex's claim under the Consumer Fraud Act (count V) (815 ILCS 505/1 et seq. (West 2020)), Lloyd's argued that the CN and BNSF complaints were not covered under the policy, so coverage was appropriately denied. Additionally, the policy required that New York law be applied, so Remprex could not bring a claim under an Illinois statute. Lloyd's also contended that Remprex's claim was a restatement of its breach of contract claim which could not support a violation of the Consumer Fraud Act, and that Remprex failed to identify any specific misrepresentations or unfair acts or practices in its first amended complaint.
¶ 23 Finally, Lloyd's contended that Remprex failed to state a claim in count VI (common law fraud) because the CN and BNSF complaints were not covered by the policy, so coverage was appropriately denied. Additionally, Lloyd's noted that a party could not state a claim of fraud by alleging that a counterparty did not comply with the parties' contract, which was the basis of Remprex's claim, and further that Remprex failed to allege the elements of fraud.
¶ 24 Lloyd's therefore concluded that Remprex's first amended complaint should be dismissed with prejudice in its entirety.
¶ 25 Remprex filed a response in which it raised essentially the same allegations contained in its first amended complaint. The circuit court subsequently heard argument on the motion on August 5, 2021, via a Zoom teleconference. At the hearing, the court indicated that it had reviewed the materials submitted by both sides, and allowed time for oral argument. After hearing argument, the circuit court found that there was no coverage for the CN lawsuit under the policy because there was no dissemination of any data to the public, just transmission between parties affiliated with one another. With respect to the BNSF lawsuit, the court noted that because Remprex was not named, it could not determine whether there was coverage. The circuit court dismissed the remaining counts of the first amended complaint.
¶ 26 The circuit court subsequently entered its written order on August 12, 2021, granting Lloyd's motion to dismiss. The order indicated that "[f]or the reasons stated on the record," counts 1 and 2 for declaratory judgment and breach of contract were dismissed with prejudice to the extent that they asserted causes of action arising from Lloyd's refusal to defend Remprex in the CN lawsuit or to indemnify it for expenses or liability incurred in defense of the CN lawsuit. The order additionally dismissed counts 1 and 2 without prejudice with respect to the BNSF lawsuit so that Remprex could seek a declaratory judgment regarding coverage if it was subsequently named in the BNSF lawsuit. Counts I through VI were dismissed with prejudice, and the order was entered as a final order which resolved all outstanding issues in the case.
As previously noted, the BNSF lawsuit ended in a jury verdict on October 12, 2022, and Remprex was never named as a party to that suit.
¶ 27 Remprex filed its timely notice of appeal on September 2, 2021 (case number 21-1097). However, on February 2, 2022, Rempex filed a motion to remand to the circuit court for entry of a final order. On February 16, 2022, this court granted the motion to remand for the limited purpose of having the circuit court clarify whether its order of August 12, 2021, was intended as a final order disposing of the case. In response, the circuit court entered a subsequent order on Lloyd's motion to dismiss on February 28, 2022, which dismissed counts I and II with prejudice as related to the BNSF lawsuit because Remprex was not named as a defendant in that lawsuit. All other relief remained the same. Remprex filed a second notice of appeal on March 3, 2022 (case number 22-0308), which was subsequently consolidated with the earlier appeal.
¶ 28 D. The Insurance Policy
¶ 29 As noted above, the BBR policy at issue was issued to Remprex by Lloyd's as underwriters for the policy period of July 30, 2018, through July 30, 2019. The policy included a BBR Information Pack. Under the BBR Insuring Agreements Breach Responses section, the purpose of the policy was "[t]o provide Breach Response Services to the Insured Organization because of an actual or reasonably suspected Data Breach or Security Breach that the Insured first discovers during the Policy Period." (Emphasis in original).
¶ 30 Applicable to this appeal, the Data &Network Liability section of the policy provided as follows:
"Data & Network Liability
To pay Damages and Claims Expenses, which the Insured is legally obligated to pay because of any Claim first made against any Insured during the Policy Period for:
1. a Data Breach;
2. a Security Breach; ***
4. failure by the Insured to comply with that part of a Privacy Policy that specifically:
(a) prohibits or restricts the Insured Organization's disclosure, sharing or selling of Personally Identifiable Information;
(b) requires the Insured Organization to provide an individual access to Personally Identifiable Information or to correct incomplete or inaccurate Personally Identifiable Information after a request is made; or
(c) mandates procedures and requirements to prevent the loss of Personally Identifiable Information;
provided the Insured Organization has in force, at the time of such failure, a Privacy Policy that addresses those subsections above that are relevant to such Claim." (Emphasis in the original).
¶ 31 The Media Liability section of the policy provided as follows:
"Media Liability
To pay Damages and Claims Expenses, which the Insured is legally obligated to pay because of any Claim first made against any Insured during the Policy Period for Media Liability." (Emphasis in the original).
¶ 32 The definitions section of the policy also contains several relevant definitions as follows: "Breach Notice Law means any statute or regulation that requires notice to persons whose personal information was accessed or reasonably may have been accessed by an unauthorized person. Breach Notice Law also includes any statute or regulation requiring notice of a Data Breach to be provided to governmental or regulatory authorities.
Breach Response Services means the following fees and costs in response to an actual or reasonably suspected Data Breach or Security Breach: ***"
"Claim means:
1. a written demand received by any Insured for money or services;
***
3. with respect to coverage provided under part 1. of the Data &Network Liability insuring agreement only, a demand received by any Insured to fulfill the Insured Organization's contractual obligation to provide notice of a Data Breach pursuant to a Breach Notice Law.
Multiple Claims arising from the same or a series of related, repeated or continuing acts, errors, omissions or events will be considered a single Claim for the purposes of this Policy.
Claims Expenses means:
1. all reasonable and necessary legal costs and expenses resulting from the investigation, defense and appeal of a Claim, if incurred by the Underwriters, or by the Insured with the prior written consent of the Underwriters; ***
Claims Expenses will not include any salary, overhead, or other charges by the Insured for any time spent in cooperating in the defense and investigation of any Claim or circumstance that might lead to a Claim notified under this Policy, or costs to comply with any regulatory orders, settlements or judgments.
Computer Systems means computers, any software residing on such computers and any associated devices or equipment:
1. operated by and either owned by or leased to the Insured Organization; or
2. with respect to coverage under the Breach Response and Liability insuring agreements, operated by a third party pursuant to a written contract with the Insured Organization and used for the purposes of providing hosted computer
application services to the Insured Organization or for processing, maintaining, hosting or storing the Insured Organization's electronic data."
"Damages means a monetary judgment, award or settlement, including any award of prejudgment or post-judgment interest; but Damages will not include:
* * *
9. any amounts for which the Insured is not liable, or for which there is no legal recourse against the Insured.
Data means any software or electronic data that exists in Computer Systems and that is subject to regular back-up procedures.
Data Breach means the theft, loss, or Unauthorized Disclosure of Personally Identifiable Information or Third Party Information that is in the care, custody or control of the Insured Organization or a third party for whose theft, loss or Unauthorized Disclosure of Personally Identifiable Information or Third Party Information the Insured Organization is liable." "Loss means Breach Response Services, Business Interruption Loss, Claims Expenses, Criminal Reward Funds, Cyber Extortion Loss, Damages, Data Recovery Costs, Dependent Business Loss, PCI Fines, Expenses and Costs, Penalties, loss covered under the eCrime insuring agreement and any other amounts covered under this Policy."
"Media Liability means one or more of the following acts committed by, or on behalf of, the Insured Organization in the course of creating, displaying, broadcasting, disseminating or releasing Media Material to the public:
1. defamation, libel, slander, product disparagement, trade libel, infliction of emotional distress, outrage, outrageous conduct, or other tort related to disparagement or harm to the reputation or character of any person or organization;
2. a violation of the rights of privacy of an individual, including false light, intrusion upon seclusion and public disclosure of private facts;
3. invasion or interference with an individual's right of publicity, including commercial appropriation of name, persona, voice or likeness;
4. plagiarism, piracy, or misappropriation of ideas under implied contract; 5. infringement of copyright;
6. infringement of domain name, trademark, trade name, trade dress, logo, title, metatag, or slogan, service mark or service name;
7. improper deep-linking or framing; 8. false arrest, detention or imprisonment;
9. invasion of or interference with any right to private occupancy, including trespass, wrongful entry or eviction; or
10. unfair competition, if alleged in conjunction with any of the acts listed in parts 5. or 6. above.
Media Material means any information, including words, sounds, numbers, images or graphics, but will not include computer software or the actual goods, products or services described, illustrated or displayed in such Media Material."
"Personally Identifiable Information means:
1. any information concerning an individual that is defined as personal information under any Breach Notice Law; and
2. an individual's driver's license or state identification number, social security number, unpublished telephone number, and credit, debit or other financial account numbers in combination with associated security codes, access codes, passwords or PINs; if such information allows an individual to be uniquely and reliably identified or contacted of allows access to the individual's financial account or medical record information.
but will not include information that is lawfully made available to the general public." "Security Breach means a failure of computer security to prevent:
1. Unauthorized Access or Use of Computer Systems, including Unauthorized Access or Use resulting from the theft of a password from a Computer System or from any Insured;
2. a denial of service attack affecting Computer Systems;
3. with respect to coverage under the Liability insuring agreements, a denial of service attack affecting computer systems that are not owned, operated or controlled by an Insured; or
4. infection of Computer Systems by malicious code or transmission of malicious code from Computer Systems."
"Unauthorized Disclosure means the disclosure of (including disclosure resulting from phishing) or access to information in a manner that is not authorized by the Insured Organization and is without knowledge of, consent or acquiescence of any member of the Control Group." (Emphasis in original).
¶ 33 The policy also excluded certain types of losses. With respect to the gathering or distribution of information, the policy excluded any loss arising out of "the unlawful collection or retention of Personally Identifiable Information or other personal information by or on behalf of the Insured Organization;" but the exclusion did not apply to "Claims Expenses incurred in defending the Insured against allegations of unlawful collection of Personally Identifiable Information." The policy also excluded from coverage, under the Media Liability insuring agreement, "any contractual liability or obligation," but the exclusion did not apply to a claim for misappropriation of ideas under implied contract.
¶ 34 The policy further provided that, "[e]xcept with respect to coverage under the Payment Card Liabilities &Costs insuring agreement, the Underwriters ha[d] the right and duty to defend any covered Claim or Regulatory Proceeding."
¶ 35 II. ANALYSIS
¶ 36 On appeal, Remprex contends that Lloyd's had a duty to defend it in the two underlying lawsuits that alleged BIPA violations pursuant to two provisions of the policy. The provisions at issue provided coverage for claims based on the dissemination of information to the public and for claims based on a loss for which Remprex was liable. Specifically, Remprex argues that: (1) it stated valid claims for declaratory judgment and breach of contract because Lloyd's had a duty to defend under the insurance policy; (2) the circuit court erred in dismissing its claims merely because Remprex was not named as a defendant in the BNSF lawsuit; and (3) the circuit court erred in dismissing Remprex's remaining claims for breach of contract, violation of the Consumer Fraud Act and common law fraud.
¶ 37 A. Standard of Review
¶ 38 This is an appeal from the circuit court's grant of a section 2-615 (735 ILCS 5/2-615 (West 2020)) motion to dismiss for failure to state a cause of action. Specifically, Lloyd's motion to dismiss contended that the facts alleged by Remprex did not fall, or even potentially fall, within the scope of coverage in the insurance policy it issued to Remprex. A motion to dismiss under section 2-615 of the Code challenges the legal sufficiency of the complaint by alleging defects on its face. Omega Demolition Corporation v. The Illinois State Toll Highway Authority, 2022 IL App (1st) 210158, ¶ 36. A court should grant a section 2-615 motion to dismiss only if it is apparent that the plaintiff cannot prove any set of facts that will entitle it to recover. Board of Trustees of Community College District No. 502, County of DuPage v. Department of Professional Regulation, 363 Ill.App.3d 190, 196 (2006). The question is whether, even assuming that all well-pleaded facts in the complaint are true, the complaint states a legally recognized cause of action. Omega Demolition, 2022 IL App (1st) 210158, ¶ 36. In making this determination, a court will construe the complaint's allegations in the light most favorable to plaintiff and draw reasonable inferences in the plaintiff's favor. Id. An appellate court reviews a circuit court's order granting a section 2-615 motion de novo. Id. Additionally, we may affirm on any basis appearing in the record, whether or not the trial court relied on that basis or its reasoning was correct. Id.
¶ 39 B. Choice of Law Provision in the Policy
¶ 40 As a preliminary matter, we note that the policy at issue contained a choice of law provision that designated New York law to apply to disputes. In the absence of a specific choice of law provision, the general choice of law rules of the forum state control. U.S. Gypsum Co. v. Admiral Insurance Co., 268 Ill.App.3d 598, 635 (1994). It is undisputed that the insurance policy at issue designated New York law to apply to any disputes. Nor is there any dispute between the parties about the applicability of the choice of law provision contained in the policy as it relates to Lloyd's duty to defend. We will therefore apply the parties' chosen law, New York, in interpreting this insurance policy.
¶ 41 C. New York Contract Interpretation Principles
¶ 42 With respect to the policy, Remprex initially sought declarations that Lloyd's had a duty to defend and indemnify, while Lloyd's contended that it had no duty because coverage under the policy was not triggered. In an action for a judgment declaring the parties' rights under an insurance policy, we must be guided by rules of contract interpretation because an insurance policy is a contract between the insurer and insured. Westchester Fire Insurance Co. v. Schorsch, 129 N.Y.S. 3d 67, 74 (2020). Contract interpretation or construction is usually a court function. Id. Thus, in interpreting an insurance policy, the court must determine the rights and obligations of the parties, using the specific language of the policy itself. Sunrise Acupuncture, P.C. v. Kemper Independence Insurance Co., 86 N.Y.S. 3d 710, 712 (2018). To ascertain the parties' intent from the language of the insurance contract, the court must construe the policy as a whole; all pertinent provisions of the policy should be given meaning, with due regard to the subject matter that is being insured and the purpose of the entire contract. Westchester, 129 N.Y.S. 3d at 74.
¶ 43 When the language in an insurance policy is clear and unambiguous, the interpretation of said document and the determination of the rights and obligations of the parties is a question of law to be adjudicated by the court. Sunrise, d. 86 N.Y.S. 3d at 713. However, if the language in the policy is ambiguous, the court can use extrinsic evidence to determine the intent of the parties to the policy and resolution of the rights and obligations of the parties is a question of fact, to be determined by the trier of fact. Id. If the extrinsic evidence is conclusory, failing to equivocally resolve the ambiguity in a policy, interpretation of the policy remains a question of law for the court to decide; deciding any ambiguities against the insurer. Id.
¶ 44 When interpreting an insurance policy, the language of the policy, when clear and unambiguous, must be given its plain and ordinary meaning. Id. The policy should be construed in such a way "that affords a fair meaning to all of the language employed by the parties in the contract and leaves no provision without force and effect." Id. (quoting Raymond Corporation v. National Union Fire Insurance Co. of Pittsburgh, PA., 5 N.Y.3d 157, 162 (2005)).
¶ 45 We further note while Remprex sought declarations in the circuit court that Lloyd's had both a duty to defend and indemnify under the policy provisions, Remprex has not made any argument on appeal or cited to any supporting authority with respect to its claims that Lloyd's had a duty to indemnify and solely concentrates its arguments on Lloyd's duty to defend under the policy. A point not argued or supported by citation to relevant authority fails to satisfy the requirements of Illinois Supreme Court Rule 341(h)(7) (eff. Oct. 1, 2020). See Lake County Grading Co., LLC v. Forever Construction Co., Inc., 2017 IL App (2d) 160359, ¶ 83. Since the issue of whether Lloyd's had a duty to indemnify Remprex has not been raised in this appeal, we therefore do not address that issue herein. See Rodgers v. St. Mary's Hospital of Decatur, 149 Ill.2d 302, 309 (1992). We now turn our attention then to the relevant law with respect to an insurer's duty to defend.
¶ 46 An insurer's duty to defend its insured arises whenever the allegations in a complaint state a cause of action that gives rise to the reasonable possibility of recovery under the policy. Town of Massena v. Healthcare Underwriters Mutual Insurance Co., 98 N.Y.2d 435, 443 (2002). If the allegations of the complaint are even potentially within the language of the insurance policy, there is a duty to defend. Id. If any of the claims against an insured arguably arise from a covered event, the insurer is required to defend the whole action. Id. The duty to defend arises whenever the allegations in a complaint against the insured fall within the scope of the risks undertaken by the insurer and it is immaterial that the complaint against the insured asserts additional claims which fall outside of the policy's general coverage or within its exclusory provisions. Id. at 443-44. When an exclusion clause is relied upon to deny coverage, the burden rests on the insurance company to demonstrate that the allegations of the complaint can be interpreted only to exclude coverage. Id. at 444. The merits of the complaint are irrelevant, and an insured's right to be accorded legal representation is a contractual right and consideration upon which his premium is in part predicated, and this right exists even if debatable theories are alleged in the pleading against the insured. Id. Nonetheless, an insurer can be relieved of its duty to defend if it establishes as a matter of law that there is no possible factual or legal basis on which it might eventually be obligated to indemnify its insured under any policy provision. Cumberland Farms, Inc. v. Tower Group, Inc., 28 N.Y.3d 1068, 1070 (2016). Thus, we must consider whether Remprex's losses were caused by a covered event so as to bring the losses within the ambit of the policy. See Throgs Neck Bagels, Inc. v. G.A. Insurance Co. of New York, 671 N.Y.S.2d 66, 69 (1998).
¶ 47 With these principles in mind, we now turn to the merits of Remprex's appeal.
¶ 48 D. Lloyd's Duty to Defend (Counts I and II)
¶ 49 Remprex first contends that it stated valid claims for declaratory judgment and breach of contract because Lloyd's had a duty to defend it under the policy. Remprex argues that both the CN and BNSF lawsuits triggered the duty to defend against claims based on the dissemination of material to the public, and against claims based on a loss for which Remprex may be liable. Remprex concludes that when the broad presumptions in favor of coverage are properly applied and Remprex's allegations are viewed in the most favorable light, "it is plain that Remprex has sufficiently set forth allegations arguably triggering Lloyd's duty to defend" which was the only requirement to survive Lloyd's motion to dismiss. Remprex maintains that it sufficiently alleged that Lloyd's had a duty to defend it under multiple provisions of the policy, and the circuit court's order dismissing Remprex's claims should be reversed. It bears mentioning that Remprex combined New York law and Illinois law in support of its contentions. However, as stated above, we will apply New York law pursuant to the choice of law provision in the insurance policy as we address Remprex's specific contentions individually below.
¶ 50 1. Duty to Defend Against the BNSF Complaint, Answer and Subpoena
¶ 51 Remprex contends that Lloyd's had a duty to defend it against the BNSF complaint, answer and subpoena under both the Media Liability and Data &Network Liability provisions. Remprex argues that the BNSF suit alleged that BNSF and its vendors, which included Remprex, collected and transferred the plaintiff class members' biometric information; and BNSF in response to those allegations, claimed that Remprex was the party responsible for the alleged collection and transfer of that information. Remprex concludes that those allegations, namely that Remprex violated BIPA by collecting and transferring biometric data, constituted claims that Remprex disseminated media material to the public, including information concerning individual's privacy rights. Similarly, Remprex argues that the BNSF suit alleged, in one way or another, that the plaintiffs lost their personally identifiable information (biometric data), and that Remprex was liable for that loss, which was covered under the policy. We disagree.
¶ 52 As noted above, when interpreting an insurance contract, the court must determine the rights and obligations of the parties, using the specific language of the policy itself. Sunrise, 86 N.Y.S. 3d at 712 . When the language in an insurance policy is clear and unambiguous, the interpretation of said document and the determination of the rights and obligations of the parties is a question of law to be adjudicated by the court. Id. at 713. Additionally, we must construe the policy as a whole; all pertinent provisions of the policy should be given meaning, with due regard to the subject matter that is being insured and the purpose of the entire contract. Westchester, 129 N.Y.S. 3d at 74.
¶ 53 In this case, under both the Media Liability and Data &Network Liability provision of the policy at issue, coverage was provided for "damages and claims expenses, which the insured was legally obligated to pay because of any claim first made against any insured during the policy period," for media liability, a data breach, a security breach, or failure to comply with that part of a privacy policy that specifically prohibited or restricted the insured's disclosure, sharing or selling of personally identifiable information, provided that the insured had such privacy policy in place. The policy specifically defined a claim as "a written demand received by any insured for money or services," and further considered a claim under part one of the Data &Network Liability coverage (data breach) to include "a demand received by any insured to fulfill their contractual obligation to provide notice of a data breach pursuant to a breach notice law." Relevant to the Data &Network Liability coverage, the policy defines a data breach as the theft, loss or unauthorized disclosure of personally identifiable information that is in the care, custody or control of the insured or a third party for whose theft, loss or unauthorized disclosure of the personally identifiable information the insured is liable. With respect to Media Liability, the policy lists a series of acts, one or more of which committed by the insured in the course of creating, displaying, broadcasting, disseminating or releasing media material to the public. Media material is defined as any information including words, sounds, numbers, images or graphics, but not the computer software or the actual goods, products or services described, illustrated or displayed in such media material. However, we find that none of these circumstances were presented by the BNSF lawsuit that would have triggered Lloyd's duty to defend Remprex.
¶ 54 First and foremost, Remprex was never named as a defendant in the BNSF complaint, thus no claim as defined by the policy was ever made against it by Rogers, which would arguably have formed the basis for any duty to defend under the provisions of the policy. As previously noted, the BNSF lawsuit has since reached a verdict after a jury trial in October 2022 without Remprex ever being named as a party. Under the plain language of the policy, there was never a claim made against Remprex- no written demand for money or services, that would have triggered the policy's coverage under either the media liability or data & network liability provisions. Nor did the BNSF lawsuit fall within the other definition of a claim under the data &network liability insuring agreement as there was no demand that Remprex fulfill a contractual obligation to provide notice of a data breach pursuant to a breach notice law as required by the policy.
¶ 55 Moreover, although Remprex apparently voluntarily participated in certain information gathering activities related to the BNSF lawsuit in March 2020, we find that such activities did not rise to the level of being a named party in the suit with a claim filed against it or the incurrence of claims expenses as defined by the policy. The policy specifically defined claims expenses as "all reasonable and necessary legal costs and expenses resulting from the investigation, defense and appeal of a Claim, if incurred by the Underwriters, or by the Insured with the prior written consent of the Underwriters." (Emphasis added). Here, there was no evidence in the record that Remprex had written consent from Lloyd's to participate in any information-gathering activities in the BNSF lawsuit, thus such expenses would not have been covered as claims expenses. This is so, despite language in the policy exclusions section, which states that claims expenses incurred in defending the insured against allegations of unlawful collection of personally identifiable information because such activity was not preapproved by Lloyd's, which was a condition precedent under the definition of claims expenses.
¶ 56 Additionally, a review of the BNSF complaint reveals that there were general allegations made against BNSF and "authorized vendors," however, such general language did not bring the BNSF complaint within the definition of a claim as defined by the policy because there was no written demand received by Remprex for money or services in the BNSF complaint. We therefore conclude that because Remprex was never named as a defendant nor ever included in the BNSF lawsuit beyond its voluntary participation in information-gathering activities related to it, there was no demand made of Remprex for money or services that would support a claim for coverage under the plain language of the policy. Thus, the policy precludes coverage and Lloyd's had no duty to defend against the BNSF complaint.
¶ 57 The same result is reached when considering BNSF's answer to the complaint, in which it identified Remprex as an authorized vendor related to matters raised in the complaint. BNSF's answer was not a claim made against Remprex within the meaning of the policy because it did not demand money or services. Although BNSF sent a letter to Remprex after the BNSF lawsuit was filed requesting indemnification pursuant to their contractual agreement, the policy specifically excluded any contractual liability or obligation with respect to the media liability coverage. Apparently, Rempex had a contractual obligation to indemnify BNSF under the terms of their contract, which would therefore fall outside of the policy's coverage. Thus, BNSF's answer to the complaint in the lawsuit that did not name Remprex as a defendant was not a claim within the plain language of the policy and Lloyd's had no duty to defend against the BNSF answer.
¶ 58 With respect to the third-party subpoena received by Remprex from plaintiff Rogers' counsel in August 2020, the record reveals that Remprex did not submit a claim to Lloyd's regarding the subpoena. Remprex had previously submitted its initial request for coverage to Lloyd's in June 2019, Lloyd's denied coverage in November 2019, and Remprex filed this suit in August 2020. The subpoena, received by Remprex after the denial of coverage by Lloyd's was never submitted to Lloyd's for coverage, and Lloyd's only learned of the subpoena during the pendency of the litigation at issue. The policy required the insured to notify the insurer of any claim or potential claim as soon as practicable, but not later than 90 days after the end of the policy period. The policy at issue expired on July 30, 2019, thus it was no longer in place when Remprex received the subpoena more than a year later. Because the subpoena was received outside of the notice provision under policy, there was no coverage available.
¶ 59 Although Remprex considers the subpoena to be part of its original request for coverage filed in June 2019, Lloyd's duty to defend was never triggered because Remprex was not a named party to the BNSF lawsuit and there was no claim filed against it.. Thus, the subpoena was also not covered as it did not fall within the policy's effective dates or within 90 days after its expiration.
¶ 60 We therefore conclude that, despite Remprex's efforts to persuade us to the contrary, the policy did not cover any aspect of the BNSF lawsuit as Remprex was not a party to it and there was no claim for damages or demand for services made against Remprex in the BNSF lawsuit. We decline to discuss any other aspects of the policy specifics in reference to the BNSF lawsuit as we believe our conclusion fully disposes of the issue. Accordingly, we find that Lloyd's section 2-615 motion was properly granted with respect to the BNSF lawsuit because, even assuming that all well-pleaded facts in the declaratory judgment complaint are true, Remprex's complaint fails to state a cause of action against Lloyd's for coverage as there was no duty to defend in the BNSF lawsuit. Omega Demolition Corporation, 2022 IL App (1st) 210158, ¶ 36. The circuit court thus properly dismissed counts I and II as they pertain to the BNSF lawsuit.
¶ 61 2. Duty to Defend Against the CN Complaint
¶ 62 Remprex also contends that Lloyd's had a duty to defend it against the CN complaint under both the media liability and data & network liability coverage in the policy. It is uncontroverted that Remprex was a named defendant in the CN complaint and that a monetary demand was made in the prayer for relief, thereby satisfying the policy definition of a claim. Our question then becomes whether Remprex's claim was caused by a covered event so as to bring its losses within the ambit of the policy. Throgs Neck Bagels, 671 N.Y.S.2d at 69. We note again that while Remprex was initially named in the CN complaint, Remprex filed a successful motion to dismiss, and the plaintiff voluntarily dismissed Remprex from the suit in November 2019, approximately four months after filing the complaint.
¶ 63 a. Coverage Under the Media Liability Provision
¶ 64 With respect to the media liability coverage, as it has maintained in all of its pleadings related to this case, Remprex argues that the CN lawsuit involved allegations that Remprex disseminated media material to the public, including information violating individuals' privacy rights under BIPA, which was collected and transferred to third parties. Remprex insists that Lloyd's interpretation of the policy language "to the public" as meaning the community at large is too narrow and limits the scope of the provision is ways that were not intended by the policy. Remprex contends that the word "public" as used in the policy is ambiguous and that the public could include a limited group.
¶ 65 In order to determine whether the Media Liability provision of the policy applied and thus triggered Lloyd's duty to defend, we must first examine the type of information that was alleged to be captured or collected, and whether that type of information was covered by the policy.
¶ 66 The CN complaint alleged that the named defendants collected and transferred the individual's fingerprints in violation of Illinois' BIPA law. BIPA requires that an individual be informed and provide a release before any biometric information is captured or collected. See Watson v. Legacy Healthcare Financial Services, LLC, 2021 IL App (1st) 210279, ¶ 53. Under BIPA, "biometric information" is defined as "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual." 740 ILCS 14/10 (West 2018); Mosby v. Ingalls Memorial Hospital, 2022 IL App (1st) 200822, ¶ 47. BIPA further defines "biometric identifiers" as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Id. In the underlying CN complaint, it was alleged that the plaintiffs' fingerprint information was collected and stored without permission. There is no dispute that any collection and transfer of an individual's fingerprints without informing them and procuring a release would be a violation of BIPA.
¶ 67 However, the crux of our issue is whether an alleged violation of BIPA, as outlined in the CN complaint, triggered the media liability coverage under the policy.
¶ 68 As noted above, the policy specifically defines media liability as one or more of enumerated acts committed by or on behalf of the insured in the course of creating, displaying, broadcasting, disseminating or releasing media material to the public. As detailed above, the policy then goes on to outline specific acts that fall within the scope of coverage. The policy also defines media material as any information, including words, sounds, numbers, images or graphics. The parties do not appear to dispute whether fingerprints are considered media material as defined in the policy.
¶ 69 Remprex focuses its argument on the dissemination to the public requirement for coverage, maintaining that the policy did not define "public," and it is thus an ambiguous term. Remprex argues that Lloyd's uses a narrow definition of public and maintains that "public" can apply to information shared between itself and one other entity. To the contrary, we find that under the circumstances presented here, dissemination to the counterparty of the agreement to collect such information was not reasonably anticipated under the policy to constitute "public."
¶ 70 The construction and interpretation of an unambiguous written contract is an issue of law within the province of the court, as is the inquiry of whether the writing is ambiguous. Palombo Group v. Poughkeepsie City School District, 3 N.Y.S. 3d 390, 392 (2015). If the language is free from ambiguity, its meaning may be determined as a matter of law on the basis of the writing alone without resort to extrinsic evidence. Id. The contract language in an insurance policy is to be read in light of common speech and interpreted according to the reasonable expectations and purposes of ordinary businesspeople when making ordinary business contracts. Heartland Brewery, Inc. v. Nova Casualty Co., 52 N.Y.S. 3d 55, 57 (2017). Before the rules governing the construction of ambiguous contracts are triggered, the court must first find an ambiguity. Elletson v. Bonded Insulation Co. Inc., 708 N.Y.S.2d 511, 513 (2000). An ambiguity does not exist simply because the parties urge different interpretations or where one party's view strains the contract language beyond its reasonable and ordinary meaning. Id.
¶ 71 In this case, we find that the term "to the public" is not ambiguous, despite Remprex's arguments to the contrary. Merriam-Webster Dictionary defines public as "exposed to general view." https://www.merriam-webster.com/dictionary/public (accessed February 8, 2023). In reading the policy's use of the term "to the public" within the media liability definition, in context with the types of acts that would constitute media liability, it is clear that the policy intends for coverage to attach to actions that were intended for general view. For example, the policy defines media liability as one or more of the following acts in the course of creating, displaying, broadcasting, disseminating or releasing media material to the public: defamation, libel, slander or other tort related to the disparagement or harm to the reputation or character of any person or organization; plagiarism; copyright infringement; and invasion of or interference with any right to private occupancy, to name a few. These types of acts clearly anticipate that such media material has to be exposed to general view such that they would harm an individual or organization in order for coverage to apply. No such acts were included in the CN complaint's allegations against Remprex- there was no allegation that Remprex disseminated or released the plaintiff's biometric data to general view, only that it was shared between Remprex and the various railroad entities named within the suit. We therefore conclude that the use of "public" in the policy is not ambiguous and should be given its plain and ordinary meaning. Applying the plain and ordinary meaning to the language of the policy, it is clear that the allegations of the CN complaint did not allege that Remprex disseminated any media material to the public.
¶ 72 Aside from disseminating media material to the public, however, the policy also defines media liability as violating an individual's right to privacy during the "course of creating media material." As noted above, the parties do not appear to dispute whether fingerprints are considered media material. Nor is there any dispute that the CN lawsuit alleged that Remprex created such media material, which would thus fall or potentially fall within coverage under the policy. However, that does not end our inquiry.
¶ 73 It bears noting that the policy also contains language excluding losses arising from the unlawful collection or retention of personally identifiable information or other personal information by or on behalf of the insured organization. Nevertheless, the exclusion contains an exception, indicating that the exclusion is not applicable to claims expenses incurred in defending the insured against allegations of the unlawful collection of personally identifiable information. That is precisely what the CN complaint accused Remprex of doing: unlawfully collecting the plaintiffs' fingerprints. As such, we find that there was coverage under the policy for the claims expenses related to defending against the CN lawsuit. As noted, the CN complaint was filed on July 26, 2019, and Remprex was not dismissed from the lawsuit until November 24, 2019. Under the terms of the policy, Remprex was entitled to coverage for its claims expenses incurred in defending against the CN lawsuit.
¶ 74 Accordingly, we find that the trial court erred in denying coverage for the claims expenses that Remprex incurred in defending against the CN lawsuit based on its allegations that it unlawfully collected the CN plaintiffs' fingerprints. We therefore remand to the circuit court for a determination of those claims expenses due to Remprex.
¶ 75 b. Coverage Under the Data & Network Liability Provision
¶ 76 Remprex makes a similar argument with respect to its claim for coverage under the data & network liability provisions of the policy. Remprex asserts that the policy requires Lloyd's to defend Remprex for a "data breach," defined as any theft, loss or unauthorized disclosure of personally identifiable information *** that is in the care, custody or control of [Remprex] or a third party for whose theft, loss, or unauthorized disclosure of personally identifiable information [Remprex] is liable." Remprex argues that "in some way or another," the CN suit alleges that plaintiffs lost their personally identifiable information and that Remprex is liable for that loss, which makes the claim covered under the policy. Remprex contends that there is no question that the biometric data constitutes personally identifiable information under the policy, and further that the suit alleges a "loss" for which it is liable. Remprex makes a convoluted argument that the word "loss" with a lowercase "l" is different than the policy's defined term "Loss" with a capital "L," thus making the term ambiguous and seeks to employ extrinsic evidence to define the term.
¶ 77 As noted above, the data &network liability section of the policy provided, in pertinent part, that it would pay damages and claims expenses, which the insured was legally obligated to pay because of any claim made against the insured during the policy period for a data breach; a security breach; the insured's failure to timely disclose a data or security breach; failure by the insured to comply with that part of a privacy policy that specifically prohibited or restricted the insured's disclosure; and, the sharing or selling of personally identifiable information (provided that the insured had such privacy policy in place). The policy defined data breach as any software or electronic data that exists in computer systems and was subject to regular backup procedures. A data breach was defined as the theft, loss, or unauthorized disclosure of personally identifiable information or third party information that was in the care, custody or control of the insured or a third party for whose theft, loss or unauthorized disclosure the insured was liable. The policy also defined what constituted a loss. Personally Identifiable Information was defined as any information concerning an individual that was defined as personal information under any breach notice law; and an individual's driver's license or state identification number, social security number, unpublished telephone number, and credit, debit or other financial account numbers in combination with associated security codes, access codes, passwords or PINs, provided such information allows an individual to be uniquely and reliably identified or contacted or allows access to the individual's financial account or medical record information. It did not, however, include information that is lawfully made available to the general public. Finally, a security breach was defined as a failure of computer security to prevent unauthorized access or use of a computer system, including that which occurred from the theft of a password from a computer system or any insured; a denial of service attack affecting computer systems; with respect to coverage under the Liability insuring agreements, a denial of service attack affecting computer systems that are not owned, operated or controlled by an insured; or the infection of computer systems by malicious code or transmission of malicious code from computer systems.
¶ 78 A plain reading of the terms of the data &network liability coverage section of the policy as well as the relevant definition sections establish that the alleged violation of BIPA in the CN complaint do not fall, or potentially fall within this section of the policy. While it is true that fingerprint biometric data is personally identifiable information, the collection and storage of it without the individual's permission does not appear to fall under this section of the policy. Contrary to Remprex's argument, the CN complaint does not allege that such biometric data was stolen or shared with the public; rather, the complaint alleged that the named defendants played a part in collecting and sharing such data with one another without permission in violation of BIPA. The relevant policy section appears to apply primarily to third-party breaches of the insured's computer systems which in turn exposes the stored personal information to unauthorized persons. Remprex's attempts to bring the allegations of the CN complaint under the data &network coverage of the policy, while certainly creative, are without merit. The CN complaint contained no allegations that an unauthorized third party accessed individuals' personal information and shared it with the public, instead it merely alleged that the named parties engaged in the unauthorized collection of their personal information without their consent, which in turn is a violation of BIPA. We therefore conclude that Lloyd's had no duty to defend pursuant to the data &network provision of the policy.
¶ 79 We do not reach a discussion of whether there is a difference between loss with a lowercase "l" or uppercase "L" as we believe the plain language of the policy is dispositive of the issue.
¶ 80 D. Breach of Contract (Count II)
¶ 81 Remprex also contends that Lloyd's breached the contract of insurance by refusing to provide coverage for the CN and BNSF lawsuits. However, to the contrary, our conclusion that there was no coverage for the BNSF lawsuit means that Lloyd's had no duty to defend it and thus there was no breach of contract by its failure to do so. Consequently, the section 2-615 motion to dismiss was properly granted as to count II regarding the BNSF lawsuit.
¶ 82 With respect to the CN lawsuit, because we have found limited coverage for the claims expenses incurred by Remprex in defending against the CN lawsuit, we also find that Remprex has sustained its breach of contract claim for the CN lawsuit. However, in the context of insurance liability litigation, Remprex's damages related to a breach of the duty to defend are limited to the cost to the insured of defending itself. East Ramapo Central School District v. New York School Insurance Reciprocal, 158 N.Y.S. 3d 173, 179 (2021).
¶ 83 E. Bad Faith (Count III) and Vexatious and Unreasonable Conduct (Count IV)
¶ 84 Remprex further alleged in count III of its first amended complaint that Lloyd's denied its claims "without conducting a reasonable investigation based on all available information as required under Illinois law." Specifically, Remprex takes issue with the time it took Lloyd's to "analyze and prepare its denial letter to Remprex's request for coverage of the CN [and BNSF] lawsuit[s]." Additionally, in Count IV, Remprex alleged that Lloyd's conduct in denying coverage was vexatious and unreasonable under Illinois law, which entitled it to attorney's fees under section 155 of the Insurance Code (215 ILCS 5/155 (West 2020)). We disagree.
¶ 85 Remprex's claims of bad faith and vexatious and unreasonable conduct go hand in hand. Section 155 provides an extra contractual remedy intended to make suits by policyholders economically feasible and punish insurance companies for misconduct. McGee v. State Farm Fire &Casualty Co., 315 Ill.App.3d 673, 681 (2000). Thus, the key question in a section 155 claim is whether an insurer's conduct is vexatious and unreasonable. Id. To state a claim under section 155, the insured must plead some factual support and cannot merely allege that the insurer's conduct was vexatious and unreasonable. Id. Whether a delay is vexatious and unreasonable is a question of fact that must be assessed based on the totality of the circumstances, taken in broad focus. Nine Group II, LLC v. Liberty International Underwriters, Inc., 2020 IL App (1st) 190320, ¶ 41. No single factor is controlling. Id. In examining the circumstances, courts have considered the insurer's attitude, whether the insured was forced to file suit to recover, and whether the insured was denied the use of its property. Id. Additional considerations include whether there is a bona fide dispute concerning coverage, the extent of the insurance company's evaluation and investigation of the claim, and the adequacy of the communications between the insurance company and the insured. Id. Section 155 costs and sanctions are inappropriate when a bona fide dispute regarding coverage exists. Id. ¶ 44. Bona fide is defined as real, actual, genuine, and not feigned. Id. Where an insurer reasonably relies upon evidence sufficient to form a bona fide dispute, the insurer has not acted unreasonably and vexatiously under section 155. Id. Nor is an insurer liable for a violation of section 155 when it takes a reasonable but erroneous position on its coverage obligations where its position is at least arguable. Evergreen Real Estate Services, LLC v. Hanover Insurance Co., 2019 IL App (1st) 181867, ¶ 38. The granting of attorney fees and penalties pursuant to section 155 is usually entrusted to the sound discretion of the trial court but when section 155 fees and costs are awarded as a judgment on the pleadings, the standard of review is de novo. Statewide Insurance Co. v. Houston General Insurance Co., 397 Ill.App.3d 410, 425 (2009).
¶ 86 We find that Remprex has not sufficiently alleged that Lloyd's actions were vexatious and unreasonable. The conduct in question that was alleged by Remprex to constitute bad faith and vexatious behavior, namely the delay in processing the claims could reasonably demonstrate just the opposite- the amount of time that Lloyd's took to analyze the claim and determine whether there was policy coverage could support the inference that instead of immediately denying the claim, Lloyd's fully researched it to ensure that coverage would not be unfairly withheld. Additionally, Lloyd's denial of coverage was based on a bona fide dispute as to coverage; indeed, it is that dispute that got us here. Such bona fide dispute cannot support Remprex's claims of bad faith and vexatious and unreasonable behavior that would entitle it to section 155 attorney fees. Accordingly, Remprex's claims of bad faith and vexatious and unreasonable conduct were properly dismissed.
Remprex filed its initial claim for the BNSF case in June 2019 which Lloyd's denied in November 2019, only five months later. Discussions continued until April 2020 and Remprex filed the within case in August 2020.
¶ 87 F. Violations of the Illinois Consumer Fraud Act (Count V)
¶ 88 Remprex further alleged in count V that Lloyd's conduct was a violation of the Consumer Fraud Act (815 ILCS 505/2 (West 2020)) by engaging in unfair and deceptive acts and practices and arbitrarily denying claims without basis. We find that these counts were properly dismissed by the circuit court.
¶ 89 The Consumer Fraud Act is a regulatory and remedial statute that is intended to protect consumers, borrowers, and businesspersons against fraud, unfair methods of competition, and other unfair and deceptive business practices. Robinson v. Toyota Motor Credit Corp., 201 Ill.2d 403, 416-17 (2002). It makes it unlawful to engage in any unfair or deceptive acts or practices, including but not limited to the use of any deception, fraud, false pretense, false promise, misrepresentation or the concealment, suppression or omission of any material fact, with intent that others rely on it in the conduct of any trade or commerce. 815 ILCS 505/2 (West 2020). To establish a violation under the Act, a plaintiff must establish: (1) a deceptive act or practice by the defendant; (2) the defendant's intent that the plaintiff rely on the deception; (3) the occurrence of the deception during a course of conduct involving trade or commerce; and (4) the consumer fraud proximately caused the plaintiff's injury. White v. Daimler Chrysler Corp., 368 Ill.App.3d 278, 283 (2006). To establish a claim under the Consumer Fraud Act, a plaintiff must show that (1) defendant committed a deceptive act or practice; (2) defendant intended for plaintiff to rely on the deception; (3) the deception occurred in the course of conduct involving trade or commerce; (4) plaintiff suffered actual damages; and (5) plaintiff's damages were proximately caused by defendant's deceptive conduct. DOD Technologies v. Mesirow Insurance Services, Inc., 381 Ill.App.3d 1042, 1050-51 (2008). A complaint alleging a consumer fraud violation must be pled with the same particularity as that required under common law fraud. Id.
¶ 90 Here, Remprex's first amended complaint alleged that Lloyd's engaged in unfair and deceptive acts and practices by creating through its advertising the expectation among prospective insureds that media liability claims would be covered; selling policies purporting to cover media liability; and then arbitrarily and without basis denying coverage for such claims. The record does not support Remprex's allegations- Lloyd's policy did provide coverage for media liability as defined within the policy purchased by Remprex and Remprex's claims were not arbitrarily denied without a basis. We have determined that the policy provided no coverage for Remprex's claim for the BNSF lawsuit, and further that the policy provided limited coverage for Remprex's claim for the CN lawsuit. We have also determined that there was no bad faith or vexatious and unreasonable conduct in Lloyd's handling of the claims as there was a bona fide dispute as to coverage. We find that Remprex has not sustained its burden in raising a claim under the Consumer Fraud Act. Thus, its claim was properly dismissed.
¶ 91 G. Common Law Fraud (Count VI)
¶ 92 In count VI of the first amended complaint, Remprex alleged that Lloyd's "engaged in fraudulent acts and practices by creating through its advertising the expectation among prospective insureds that Media Liability claims would be cover[ed]; selling policies purporting to cover Media Liability claims; and then arbitrarily and without basis denying coverage for such claims." Remprex further alleged that Lloyd's engaged in these practices with the intent to deceive insureds, and that Remprex relied on those practices to its detriment.
¶ 93 We conclude that Remprex's claim of common law fraud fails because it did not satisfy the elements of common law fraud. The elements of common-law fraud are a material misrepresentation of an existing fact, made with knowledge of the falsity, an intent to induce reliance thereon, justifiable reliance upon the misrepresentation, and damages. Kastin v. GEIGO General Insurance Co., 140 N.Y.S. 3d 521, 523 (2021). Where a cause of action is based on a misrepresentation or fraud, the circumstances constituting the wrong shall be stated in detail. Id.
¶ 94 To start, Remprex fails to satisfy the requirement that there must be a false statement of material fact. Here, the fact that Lloyd's provided coverage for media liability in its policy was not a false statement; there was no issue raised as to whether Lloyd's provided that type of coverage. The only issue raised here was whether the claims made by Remprex fell or potentially fell within the scope of that coverage, which Lloyd's concluded that it did not and denied coverage under the policy. Remprex does not allege any additional facts to support this element, and such failure is fatal to its claim. We therefore affirm the dismissal of count VI.
As stated above, since the issue of whether Lloyd's had a duty to indemnify Remprex has not been raised in this appeal, we do not address that issue here. See Rodgers v. St. Mary's Hospital of Decatur, 149 Ill.2d 302, 309 (1992).
¶ 95 CONCLUSION
¶ 96 In conclusion, we affirm the portion of the circuit court's 2-615 dismissal as to all claims related to the BNSF lawsuit and counts III through VI. We reverse the circuit court's finding that there was no coverage under the CN lawsuit, finding that there was coverage for Remprex's claims expenses incurred in defending the CN lawsuit. We therefore remand for a calculation of Remprex's claims expenses due under the policy's coverage.
¶ 97 Affirmed in part; reversed in part; remanded with directions.