# Oral argument — Thermoflex Waukegan, LLC v. Mitsui Sumitomo Insurance USA > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/argument%3A90173 ## Record - **Collection:** Oral argument - **Document type:** Oral argument - **Published:** January 17, 2024 ## Text We'll hear argument now in Thermoflex Waukegan against Mitsui Sumitomo Insurance. Mr. Goodman, may it please the court, counsel, good morning. I'm David Goodman. I represent Thermoflex Waukegan. In this lawsuit, Thermoflex Waukegan was sued in July of 2020 for violating the Illinois Biometric Privacy Act for publishing employee biometric information. It promptly tendered the lawsuit to its insurer, Mitsui, both under a general liability insurance policy and under an umbrella access policy that followed form. The general liability policy had coverage, provided coverage for requiring the insurer to defend against any suit that alleges a claim that came within the personal and advertising injury of the insurance contract. And so there is no dispute under settled Illinois law, this is a case that's brought under, subject to diversity jurisdiction and it's under Illinois law, there isn't a dispute under Illinois law that the claim, publication of biometric information, falls within the personal and advertising injury coverage of the policy. The issue, the only issue, is whether or not the claim that was brought is subject to any of the exclusions in the policy. And in this case... Yes, exactly, that makes sense. So in the access or, and that's the issue that was decided adverse to us on summary judgment. The court, reading the access and, or disclosure of confidential personal information and data related liability exclusion, a mouthful, said and found that the clause as, you know, described the clause as if it read, this insurance does not apply to damages arising out of any access to or disclosure of any person's personal injury, personal information, period. On the next page of its opinion, the court said, here nothing is ambiguous about the phrase any access to or disclosure of any person's personal information, period. But the sentence in the exclusion doesn't read that way. The period placed by the court isn't there. In fact, the clause itself, you know, reads as follows. This insurance does not apply to personal and advertising injury arising out of any access to or disclosure of any person's or organization's confidential or personal information going on, including patents, trade secrets, processing methods, customer lists, financial information, or any other type of non-public information. Had it been the insurer's intent to make this exclusion simply apply to personal, excuse me, confidential or personal information, period, it could have written it that way. In fact, it's the insurer's obligation as the drafter to say what it means in the policy. What problem do you have with the phrase any other type of non-public information? What's ambiguous about that phrase? Because it follows this list of things like patents. No. What problem do you have with the word any? Right? It's trying to be as comprehensive as you can imagine. Well, Your Honor, I mean, when I look at any, and the court, you know, found any was looking at any as if it modified information, personal information or confidential information. It doesn't. It modifies person or organization or access. No. The word any modifies other type of non-public information. So when I look at this, I look at other type of non-public information. It's a list of things and the any in the public information presumably is referring to the way it's drafted, the list of things, which would be patents, which are certainly non-public information. So your view of the word any should really read similar. Well, the policy is to be read as an ordinary reasonable layperson would read a policy, would read a contract. That's how Illinois law looks at these provisions. And I look at it and I would try to understand personal and confidential information, terms that are not defined in the policy. And I look at the things that are identified as personal or confidential information. And then I look at this list and I look at other type of non-public information. I look at the list. Many of the things or some of the things are not non-public information. Right. They've got a list of things that people might not think of as non-public information because patents are public. They have to be published, right? But then they've got this catch-all. They begin with something that's broad and end with a catch-all. It doesn't seem to me that that can just be limited to patents. Well, and we wouldn't limit it to patents. Illinois law and the Illinois Supreme Court in Krishna, when they talk about how we read catch-alls, we should look at the things that are the specifics, the specific things that are being defined, so that we can understand the catch-all. And here, when I read the specific things that precede it, as the Court points out, patents are not. We can't disagree with your statement that when you read something, you read it that way because I can't open your head and look inside. But I think you might hear that other people read it as what it says. Well, I understand. I'm not offering myself. I think that presumably any reasonable person, any reasonable person means any reasonable lay person. So you don't think Judge Lee is reasonable? I wouldn't say that. I would say that he made a mistake in this case. And I wouldn't say that a number of other judges who have construed this same phrase came to a different conclusion as to what it means. Has any Illinois court sided with your reading of this phrase? A state court, an appellate level, or a trial court? A trial court has. Any state appellate court? Not yet. It hasn't been presented to any Illinois state appellate court yet. But a state trial court has. And there is a divergence of views as to what this means or whether this particular exclusion is ambiguous. Before we get there, I guess that's where we would start. What makes it ambiguous? Because I'm stuck on the word including as being illustrative and not limiting. So it's illustrative of the things that are confidential and personal information. And the very first thing that's identified is not either confidential or personal information. But that's inconceivable because patents are not neither confidential nor personal. I agree 100%. It's trying to expand the first phrase. Well, if personal... You can't put patents in the category of confidential. You can't put them in the category of personal. So what you've got is something that says confidential or personal. And then it adds patents, et cetera. That's what seems to be what's going on. I believe including is to be indicative of personal and confidential information. I agree with the court that patents are not personal or confidential information. In fact, had the insurer intended the exclusion to apply to something more broad than personal and confidential information, it could have done that as well. Did they not do that by adding the word patent? I'm sorry, I didn't hear. Did they do that by adding the word patent and then including any other type? I don't believe so because it precedes including. And I think that including is supposed to be indicative of the things that would be considered personal and confidential information. It could have said personal, confident... I mean, in other places, in the policies, the insurers describe specifically the types of things that are not covered, that are excluded from coverage. In this case, it's personal and confidential information. And then it gives including as indicative of what would be personal and confidential information. If I look at the other things, there are other things. Health information, that's probably personal information. I suppose it could be confidential information. I'm not sure the customer lists are necessarily either of those things. They can be, but they may not be. Trade secrets, those are by statute confidential information. Processing methods, those may not be either of those things. So I think the way it's drafted, including, using the word including, I think, because I think including refers to the confidential and personal information. I think that makes the exclusion ambiguous and it's furthered by the catchall at the end or any other type of non-public information, the other being the things that preceded. Some of those things are not, certainly not personal information and or confidential information. So I think the way the exclusion has been constructed makes it ambiguous. Mr. Goodman, do you want to address the 28-J letter we received with regard to the recent Illinois appellate case? Sure, sure. So the 28-J letter addressed a decision in visual PAC. It's a case decided in December and I believe that visual PAC turns well-settled Illinois law on its head. I think that it... Well, whatever it does, it's Illinois law today, right? No, it's Illinois law as Judge Easterbrook has written in, I can't think of the name of the case, but it's an Illinois Supreme Court decision. Well, we're bound by that. No, I don't believe you are bound by that. You're bound by decisions of the Illinois Supreme Court. Are you asking us to certify the question? To the Illinois Supreme Court? Yeah. I mean, what do we do with it? I understand its intention with our jurisprudence, but it's pretty close to the facts of this case. It construes an exclusion that I would say is substantially the same. It's the exclusion that was addressed by this court in the Wendolko case. And in this case, in the Wendolko case, this court, and I believe this court properly followed binding Illinois authority, including the Kristin Schomburg case... It was binding until December, right? No, no, no, no. Wendolko, I believe, is controlling here at this point in time. The Illinois Supreme Court has not addressed the issue of that specific, of the specific endorsement as it has been amended. The amendment, if anything, makes the exclusion more ambiguous than the same logic that the Illinois Supreme Court applied in Krishna, and you should, and the Illinois appellate court should have. You would look at the statutes that are identified specifically in the exclusion. In this case, it would be the first two statutes were the same as those addressed in Krishna. Those were the Canned Spam Act of 2003 and the TCPA. And the court there found, looking at those two statutes, those regulate customer, excuse me, communication, methods of communication. The other two statutes or regulations that have been added are FACTA and FCRA. Those both regulate consumer credit information. And applying the same logic that the Illinois Supreme Court used in Krishna, which is the appropriate way of addressing this, the court read the catch-all to be limited by the specific statutes identified in it. And so it would be broadened to address consumer credit type regulations. BIPA is not like that. BIPA is not... Could you use real words, please? Sure. The biometric information... You can just call it the Act. The Act does not report to regulate consumer credit information. And so if one were to follow the logic expressed by the Illinois Supreme Court in addressing a substantially similar exclusion, you would look to the statutes that are identified and you would look to what they regulate and you would extend the scope of the statutory exclusion to, in this instance, it would be consumer credit type transactions as well as things like telephone regulations. TCPA regulates faxes. CAN-SPAM regulates email. I have no idea what you're talking about. If you could use real words, that would help us. Okay. I'll try again. I'm sorry. I think that visual PAC is wrongly decided because it did not follow the approach used by the Illinois Supreme Court when it said in interpreting the catch-all, it found the catch-all to be ambiguous. And it said to understand the catch-all, you should look to the specific statutes that were enumerated in the exclusion. And in this exclusion that we're dealing with, the same one that was dealt with in visual PAC, has three statutes identified, three and a half. It's got FACTA and FCRA. And it also has the same two statutes that the court addressed in Krishna Schomburg. So, to apply and understand the exclusion, you should look to those two statutes and what they regulate, those three statutes and what they regulate. I don't believe that this court is bound by the Illinois Appellate Court. I think that the law settled that it is actually not bound by the Illinois Supreme, Illinois Appellate Court. It would be bound by a decision of the Illinois Supreme Court. This court, when Dawko, six months ago, looking at what, trying to identify what the Illinois Supreme Court would do, said that it would find that the exclusion was ambiguous. I'm going to like to reserve the rest of my time for rebuttal. Daniel Graham for Defendant Appellee, Cross Appellant, Mitsui Sumitomo Insurance, USA Incorporated. May it please the court. Your Honors, I think you've recognized right off the bat what this dispute is about. It's about the application of exclusions to claims involving violations of the Illinois Biometric Information Privacy Act. And there are three exclusions at issue. And as Your Honor recognized, one of those exclusions is the access and disclosure exclusion. Do you mind if we start for the Cross Appeal, at least the recording and distribution exclusion, and how we get around when Dawko to even begin kind of the analysis that you're asking us to take? Of course, Your Honor. As far as the, when Dawko, the court was talking with counsel about the visual PAC decision. And in construing the application of whether the exclusion applied or not, the Illinois Appellate Court took a look at the same or substantially similar exclusion as this court did in when Dawko. And what the court did was it took a look at the exclusion at the outset and it recognized that there were certain categories of statutes that were enumerated in the first part of the exclusion. And then the second, the fourth part of the exclusion, there was a catch-all. And the court looked at that catch-all and the catch-all applied to any federal, state, or local statute, ordinance, or regulation other than the statutes mentioned earlier in the exclusion that address, prohibit, or limit the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating, or distribution of material or information. And so what the Illinois Appellate Court did is it took a look at the exclusion and it said, you know, is it ambiguous on its face or can it be enforced as written in the context of the Illinois Biometric Information Privacy Act, the Act. And the Illinois Appellate Court said if we just look at this catch-all, it describes in substance what the Act does, which provides limitations on the collection and sharing of an individual's private biometric information by a private company. And so the Illinois Appellate Court said we think it applies. In making that determination, it recognized that this court concluded otherwise in the Wendalco decision. And what the court said it respectfully disagreed. In Wendalco, this court was looking at, again, a very similar exclusion. And what the court concluded is there was a concern that if the exclusion was applied, it could swallow too much of the coverage for one of the offenses in the personal and advertising injury coverage provision. Personal and advertising injury is a term in an insurance policy. It's defined to mean injury arising out of certain enumerated offenses. One of those offenses which are salient to this particular matter is oral or written publication in any manner of material that violates a person's right of privacy, the And so what this court recognized in Wendalco is it looked at the exclusion and it said, boy, this would probably swallow too much coverage. And therefore, the exclusion is ambiguous. And because it's ambiguous, we're going to apply canons of construction to try to see how does this exclusion work in total. And so the court considered, this court concluded we can't find a common theme. So the canons of construction can't rehabilitate the application or limit the exclusion. And therefore, it's ambiguous. And therefore, we're not going to apply it. And what the Illinois appellate court said is that's not, respectfully, that's not the right analysis. The question is you look at the exclusion. And you take a look at the terms. And when you look at the exclusion, if those terms apply unambiguously to the claim that you're dealing with before you, then the exclusion applies unless there's an ambiguity. So the court in VisualPAC, the Illinois appellate court, looked at that catch-all provision. And it said, you know what, this sounds like the act. It talks about the same type of wrongful conduct as the act. And that assessment, your honors, is something that various courts recognize in considering the coverage issues presented. They say this sounds like what we're talking about in substance under the act, the collection, the sharing, the recording of biometric information. But what the Illinois appellate court said is, okay, we see that this exclusion is not ambiguous. We would apply it as written. But we'll go on. We're mindful of Wendelco. And we're mindful of an earlier Illinois Supreme Court decision. So we're going to go ahead and go through this. We're going to see, is there a theme? To the extent there is an ambiguity, can we find a common theme? Lowest common denominator. Let's look at these statutes. And these are the different statutes, your honor, that counsel was talking about. The statutes in the exclusion refer at the outset to the Telephone Consumer Protection Act, which concerns unsolicited faxes. The Cannes Spam Act, which concerns unsolicited emails and unrequested emails. And then, lastly, it considered the Fair Credit Reporting Act. And what the Illinois appellate court did in looking at that type of statute is the court recognized, that talks about information. Why does that matter? Well, your honors, when we're talking about privacy, we're talking about two different types of interests. We're talking about an interest in secrecy, the right to keep your information away from anyone else. Or we're talking about seclusion, the right to be undisturbed. And so what the Illinois appellate court said against that backdrop is, when you look at these statutes, the first two statutes concern intrusion upon seclusion or seclusion interests, meaning you don't want to be disturbed by unwanted faxes. And so the Illinois appellate court said, those two statutes address interests in seclusion. But this next component, FACTA and the FCRA, the Fair Credit Reporting Act, those talk about information and they talk about secrecy and not just information but consumer information. And so what the Illinois appellate court said is, all right, if we're going to apply a theme, what is the theme that we would apply in this interest? We find that the statutes, if there is a theme, concern interests in secrecy and interests in seclusion. When you look at the act, the Illinois Biometric Information Privacy Act, now we're talking about interests in secrecy, specifically your biometric information, your handprint, your retina, that sort of thing. And so what the Illinois appellate court said is, that sounds to us like even if we apply these canons of construction, the exclusion still applies. And so the Illinois appellate court ultimately concluded, respectfully disagreeing, that it did not agree with the Seventh Circuit's analysis of this recording and distribution exclusion, and instead found that the exclusion applied. And so how would you address Judge Flom's question of seeing that when DALCO comes out with a new law? Yes. Well, Your Honor, I think as far as visual PAC is concerned, the Illinois appellate court decision, it is controlling. It is a determination or an articulation by an Illinois appellate court on what the law is in construing this exclusion in the context of HIPAA claims. Your Honor, it's on force, all force, with the biometric claims. And so when this court was making its Erie guess, it didn't have the benefit of a higher court, an Illinois appellate court, an Illinois Supreme Court. An Illinois appellate court is not a higher court. I'm sorry. Our job under Erie is to figure out what the Supreme Court of Illinois would say about a particular question. Yes, Your Honor. And a decision of an intermediate appellate court can be informative, but it's not conclusive. And in fact, a panel of this court held exactly that last Friday in UIRC. Your Honor, and I appreciate that. I think while that is true that you're not bound by it, I think the Illinois appellate court is certainly indicative. You don't have any indication that the Illinois Supreme Court would breach a contrary conclusion. And therefore, the So, Your Honor, I wanted to make sure that I addressed your question with respect to the recording and distribution exclusion and the visual pack exclusion. You did. Thank you. Thank you, Your Honor. Switching back to the access and disclosure exclusion, Your Honor, that's another exclusion that we think applies in this instance. It's on its face. It applies to confidential or personal information. And Your Honor, as you pointed out, the exclusion tries to be as comprehensive as possible. On its face, it's clear that when we're talking about biometric claims, they are confidential or I should say personal in nature. Again, when you're talking about biometrics under the Act, biometric information and identifiers are defined to mean retinas, hand scans, facial geometry. So it's very personal. It's very particular. And in fact, that's exactly why this information was used in the underlying lawsuit, at least according to the allegations, for timekeeping purposes. It was used to allow employees to keep their time. And so when you apply the exclusion in this context, Your Honor, it's clear that if we're dealing with personal and advertising injury, we are dealing with something that, a personal and advertising injury that arises out of any access to or disclosure of any person's or organization's confidential or personal information and therefore the exclusion applies. So Your Honors, we believe the recording and distribution exclusion applies. We believe the access or disclosure exclusion applies and those are contained in both Mitsui Sumitomo's CGL policies and they're also set forth by endorsement in the excess umbrella policies that Mitsui Sumitomo issued as well. There's another exclusion, Your Honor, that we believe applies in this instance and that is the employment-related practices exclusion. The employment-related practices exclusion, Your Honors, applies to personal and advertising injury. And what it does is it eliminates coverage for personal and advertising injury to a person arising out of any employment-related practices, policies, acts or omissions such as coercion, demotion, evaluation, reassignment, harassment, humiliation, discrimination and things like that. Your Honors, we recognize that various district courts have concluded that the exclusion doesn't apply. And in making that determination, their position is essentially, the conclusion is that when you're talking about a biometric timekeeping practice, this enumeration or listing of conduct under the exclusion talks about wrongful acts. It talks about defamation. It talks about discipline. I think I want to drill down just a little bit more. Sure. When we're looking at that language because it says at the end, after giving that list that you're about to go through, directed towards that person. Yes, Your Honor. And so the policy here of having the hand scan for each employee for attendance purposes, how would we be able to apply that without kind of getting rid of the end of that clause towards that person? You don't, Your Honor. And that's exactly the point. As far as your question, Your Honor, is concerned, it involves conduct that is directed at a person. So kind of the threshold issue is, like some courts have found, they say, well, wait a minute. This is wrongful conduct directed at a person. Timekeeping policies, that would stick out like a sore thumb. No pun intended. I mean, that's actually what the courts have said. When you look at this list, there's no handprint. There's no timekeeping practice. But Your Honor, the Northern District Court in Caramel is the one court that appreciated the nuance when we're dealing with claims under the Act. Specifically, the reason a violation of the Act applies to this exclusion and why the concerns a statutory invasion of privacy. That's the wrong. The focus is not hand scanning or hand timekeeping policies any more than you can harass someone by sending an unsolicited email or an unrequested email. So, Your Honors, the district courts have made a false comparison. They're saying, well, it doesn't list handprints or timekeeping policies, and therefore, it doesn't belong in the exclusion. We respectfully disagree with that, Your Honors. The analysis is, what is the injury that's being sustained? And in this instance, the injury that's being sustained is the invasion of privacy. That's the wrong. An invasion of privacy fits comfortably within that listing of wrongful conduct. As far as being directed at the person, Your Honor, the reason that a biometric violation, a violation under the Act is directed at the person is because under the Act. But it doesn't say a person. It says that person. And so, just to do something with, how are we manipulating that language? Because I think the way that you're reading it, I have to take the word that out of the clause. I think, Your Honor, you could say invasion of privacy directed at that person because each employee, each worker, has the right to his or her, their biometric interests. They have their privacy interests in their biometric policy. It's a personal right. And the Illinois Supreme Court has said as much in Rosenbach v. Six Flags. They said, when a private entity fails to adhere to the statutory procedures of BIPA, as defendants are alleged to have done here, the right of the individual to maintain his or her biometric privacy vanishes into thin air. It's not just a technicality. The precise harm the Illinois legislature sought to prevent is then realized. And as the court goes on to say, this is no mere technicality. The injury is real and significant. So, Your Honor, when we're talking about a violation, a biometric violation or a violation under the Act, we're talking about a statutory invasion of privacy that is inflicted on that person. The fact that some of these lawsuits are brought as class actions doesn't change the calculus. It's because each and every individual has a right to his or her, their biometric information, that sometimes you will bring it as a class action and you will bring together the different plaintiffs to represent the class of similar interests. But notwithstanding the fact that it involves multiple people, or notwithstanding the fact that in this instance we're dealing with employees, it's still an individual violation. And to comply with BIPA, to comply with the Act, the individual has to consent, has to provide knowing consent concerning the use of the biometric information. So, Your Honors, for all these reasons, it's our position that the recording and distribution exclusion applies under the terms of our policy, and that's the exclusion that was addressed by the court in Visual PAC, the Illinois Appellate Court. We believe the access or disclosure exclusion applies to the BIPA claims clearly and unambiguously and that the exclusion should therefore be enforced as written. And we believe that the employment-related practices exclusion applies in this instance and respectfully disagree with those courts that have found otherwise. I realize I've been kind of talking for a little while. I'm happy to answer any questions, Your Honors. Did you want to still talk through the data breach exclusion and why you believe it applies? Thank you, Your Honor. The data breach exclusion. So as far as the data breach exclusion is concerned, that is an exclusion that is contained in the access umbrella policies. So it is not in the CGL policies, and incidentally the district court found that the CGL policies did not provide coverage for the BIPA claims. The district court concluded none of the exclusions applied in connection with the access umbrella policies. It was transferred from Judge Lee to Judge Dirk, and so there was a change as far as the bench was concerned. The data breach exclusion, Your Honor, is different in title, not in substance. So if you look at the substance of the data breach liability exclusion under the access umbrella policy, it has the same language that we were talking about in connection with the access or disclosure exclusion. It excludes coverage for bodily injury, property damage, or personal and advertising injury arising out of disclosure of or access to private or confidential information belonging to any person or organization. And that's the first clause. The district court concluded that when you look at the exclusion in context, it's meant to apply to data breach losses or data breach injuries. We disagree with that, Your Honor. If you look at the court, if you look at, first of all, the substance of the exclusion, it's written in the disjunctive. There's a subparagraph 1 and a subparagraph 2. The language in subparagraph 1 is almost on all fours with the access or disclosure exclusion, which the district court found to apply under the CGL policies. But as far as the exclusion is concerned, there's nothing ambiguous about it. We believe it should be enforced as written. When you take a look at the allegations of the complaint, Your Honor, I don't think that's at odds with the type of exclusion this is. So, for example, in the Gates complaint, which determines the duty to defend, it alleges upon information and belief each defendant failed and continues to fail to inform its employees that it discloses or disclosed their handprint data to at least one out-of-state third-party vendor and likely others, fails to inform its employees that it discloses their handprint data to other currently unknown third parties which host their biometric data in their data centers and fails to obtain written releases. The common questions of law and fact for the complaint that are presented concern whether any defendant's violations of BIPA have raised a material risk that plaintiff's biometric data will be unlawfully accessed by third parties. And then in the complaint, it also alleges plaintiff would not have provided his biometric data to any defendant if he had known that they would retain such information for an indefinite period of time without his consent. And that's at ECF 13, and those are allegations 34, 36, and 51. That's just some examples. I see that I'm out of time, Your Honor. May I conclude? Thank you, Your Honors. Thank you. For all the reasons discussed today, thank you, Your Honor. Anything further, Mr. Goodman? Yes, Your Honor. I'd like to begin with the implement-related practices exclusion because I did not address that. I think that the key in looking at that exclusion, as Judge Durkan recognized, is the concluding phrase, directed at that person. I think that the practice itself, the practices that are enumerated in the exclusion itself, are all things that are directed at a person. In this instance, it was a time-tracking system, and there wasn't any conduct directed at any person, at that person, the person that would be bringing the claim. It's sort of a generic mistake, in effect, in the manner in which the company was or was not complying with the regulation. I think it's important to make, unless you have a question on that, I'd like to address the, go back to the data access, which, as counsel indicated, is substantially the same as what is identified in the umbrella policy, is the data breach exclusion, which I think is actually the intent of the other, the access to data or access and distribution of information exclusion, I think is also directed to data breach. I think that was really the intent of why it was created. It was created to respond to the risks presented by data breach. And I think, finally, with respect to going back to Wendalco and VisualPAC, I think the most important piece is that, in looking at how the Illinois Supreme Court addressed the exclusion that it faced in the Krishna case, I think you need to apply and assume it would have applied the same type of approach to the statutes enumerated in the exclusion before it was presented in VisualPAC. Thus, for the reasons I ... Thank you, counsel. Thank you. Case is taken under advisement. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/argument%3A90173. Public record. Not legal advice.