The Illinois Appellate Court recently issued the first-ever opinion regarding insurance coverage for claims under the Illinois Biometric Information Privacy Act (BIPA) involving a cyber insurance policy. The Court’s finding that the insurer owed a duty to defend under the Policy’s media liability coverage section provides another lifeline to policyholders seeking coverage amid the rising tide of BIPA lawsuits.

In Remprex, LLC v. Certain Underwriters at Lloyd's London, 2023 IL App. (1st) 211097, the policyholder, Remprex, sought coverage under its cyber policy for its role in connection with two BIPA lawsuits. The court held that insurer had no duty to defend Remprex in the first suit because Remprex was never named as a defendant, and there was never a claim made against the insured that would have triggered coverage.

However, the court found that Remprex was owed a defense for the second suit, in which Remprex was named as a defendant. The Court concluded that Remprex was entitled to coverage under the media liability section of its “Beazley Breach Response” policy, which provided coverage for any “violation of the rights of privacy of an individual” taking place “in the course of creating, displaying, broadcasting, disseminating or releasing ‘Media Material’ to the public.” Because the policy defined “Media Material” broadly to include “any information, including words, sounds, numbers, images or graphics,” the Court reasoned that Remprex’s collection and storage of fingerprint data could be viewed as “violating an individual’s right to privacy during the ‘course of creating media material,’” thereby triggering the insurer’s duty to defend. The Court rejected Remprex’s argument that it was also entitled to coverage under the data and network liability section of the policy.