Opinion
21 C 788
01-19-2023
Thermoflex Waukegan, LLC, Plaintiff, v. Mitsui Sumitomo Insurance USA, Inc., Defendant.
MEMORANDUM OPINION AND ORDER
Honorable Thomas M. Durkin, United States District Judge
Before this Court is an insurance coverage dispute between Plaintiff Thermoflex Waukegan, LLC (“Thermoflex”) and Defendant Mitsui Sumitomo Insurance USA, Inc. (“Mitsui”) concerning Mitsui's duty to defend and indemnify Thermoflex in state litigation brought under the Illinois Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. 14/1 et seq. The Court previously held that Mitsui had no duty to defend or indemnify Thermoflex under the commercial general liability policies and requested separate briefing on whether there were such duties under the excess and umbrella insurance policies. See R. 51. The parties have filed cross-motions for summary judgment on that issue. For the reasons explained below, the Court grants in part and denies in part Thermoflex's partial motion for summary judgment [54], and grants in part and denies in part Mitsui's motion for summary judgment [57].
Background
Mitsui issued several insurance policies to Thermoflex, namely a series of commercial general liability policies (“CGL Policies”) as well as excess and umbrella insurance policies (“E/U Policies”). Def. Statement of Facts (“DSOF”) ¶¶ 15, 21, R. 27. While those policies were in effect, Gregory Gates brought a class action lawsuit (“Gates” or “Gates lawsuit”) against Thermoflex in Illinois state court. Id. ¶¶ 7, 14. Gates alleged that Thermoflex violated BIPA by requiring hourly workers to scan their handprints each time they clocked in and out of work, transmitting their handprint data to a third party without authorization, and not providing them with a publicly available policy identifying its retention schedule or procedures for obtaining their consent and release. Id. ¶¶ 11, 12. Thermoflex requested that Mitsui defend and indemnify it for any damages arising from the suit, and Mitsui refused, asserting that none of the insurance policies it issued covers BIPA claims. Pl. Statement of Facts (“PSOF”) ¶¶ 22, 23, R. 55. This suit followed.
Thermoflex and Mitsui previously filed cross-motions for summary judgment as to whether Mitsui has a duty to defend and indemnify Thermoflex under the CGL Policies and E/U Policies. See R. 26; R. 30. The Court concluded that the CGL Policies' “Access Or Disclosure Of Confidential Or Personal Information” exclusion (“Access or Disclosure Exclusion”) barred coverage such that Mitsui has no duty to defend under the CGL Policies. See R. 51 at 8-17. On that basis alone, the Court granted Mitsui's motion and denied Thermoflex's cross-motion. Id. at 17. In so holding, the Court declined to address whether the other two exclusions at issue- the “Recording And Distribution Of Material Or Information In Violation Of Law” and “Employment-Related Practices” exclusions-barred coverage. Id. at 17 n.6. Further, because the parties did not address the E/U Policies with sufficient depth in their briefs, the Court limited its discussion to the CGL Policies and set a separate briefing schedule to provide the parties with an opportunity to more comprehensively address coverage under the E/U Policies. Id. at 2 n.1. The parties filed the present cross-motions for summary judgment as to whether Mitsui has a duty to defend Thermoflex under the E/U Policies. See R. 54; R. 57.
After the parties filed the present motions, the case was reassigned to the undersigned. See R. 66.
The E/U Policies include Coverage E and Coverage U. DSOF ¶ 22. Under Coverage E, Mitsui agreed, in relevant part, to pay on behalf of Thermoflex “those sums in excess of ‘underlying insurance' for which [Thermoflex] becomes legally obligated to pay as ‘damages'” from “personal or advertising injury” that “is covered by ‘underlying insurance' or that would have been covered by ‘underlying insurance' but for exhaustion of ‘underlying insurance' ‘limits' by the payment of claims, settlements, or judgments.” Id. ¶ 23. Under Coverage U, Mitsui agreed, in relevant part, to pay on behalf of Thermoflex “those sums in excess of . . . the ‘self-insured retention' [or] other insurance . . . for which [Thermoflex] becomes legally obligated to pay as ‘damages' because of . . . ‘personal advertising injury' to which this insurance applies.” Id. ¶ 26. The E/U Policies define “personal and advertising injury,” in relevant part, as injury arising out of an oral or written publication, including electronic publication, of material that violates a person's right to privacy. Def. Statement of Add'l Material Facts (“DSOAF”) ¶ 2, R. 58. The E/U Policies define “underlying insurance” as the CGL Policies. Id. ¶ 3. The CGL Policies have a limit of $1 million for personal and advertising injury and a $2 million aggregate limit, and the self-insured retention limit under the E/U Policies is $10,000. PSOF ¶¶ 13, 16. The E/U Policies also require Mitsui to defend Thermoflex in a suit seeking damages which “may be covered” under Coverage E and Coverage U. DSOF ¶¶ 23, 26; R. 16 at 24.
Coverage U “does not apply to claims which are covered under Coverage E or would have been covered except for exhaustion of ‘underlying limits.'” DSOF ¶ 26.
For Coverage E, this duty to defend arises “when the ‘limits' of ‘underlying insurance' are exhausted by the payment of claims, settlements, judgments, and/or defense costs if the applicable “limit” of ‘underlying insurance' is reduced by the payment of defense costs.” DSOF ¶ 23.
As the Court previously held, “it is uncontested that the claims Gates asserts in the underlying lawsuit allege ‘personal and advertising injury[.]'” R. 51 at 8. But Coverage E and Coverage U are subject to several exclusions.
The first, titled “Exclusion - Data Breach Liability Coverages E and U” (“Data Breach Exclusion”), precludes coverage for:
(1) “bodily injury”, “property damage”, or “personal and advertising injury” arising out of disclosure of or access to private or confidential information belonging to any person or organization; or
(2) any loss, cost, expense, or “damages” arising out of damage to, corruption of, loss of use or function of, or inability to access, change, or manipulate “data records”.
This exclusion also applies to “damages” for any expenses incurred by “you” or others arising out of 1) or 2) above, including expenses for credit monitoring, notification, forensic investigation, and legal research.DSOF ¶ 27; PSOF ¶ 18; R. 16 at 53. The second, styled as Exclusion j. under Coverage E and Exclusion z. under Coverage U (“Statutory Violation Exclusion”), bars coverage for “personal and advertising injury” arising directly or indirectly out of any violations or alleged violations of:
(1) the Telephone Consumer Protection Act (TCPA), including any amendments thereto, and any similar federal, state, or local laws, ordinances, statutes, or regulations;
(2) the CAN-SPAM Act of 2003, including any amendments thereto, and any similar federal, state, or local laws, ordinances, statutes, or regulations;
(3) the Fair Credit Reporting Act (FCRA), including any amendments thereto, such as the Fair and Accurate Credit Transaction Act (FACTA), and any similar federal, state, or local laws, ordinances, statutes, or regulations; or
(4) any other federal, state, or local law, regulation, statute, or ordinance that restricts, prohibits, or otherwise pertains to the collecting, communicating, recording, printing, transmitting, sending, disposal, or distribution of material or information.DSOF ¶¶ 24, 28. The third, styled Exclusion k. under Coverage E and Exclusion n. under Coverage U (“ERP Exclusion”), precludes coverage for “personal or advertising injury” to a person arising out of any:
(a) refusal to employ that person;
(b) termination of employment of that person; or
(c) coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation, malicious prosecution, discrimination, sexual misconduct, or other employment-related practices, policies, acts, or omissions, directed towards that person ....Id. ¶¶ 25, 29. The ERP Exclusion applies whether the insured may be liable as an employer or in any other capacity and to any obligation to reimburse a third party for “damages” because of the injury, whether fully or partially. Id.
Mitsui argues that these exclusions bar coverage for the Gates lawsuit. In the alternative, Mitsui argues that even if none of the exclusions apply, it does not presently owe Thermoflex a duty to defend because Thermoflex has not exhausted its primary insurance limits. Thermoflex argues that none of the exclusions apply, and that disputed facts regarding primary coverage preclude granting summary judgment in Mitsui's favor.
Legal Standard
Summary judgment is appropriate “if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed.R.Civ.P. 56(a); see also Celotex Corp. v. Catrett, 477 U.S. 317, 322-23 (1986). The Court considers the entire evidentiary record and must view all of the evidence and draw all reasonable inferences from that evidence in the light most favorable to the nonmovant. Horton v. Pobjecky, 883 F.3d 941, 948 (7th Cir. 2018). To defeat summary judgment, a nonmovant must produce more than a “mere scintilla of evidence” and come forward with “specific facts showing that there is a genuine issue for trial.” Johnson v. Advocate Health and Hosps. Corp., 892 F.3d 887, 894 (7th Cir. 2018). Ultimately, summary judgment is warranted only if a reasonable jury could not return a verdict for the nonmovant. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986).
Where the parties have filed cross-motions for summary judgment, the Court applies this standard to each motion separately to determine whether there is a genuine dispute of material fact and whether judgment should be entered as a matter of law. Marcatante v. City of Chi., 657 F.3d 433, 438-39 (7th Cir. 2011). In ruling on each cross-motion for summary judgment, the Court draws inferences in favor of the party against whom the motion under consideration is made. Siliven v. Ind. Dep't of Child Servs., 635 F.3d 921, 925 (7th Cir. 2011).
Analysis
The parties agree that Illinois law applies. See R. 56 at 3 n.1; R. 59 at 6. Under Illinois law, the “primary function of the court in construing contracts is to ascertain and give effect to the parties' intent as expressed in the insurance contract's language.” W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, ¶ 32 (citing Sanders v. Ill. Union. Ins. Co., 2019 IL 124565, ¶ 22). If a policy's words are unambiguous, the Court must afford them their plain and ordinary meaning. U.S. Fid. & Guar. Co. v. Wilkin Insulation Co., 144 Ill.2d 64, 74 (1991). If, however, the terms are “reasonably susceptible to more than one meaning, [they are] considered ambiguous and will be construed strictly against the insurer who drafted the policy.” Rich v. Principal Life Ins. Co., 226 Ill.2d 359, 371 (2007). In making such a determination, the Court must assess “[t]he entire insurance contract, rather than an isolated part.” Ind. Ins. Co. v. Pana Cmty. Unit Sch. Dist. No. 8, 314 F.3d 895, 903 (7th Cir. 2002).
Here, the Court must determine whether, under the E/U Policies, Mitsui has a duty to defend Thermoflex in the Gates lawsuit. A duty to defend arises if the Gates complaint “states a claim that is within, or even potentially or arguably within, the scope of coverage provided by the policy.” Pipefitters Welfare Educ. Fund v. Westchester Fire Ins. Co., 976 F.2d 1037, 1039 (7th Cir. 1992) (citing U.S. Fid., 144 Ill.2d at 73). The Court “liberally construes the underlying complaint and the insurance policy in the manner reasonably most favorable to the insured.” Title Indus. Assurance Co., R.R.G. v. First Am. Title Ins. Co., 853 F.3d 876, 884 (7th Cir. 2017). Accordingly, “a decision to excuse an insurer's duty to defend based on an exclusionary clause in the contract ‘must be clear and free from doubt.'” Zurich Am. Ins. Co. v. Ocwen Fin. Corp., 990 F.3d 1073, 1078 (7th Cir. 2021) (quoting Evergreen Real Estate Servs., LLC v. Hanover Ins. Co., 2019 IL App (1st) 181867). By the same token, “a policy provision that purports to exclude or limit coverage will be read narrowly and will be applied only where its terms are clear, definite, and specific.” Gillen v. State Farm Mut. Auto. Ins. Co., 215 Ill.2d 381, 393 (2005).
The pending motions do not address the duty to indemnify. That duty is not ripe because the issue of Thermoflex's liability in the Gates lawsuit has not yet been decided. See Gregory v. Farmers Auto. Ins. Ass'n, 392 Ill.App.3d 159, 161, 331 (2009) (“[A]lthough a declaratory judgment action brought to determine an insurer's duty to defend is ripe upon the filing of a complaint against the insured, a declaratory judgment action brought to determine an insurer's duty to indemnify an insured is not ripe for adjudication until an insured becomes legally obligated to pay the damages in the underlying action.”); see also Grinnell Mut. Reinsurance Co. v. Reinke, 43 F.3d 1152, 1154 (7th Cir. 1995) (“Illinois treats arguments about the duty to indemnify as unripe until the insured has been held liable.”).
I. Coverage E
Coverage E provides coverage for damages Thermoflex becomes legally obligated to pay for “personal and advertising injury” in excess of “underlying insurance,” subject to certain exclusions. But Coverage E only kicks in if the “underlying insurance” (the CGL Policies) provides coverage in the first place. And here, the Court already held that they didn't. See R. 51 at 17. Thermoflex thus asks this Court to reconsider the prior ruling.
Rule 54(b) “provides that non-final orders ‘may be revised at any time before the entry of a judgment adjudicating all the claims and all the parties' rights and liabilities.'” Galvan v. Norberg, 678 F.3d 581, 587 (7th Cir. 2012) (quoting Fed.R.Civ.P. 54(b)). “Motions for reconsideration under Rule 54(b) serve the limited function of correcting manifest errors of law or fact.” Ace Hardware Intern. Holdings, Inc. v. Masso Expo Corp., No. 11 C 3928, 2012 WL 182236, at *1 (N.D. Ill. Jan. 23, 2012) (citations omitted). To that end, “[i]t is well established that a motion to reconsider is only appropriate where a court has misunderstood a party, where the court has made a decision outside the adversarial issues presented to the court by the parties, where the court has made an error of apprehension (not of reasoning), where a significant change in the law has occurred, or where significant new facts have been discovered.” Broaddus v. Shields, 665 F.3d 846, 860 (7th Cir. 2011), overruled on other grounds by Hill v. Tangherlinin, 724 F.3d 965, 967 n.1 (7th Cir. 2013). A party asserting that the court committed a manifest error of fact or law bears a heavy burden. Brownlee v. Catholic Charities of Archdiocese of Chi., No. 16 C 665, 2022 WL 602535, at *1 (N.D. Ill. Mar. 1, 2022) (citation omitted).
Further, as relevant here, “[g]enerally speaking, a successor judge should not reconsider the decision of a transferor judge at the same hierarchical level of the judiciary when a case is transferred.” See Brengettcy v. Horton, 423 F.3d 674, 680 (7th Cir. 2005) (citations omitted). “Although the second judge may alter previous rulings if he is convinced they are incorrect, he is not free to do so . . . merely because he has a different view of the law or facts from the first judge.” Best v. Shell Oil Co., 107 F.3d 544, 546 (7th Cir. 1997) (citation omitted).
Thermoflex asserts that Judge Lee erred in deeming the Access or Disclosure Exclusion unambiguous. According to Thermoflex, the fact that other courts in this district have held that the same exclusion does not bar coverage of BIPA claims means that the exclusion is open to more than one reasonable interpretation. See, e.g., Am. Fam. Mut. Ins. Co. v. Caremel, Inc., No. 20 C 637, 2022 WL 79868, at *2-3 (N.D. Ill. Jan. 7, 2022) (Leinenweber, J.); Citizens Ins. Co. of Am. v. Thermoflex Waukegan, LLC, No. 20 C 5980, 2022 WL 602534, at *7 (N.D. Ill. Mar. 1, 2022) (Kness, J.); Citizens Ins. Co. of Am. v. Highland Baking Co., Inc., No. 20 C 04997, 2022 WL 1210709, at *1 (N.D. Ill. Mar. 29, 2022) (Pacold, J.). But “disagreement among courts regarding the interpretation of an insurance policy provision does not, by itself, render the provision ambiguous.” CFIT Holding Corp. v. Twin City Fire Ins. Co., 548 F.Supp.3d 701, 707 (N.D. Ill. 2021); see also Cozzini Bros. v. Cincinnati Ins. Co., Inc., No. 20 C 4274, 2021 WL 3408499, at *3 (N.D. Ill. Aug. 4, 2021), appeal dismissed, No. 22-1034, 2022 WL 2644114 (7th Cir. Mar. 29, 2022). Indeed, Judge Lee was well aware of his deviation from other courts in this district when he issued his ruling. R. 51 at 12 n.4. And Thermoflex has not pointed to any other basis for finding ambiguity that was not already considered and addressed by Judge Lee. This Court is not convinced that Judge Lee's ruling was incorrect, and thus the prior ruling that the Access or Disclosure Exclusion bars coverage under the CGL Policies stands. Accordingly, there can be no coverage for the Gates lawsuit under Coverage E.
II. Coverage U
Coverage U provides coverage for damages Thermoflex becomes legally obligated to pay for “personal and advertising injury” in excess of its “self-insured retention” or other insurance coverage, subject to certain exclusions. Mitsui and Thermoflex disagree as to whether the exclusions apply to bar coverage.
A. Statutory Violation Exclusion
The Statutory Violation Exclusion bars coverage for:
“personal and advertising injury” arising directly or indirectly out of any violations or alleged violations of:
(1) the Telephone Consumer Protection Act (TCPA), including any amendments thereto, and any similar federal, state, or local laws, ordinances, statutes, or regulations;
(2) the CAN-SPAM Act of 2003, including any amendments thereto, and any similar federal, state, or local laws, ordinances, statutes, or regulations;
(3) the Fair Credit Reporting Act (FCRA), including any amendments thereto, such as the Fair and Accurate Credit Transaction Act (FACTA), and any similar federal, state, or local laws, ordinances, statutes, or regulations; or
(4) any other federal, state, or local law, regulation, statute, or ordinance that restricts, prohibits, or otherwise pertains
to the collecting, communicating, recording, printing, transmitting, sending, disposal, or distribution of material or information.
While the exclusion does not explicitly refer to BIPA, Mitsui argues that Subpart (4) nonetheless bars coverage of the Gates lawsuit because BIPA is a statute that “governs the collection, recording, disclosure and dissemination of material or information.” R. 28 at 9-10; R. 59 at 9-10. In response, Thermoflex argues that the Illinois Supreme Court's holding in Krishna that a similar, but not identical “violation of statutes” exclusion did not bar coverage of a BIPA claim is dispositive. R. 32 at 8-9. As an authoritative construction of Illinois law, the holding in Krishna is binding unless it can be distinguished. See Kaiser v. Johnson & Johnson, 947 F.3d 996, 1013 (7th Cir. 2020).
In Krishna, the Illinois Supreme Court addressed an exclusion that included three subparts: the first two excluded claims under the TCPA and CAN-SPAM Act and the third was a catchall provision that applied to personal and advertising injury arising out of a violation or alleged violation of “[a]ny statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.” 2021 IL 125978, ¶ 9. The Illinois Supreme Court began its analysis with the title of the exclusion, “Violation of Statutes that Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or Information,” explaining that the title indicated the exclusion covered statutes governing methods of communication. Id. ¶ 58 (emphasis in original). The Krishna Court then delved into the text of the exclusion, identifying the common theme between the two referenced statutes as regulating methods of communication. Id. The Illinois Supreme Court next applied the canon of ejusdem generis to the text, Id. ¶¶ 57, 58, which provides “that when a general word or phrase follows a list of specifics, the general word or phrase will be interpreted to include only items of the same class as those listed.” Ejusdem generis, Black's Law Dictionary (11th ed. 2019). Accordingly, the Illinois Supreme Court construed the “other than” phrase in the catchall provision to mean other statutes of the same general kind as the TCPA and CAN-SPAM Act, which it held regulated methods of communication such as calls, faxes, and e-mails. 2021 IL 125978, ¶ 58. The Krishna Court reasoned that because BIPA does not regulate methods of communication, the exclusion did not apply. Id.
Here, the Statutory Violation Exclusion differs from the exclusion in Krishna in several ways. For one, the exclusion references three specific statutes, not two: the TCPA, the CAN-SPAM Act, and the FCRA (and its amendment FACTA). In fact, it goes even further by pulling in “any similar federal, state, or local laws, ordinances, statutes, or regulations” to the three referenced statutes. Additionally, Subpart (4) contemplates other ways of handling material or information. That provision covers not just sending, transmitting, communicating, and distributing material or information, but also collecting, recording, printing, and disposing material or information. And finally, while the exclusion in Krishna had a title that specifically referenced “other methods of sending material or information,” the Statutory Violation Exclusion as it appears in the E/U Policies has no title.
Mitsui highlights some of these differences in arguing that the reasoning in Krishna-that is, “interpreting the catch-all provision by looking at the statutes expressly enumerated in the exclusion”-compels a different result here. R. 36 at 9. In Mitsui's view, BIPA falls within the boundaries of the exclusion because it, like the FCRA and FACTA, aims to “protect[] the privacy of personal information.” Id.
Mitsui incorporates the argument from its original motion for summary judgment distinguishing the similar exclusion in the CGL Policies (“Recording and Distribution of Material Exclusion”) from that in Krishna. See R. 59 at 10. In its original briefing, Mitsui pointed to the different titles, the inclusion of the FCRA (and FACTA), and the other ways of handling material or information contemplated in Subpart (4). See R. 28 at 11-12. Mitsui did not point out that the Statutory Violation Exclusion has no title and references “any similar federal, state, or local laws, ordinances, statutes, or regulations” to the three referenced statutes.
Other courts in this district have undertaken this analysis with similar exclusions. Many of these cases are distinguishable in that the exclusions at issue did not reference the FCRA. See, e.g., Am. Mut. Ins. Co. v. Carnagio Enters., Inc., No. 20 C 3665, 2022 WL 952533, at *6 (N.D. Ill. Mar. 30, 2022); Caremel, 2022 WL 79868, at *3. But one case cited by Thermoflex, which involves an exclusion that incorporates the FCRA (and FACTA), is instructive. See R. 56 at 9 n.3.
In Citizens Ins. Co. of Am. v. Wynndalco Enters., LLC, the court observed at the outset that even though BIPA would seem to fit in the catchall provision, interpreting the exclusion to “cover every statute that concerns a person or entity doing practically anything whatsoever with ‘information'” would “swallow the rule” by making other coverage provisions in the policy, including that pertaining to “personal and advertising injury,” “illusory.” 595 F.Supp.3d 668, 673 (N.D. Ill. 2022). Because the text of the exclusion was “ambiguous on its face,” the court turned to canons of construction, but found them to be of little use. Id. at 674. Ejusdem generis was inapplicable because the inclusion of the FCRA and FACTA severed the common characteristic present in Krishna, which was required for its application. Id. The court added that even if it were to apply ejusdem generis as Citizens advocated, where the common characteristic was the protection of privacy interests generally, it would not help the insurer “[b]ecause the type of ‘privacy' that BIPA protects is dissimilar to the type of privacy that the TCPA and the CAN-SPAM Act regulate[.]” Id. at 675 (citing Am. States Ins. Co. v. Cap. Assocs. of Jackson Cnty., Inc., 392 F.3d 939, 941-43 (7th Cir. 2004)). The court further explained that the canon of noscitur a sociis likewise provided no clarity because of the lack of a common characteristic between the listed statutes. Id. at 676. Without clear meaning from the plain text or the canons of construction, the court concluded that the exclusion was ambiguous and construed it in favor of coverage. Id.; see also Citizens, 588 F.Supp.3d at 854 (explaining that “[a]t best, it is unclear whether BIPA is sufficiently similar to those other statutes; at worst, as in Krishna, BIPA is different in kind” and finding in favor of coverage for Thermoflex because the exclusion could be viewed as ambiguous).
The Court notes that there is currently an appeal pending before the Seventh Circuit in Wynndalco on the question of whether the violation of law exclusion applies to preclude coverage for BIPA litigation. See Citizens Ins. Co. of Am. v. Wynndalco Enters., LLC, et al., No. 22-2313.
This Court is persuaded by the reasoning in Wynndalco. At first glance, a BIPA claim would seem to fit within the exclusion's boundaries as a “statute that . . . restricts, prohibits, or otherwise pertains to the collecting, communicating, recording, printing, transmitting, sending, disposal, or distribution of material or information.” BIPA is a state statute, which “imposes on private entities . . . various obligations regarding the collection, retention, disclosure, and destruction of biometric identifiers and biometric information.” Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186; see also 740 ILCS 14/15(b) (“No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless ....”); 740 ILCS 14/15(d) (“No private entity in possession of a biometric identifier or information may disclose, redisclose, or otherwise disseminate a person's or customer's biometric identifier or biometric information unless ....”).
But such a reading is not “narrow.” Gillen, 215 Ill.2d at 393. And the exclusion's broad terms are far from “clear, definite, and specific.” Id. The exclusion begins with the word “any” and extends across laws, regulations, statutes, and ordinances at the federal, state, and local levels. It follows with three verbs, the last of which is expansive: “otherwise pertains to.” See Merriam-Webster, “Otherwise”, https://www.merriam-webster.com/dictionary/otherwise (defining “otherwise” as “in other respects”); Merriam-Webster, “Pertain”, https://www.merriam-webster.com/dictionary/pertain (defining “pertain” as “to belong as an attribute, feature, or function” or “to be appropriate to something”). Next there are eight different activities, and a similarly broad phrase, “material or information,” to finish. This language is even less specific than in Wynndalco. The catchall provision in Wynndalco stated: “any [statute] other than [the listed statutes and their amendments] that address, prohibit, or limit [the ways of handling] material or information” framework. 595 F.Supp.3d at 671 (emphasis added). In contrast, Subpart (4) contemplates “any other [statutes] that restrict, prohibit, or otherwise pertain to [the ways of handling] material or information.” (emphasis added).
Additionally, reading the exclusion to encompass any statute that relates in any other way to handling material or information would seem to swallow up large swaths of Coverage U's coverage. See Founders Ins. Co. v. Munoz, 237 Ill.2d 424, 433 (2010) (“[A]n insurance policy must be considered as a whole[.]”). Here, the E/U Policies expressly cover “personal and advertising injur[ies],” which arise out of “[o]ral or written publication, including electronic publication, of material that: slanders or libels a person or organization,” as well as copyright infringement. R. 16 at 14. Such claims could similarly be said to arise under statutes that “restrict[], prohibit[], or otherwise pertain[] to the . . . communicating . . . or distribution of material or information.” See, e.g., Illinois Slander and Libel Act, 740 Ill. Comp. Stat. 145/0.01 et seq.; Copyright Act, 17 U.S.C. § 101 et seq.
Given the provision's facial ambiguity, the Court follows the Illinois Supreme Court's lead in turning to canons of construction. But as in Wynndalco, they do not provide clarity. Ejusdem generis requires the general term to share a characteristic that is common to all of the specific terms. Sw. Airlines Co. v. Saxon, 142 S.Ct. 1783, 1792 (2022). And here, the three listed statutes do not lend themselves to any common characteristic. Indeed, Mitsui acknowledges that the TCPA and SPAM “address means of communicating,” while the FCRA and FACTA “address the use of specific kinds of information.” R. 28 at 11; see also R. 36 at 7.
Mitsui cites two cases that have concluded similar exclusions bar coverage for claims under other statutes. See Zurich, 990 F.3d 1073 (applying exclusion to Fair Debt Collection Practices Act); Nat'l Union Fire Ins. Co. of Pitt. v. Coinstar, Inc., 39 F.Supp.3d 1149, 1156 (W.D. Wash. 2014) (Washington law) (applying exclusion to Michigan Video Rental Privacy Act). But neither case considered whether those exclusions covered BIPA, as Krishna and Wynndalco do. Those cases therefore do not move the needle.
Without clear meaning from the text or with the aid of canons of construction, the exclusion is ambiguous and must be construed in favor of coverage.
B. Data Breach Exclusion
The Data Breach Exclusion precludes coverage for “personal and advertising injury” arising out of “disclosure of or access to private or confidential information belonging to any person or organization” or “‘damages' arising out of damage to, corruption of, loss of use or function of, or inability to access, change, or manipulate ‘data records.'” Mitsui asserts that this exclusion is, in all material aspects, identical to the Access or Disclosure Exclusion, which the Court previously held barred coverage under the CGL Policies. R. 28 at 6; R. 59 at 7-9. Thermoflex argues that the exclusions are meaningfully different, with the Data Breach Exclusion limited to data breaches. R. 64 at 4-5.
To be sure, certain language in the Data Breach Exclusion tracks closely with the Access or Disclosure Exclusion. Compare Data Breach Exclusion (“‘personal and advertising injury' arising out of disclosure of or access to private or confidential information belonging to any person or organization”) with Access or Disclosure Exclusion (“‘personal and advertising injury' arising out of any access to or disclosure of any person's or organization's confidential or personal information . . .”). However, reading the exclusion in its entirety suggests that it was not intended to bar coverage beyond data breach liability.
Illinois law requires “that all the provisions of an insurance contract, rather than an isolated part, should be read together to interpret it[.]” Mkt. St. Bancshares, Inc. v. Fed. Ins. Co., 962 F.3d 947, 954-55 (7th Cir. 2020); see also AFM Mattress Co., LLC v. Motorists Com. Mut. Ins. Co., 503 F.Supp.3d 602, 606 (N.D. Ill. 2020) (“[E]very part of the contract must be given meaning, so no part is meaningless or surplusage.”). Accordingly, this Court must read the language Mitsui focuses on alongside its surrounding language, beginning with the title. See Krishna, 2021 IL 125978, ¶ 58 (beginning the analysis of an exclusion's meaning with the text of its title). The title of this exclusion reads “Exclusion-Data Breach Liability.” R. 16 at 53. This is markedly different than the exclusion Mitsui asserts is identical, which is titled “Access or Disclosure of Confidential or Personal Information and Data-Related Liability - With Limited Bodily Injury Exception.” DSOF ¶ 18. Because the E/U Policies do not supply a definition for “data breach,” the Court gives the phrase its “plain and ordinary meaning, which can be derived from a dictionary.” Gulino v. Econ. Fire & Cas. Co., 2012 IL App (1st) 102429, ¶ 18. Merriam-Webster defines “data” as “factual information (such as measurements or statistics) used as a basis for reasoning, discussion, or calculation” or “information in digital form that can be transmitted or processed” and “breach” as “a broken, ruptured, or torn condition or area” or “a gap (as in a wall) made by a battering.” Merriam-Webster, “Breach”, https://www.merriam-webster.com/dictionary/breach. Consistent with the dictionary definitions, a “data breach” can be ordinarily understood as improperly obtaining access to protected information.
Mitsui does not argue that the Gates lawsuit alleges a data breach, but instead asserts that the title does not limit the exclusion. Of course, under Illinois law, a court “does not construe a contractual provision by looking at its title alone.” Zurich Am. Ins. Co. v. Ocwen Fin. Corp., 357 F.Supp.3d 659, 673 (N.D. Ill. 2018), aff'd, 990 F.3d 1073 (7th Cir. 2021). But other language in the exclusion reasonably suggests that the exclusion is limited to data breaches. The second subsection, which follows the “disclosure of or access to” language, speaks of “damage to, corruption of, loss of use or function of, or inability to access, change, or manipulate ‘data records.'” R. 16 at 53. And the E/U Policies define “data records” as “files, documents, and information in an electronic format that are stored on instruments used with computer hardware, networks, or other computer programs and applications, including those used with electronically controlled equipment.” Id. at 11. In addition, the exclusion references “expenses for credit monitoring, notification, [and] forensic investigation,” which relate to actions taken in the aftermath of a data breach. Id. Taken together, the exclusion would seem to be focused on the “disclosure of or access to private or confidential information” in a data breach or the resulting impact of that data breach.
The Data Breach Exclusion's language indicates that it is limited to the data breach context, which the Gates lawsuit does not implicate. But to the extent the Data Breach Exclusion is open to another reasonable interpretation in light of its similar language to the Access or Disclosure Exclusion, it is ambiguous and must be construed in favor of coverage.
C. ERP Exclusion
The ERP Exclusion precludes coverage for “personal and advertising injury” arising out of “other employment-related practices, policies, acts, or omissions directed towards that person.” The parties disagree as to whether the exclusion extends to the alleged conduct in Gates, which Mitsui describes as arising out of a “policy” of requiring hourly workers to use a biometric time tracking and attendance system. See R. 28 at 12-13; R. 32 at 10-13; R. 59 at 10-11.
Beginning with the text, the exclusion bars coverage for “‘personal and advertising injury' arising out of any: (a) refusal to employ that person; (b) termination of employment of that person; or (c) coercion, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation, malicious prosecution, discrimination, sexual misconduct, or other employment-related practices, policies, acts, or omissions directed towards that person ....” Mitsui does not claim that Gates involves allegations related to improper hiring or firing, so the focus is on the third subpart.
The phrase “other employment-related practices, policies, acts, or omissions” does not stand alone. It is expressly modified by the phrase that follows: “directed towards that person.” And it is preceded by a list of examples. The list includes some legal claims (defamation, harassment, discrimination, malicious prosecution), some adverse employment actions (demotion, evaluation, reassignment, discipline), and some other personalized harms that may occur in the workplace setting (coercion, humiliation, sexual misconduct). See Citizens, 588 F.Supp.3d at 852. But all can fairly be characterized as actions taken against a worker in the employment context in a targeted, personal way. See State Auto. Mut. Ins. Co. v. Tony's Finer Foods Enters., Inc., 589 F.Supp.3d 919, 928 (N.D. Ill. 2022) (describing listed examples as “mistreatment that is targeted at a specific employee in a direct, personal way.”).
It is difficult to see how Thermoflex's “policy” that hourly workers use a biometric time tracking and attendance system would fit the bill. It is a workplace policy that applies to everyone in the same way; it is not conduct directed towards a specific person at an individual level. Indeed, if someone added “biometric time tracking policy” to the list of examples, it would “stick out like a sore thumb.” See Id. at 928.
Several courts in this district have addressed this precise question, and most have found in favor of the insured. See, e.g., Citizens, 588 F.Supp.3d at 851 (holding that the claims in the Gates lawsuit “do not unambiguously share ‘general similitude with . . . the matters specifically enumerated in the employment-related practices exclusion'”); Highland Baking, 2022 WL 1210709, at *1 (employment-related practices exclusion did not unambiguously preclude coverage of BIPA claim); Tony's, 589 F.Supp.3d at 930 (“BIPA claims do not fall within the exclusion for employment-related practices.”); Cheese Merchants, No. 21 C 1571, 2022 WL 4483886, at *4 (N.D. Ill. Sept. 27, 2022) (adopting the reasoning of Tony's in holding that employment-related practices exclusion did not unambiguously preclude coverage of BIPA claim arising out of hand scanning practice); Carnagio, 2022 WL 952533, at *6 (holding practice of fingerprinting when clocking in and out of work did not fall within the employment-related practices exclusion and finding ambiguity that required resolution in the insured's favor).
However, Mitsui points to Caremel, wherein another court in this district held that a similar exclusion unambiguously excluded coverage for BIPA violations. R. 59 at 10. That court explained that the fingerprinting requirement applied to employees at an individual level and that a “BIPA violation was of the same nature” as the listed examples, which “reflect a practice that can cause individual harm to an employee.” 2022 WL 79868, at *4. But, as explained in Citizens, reading the exclusion to bar coverage for any employment-related practice that “can” cause harm to an employee would sweep in essentially any claim against an employer. 588 F.Supp.3d at 852. Such a reading is contrary the rule that exclusions must be read “narrowly.” Id. (citing Gillen, 215 Ill. at 393). Further, notwithstanding its initial finding that the fingerprinting requirement applied to employees individually, the Caremel court then shifted its definition of the practice in question to a BIPA violation. That the conduct at issue could be framed, for example, as a policy of biometric time keeping, a practice of collecting, storing, and transmitting biometric information, an act of violating BIPA or privacy rights, or the omission of obtaining authorization only indicates ambiguity in the exclusion as applied. See Citizens, 588 F.Supp.3d at 852.
Elsewhere in its original briefing, Mitsui adopts different characterizations for the practice or policy at issue. Compare R. 36 at 11 (“Thermoflex does not dispute that its alleged clock-in/clock-out policy is an employment-related practice, policy, act, or omission) (emphasis added) with id. at 13 (“Thermoflex's alleged violations of its employees' or workers' privacy rights in their biometric identifiers are precisely “of the same kind” as the examples of employment-related harms enumerated in the exclusion) (emphasis added).
Accordingly, Thermoflex's “policy” of requiring hourly workers to use a biometric time tracking and attendance system does not fall within the ERP Exclusion. At a minimum, the ambiguity as to whether the exclusion bars coverage of the conduct at issue in Gates requires resolution in favor of coverage.
D. Exhaustion
Mitsui argues that even if none of the exclusions in Coverage U preclude coverage of the Gates lawsuit, it has no present duty to defend Thermoflex because under Illinois law, such a duty would not arise until Thermoflex exhausts primary coverage. R. 59 at 11 (citing Kajima Const. Servs., Inc. v. St. Paul Fire & Marine Ins. Co., 227 Ill.2d 102, 115 (2007)). Mitsui asserts that Thermoflex is unable to make such a showing because another court in this district held that a different, primary insurer owes Thermoflex a duty to defend in the Gates lawsuit. Id. at 11 (citing Citizens, 588 F.Supp.3d at 848 (Kness, J.)).
Kajima dealt with the doctrines of targeted tender and horizontal exhaustion. Targeted tender allows an insured covered by multiple and concurrent primary insurance policies to choose one of those carriers to defend and indemnify it against a claim. Kajima, 227 Ill.2d at 107. Horizontal exhaustion “requires an insured to exhaust all available primary limits before invoking excess coverage.” Id. at 113. Horizontal exhaustion is “based on the recognition of the difference between primary and excess insurance.” Id. In Kajima, the Illinois Supreme Court declined to extend targeted tender to “require an excess policy to pay before a primary policy” because it would “eviscerate the distinction between primary and excess insurance.” Id. at 116. Rather, the Illinois Supreme Court held that “to the extent that defense and indemnity costs exceed the primary limits of the targeted insurer, the deselected insurer or insurers' primary policy must answer for the loss before the insured can seek coverage under an excess policy.” Id. at 117.
Thermoflex does not argue that the E/U Policies are not excess in nature, but instead contends that there are no facts in the record regarding other primary coverage. R. 64 at 6. But courts regularly take judicial notice of the actions of other courts. Daniel v. Cook Cty., 833 F.3d 728, 742 (7th Cir. 2016) (citing Gen. Elec. Cap. Corp. v. Lease Resol. Corp., 128 F.3d 1074, 1081 (7th Cir. 1997)); Opoka v. Immigr. & Naturalization Serv., 94 F.3d 392, 394 (7th Cir. 1996) (citations omitted) (“Indeed, it is a well-settled principle that the decision of another court . . . is a proper subject of judicial notice.”) And in Citizens, the court held that Citizens Insurance Company of America, which issued Thermoflex a Commercial Lines Policy, owed Thermoflex a duty to defend in the Gates lawsuit. 588 F.Supp.3d at 848. Applying the principle of horizontal exhaustion, Mitsui's duty to defend Thermoflex under Coverage U is not triggered until the limits of the Citizens policy are exhausted.
Thermoflex further argues that because Judge Kness did not decide the duty to indemnify, Citizens does not establish that Thermoflex has primary coverage through another insurer that it has not exhausted. But whether or not Citizens has a duty to indemnify does not change the fact that Citizens is a primary policy, and the E/U Policies are excess policies. And “[i]nsurers which issue excess policies . . . are not liable to pay defense costs before the conclusion of the underlying suit. Instead, insurers which issue primary policies have the primary duty to pay defense costs.” Am. States Ins. Co. v. Liberty Mut. Ins. Co., 291 Ill.App.3d 336, 339 (1997) (citations omitted).
Thermoflex finally argues that that the Citizens policy has different effective dates than the E/U Policies, and that Citizens is refusing to provide a defense and denying coverage notwithstanding the holding in Citizens. Id. at 5-6. That the E/U Policies cover a different time period than the Citizens policy does not mean that the E/U Policies are not excess to it. See Kajima, 227 Ill.2d at 114. Nor does the fact that Citizens apparently continues to deny this duty negate Judge Kness's ruling that there is a duty owed.
Accordingly, while Mitsui owes Thermoflex a duty to defend under the E/U Policies because the Gates lawsuit is potentially within the scope of coverage under Coverage U, that duty to defend does not arise until the limits of the Citizens policy are reached. Metzger v. Country Mut. Ins. Co., 2013 IL App (2d) 120133, ¶ 20 (“Thus, if there is even potential coverage, the insurer must assume the defense of the underlying lawsuit, unless the insurer is secondary or excess, in which case the insurer's duty to defend will not arise until the limits in the primary policy are reached.”)
Conclusion
For the foregoing reasons, the Court grants in part and denies in part Thermoflex's partial motion for summary judgment, and grants in part and denies in part Mitsui's motion for summary judgment. Mitsui owes no duty to defend under Coverage E. While Mitsui owes a duty to defend under Coverage U, that duty to defend does not arise until Thermoflex has exhausted its primary insurance limits.