No Duty To Defend BIPA Lawsuit Given Absence Of Data Breach Or Security Failure

The Appellate Court of Illinois, First District, applying Illinois law, has held that a cyber policy did not afford coverage for an underlying lawsuit alleging violations of the Biometric Information Privacy Act (BIPA) because the lawsuit did not include allegations of a "data breach" or "security failure" required to trigger coverage. Tony's Finer Foods Enters., Inc. v. Certain Underwriters at Lloyd's, London, No. 1-23-1712 (Ill. App. Ct. Sept. 10, 2024). The court also held that the policy's unlawful collection exclusion served as an independent bar to coverage.

In 2018, a former employee of the insured grocery retailer filed a putative class action complaint against the retailer for alleged violations of BIPA. The complaint alleged that the retailer required its employees to scan their fingerprints into a timekeeping system to clock in and out of work shifts. The complaint further alleged that the retailer violated the requirements of BIPA by failing to publish