Citizens Insurance Company Of America v. Wynndalco Enterprises, LLC

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION CITIZENS INSURANCE ) COMPANY OF AMERICA, ) a Michigan corporation, ) ) Plaintiff, ) ) No. 20 C 3873 v. ) ) Judge John Z. Lee WYNNDALCO ENTERPRISES, LLC; ) an Illinois limited liability company; ) DAVID ANDALCIO; JOSE FLORES; ) MELISSA THORNLEY; ) DEBORAH BENJAMIN-KOLLER; ) and JOSUE HERRERA; ) individually and on behalf of ) all others similarly situated; ) and MARIO CALDERON and ) JENNIFER ROCIO, ) individually and on behalf of ) all others similarly situated, ) ) Defendant. ) MEMORANDUM OPINION AND ORDER Plaintiff Citizens Insurance Company of America sold a business liability insurance policy to Defendant Wynndalco Enterprises, LLC. While the policy was in effect, Wynndalco was sued in two separate class action lawsuits for allegedly selling biometric information in violation of the Illinois Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. 14/1 et seq. In turn, Wynndalco and its officers, David Andalcio and Jose Flores, notified Citizens of the lawsuits and requested defense under the insurance policy. Citizens then filed this lawsuit, seeking a declaratory judgment that the policy does not cover the two underlying lawsuits. Wynndalco filed a counterclaim seeking the opposite. Now Citizens and Wynndalco have filed cross-motions for judgment on the pleadings. Because the policy exclusion invoked by Citizens does not unambiguously preclude coverage for the underlying lawsuits, Citizens’ motion is denied, and Wynndalco’s cross-motion is granted. I. Undisputed Facts A. The Thornley and Calderon Lawsuits The litigation that prompted this insurance coverage dispute involves the secret collection of more than three billion facial scans by Clearview AI, an artificial intelligence company that specializes in facial recognition software. See 1st Am. Compl. (“Compl.”) ¶ 19, ECF No. 20. Clearview AI allegedly extracted, or “scraped,” photographs from social media and content sharing platforms like Facebook, Twitter, Instagram, YouTube, and Venmo to create a database of facial scans (“Clearview Database”). Id. Clearview AI also created a facial recognition application (“Clearview App”) that allows its customers to identify individuals by comparing facial pictures they take to the Clearview Database. Id. Wynndalco, an information technology (“IT”) services and consulting firm, licensed and sold access to the Clearview Database and Clearview App to customers in Illinois. Id. ¶¶ 21–22. Melissa Thornley and Mario Calderon, on behalf of themselves and others similarly situated, each filed class action lawsuits (the “Thornley Lawsuit” and the “Calderon Lawsuit;” together, the “Lawsuits”) against Wynndalco, alleging that Wynndalco had violated BIPA—an Illinois statute that regulates the collection, disclosure, retention, and destruction of biometric information, by selling Clearview’s products in Illinois. Id. ¶¶ 18, 28; see Compl. Ex. B, Class Action Compl., Thornley v. CDW-Gov’t, LLC, No. 2020 CH 04346 (Cir. Ct. Cook Cnty. May 27, 2020), ECF No. 20-2; Compl. Ex. C, 1st Am. Class Action Compl., Calderon v. Clearview AI, Inc., No. 1:20-cv-01296-CM (S.D.N.Y. July 22, 2020), ECF No. 20-3.1 B. The Citizens Policy Wynndalco purchased a Business Owners Insurance Policy from Citizens and has asked Citizens to defend it and its officers pursuant to the policy. Compl. ¶ 34; see Compl. Ex. A, Business Owners Policy No. OBC-H062078-00 (the “Policy”), ECF No. 20-1. The Policy provides coverage for “personal and advertising injury,” defined, in pertinent part, as “injury, including consequential ‘bodily injury,’ arising out of . . . [o]ral or written publication, in any manner, of material that violates a person’s right of privacy.” Id. The Policy also contains a number of exclusions. Relevant here is the exclusion entitled “Distribution of Material in Violation of Statutes” (“Statutory Violation exclusion”), which provides that the insurance does not apply to: “[P]ersonal and advertising injury” arising directly or indirectly out of any action or omission that violates or is alleged to violate: (1) The Telephone Consumer Protection Act (TCPA) [47 U.S.C. § 227 et seq.] including any amendment of or addition to such law; or 1 The Thornley Lawsuit also includes common law claims for invasion of privacy and unjust enrichment. Compl. ¶ 27. (2) The CAN-SPAM Act of 2003 [15 U.S.C. § 7701 et seq.], including any amendment of or addition to such law; (3) The Fair Credit Reporting Act (FCRA) [15 U.S.C. § 1681 et seq.], and any amendment of or addition to such law, including the Fair and Accurate Credit Transaction Act (FACTA); or (4) Any other laws, statutes[,] ordinances[,] or regulations, that address, prohibit, or limit the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information. Compl. ¶ 17; see Policy at 92. This dispute concerns the interpretation of the last subsection of this exclusion. II. Legal Standard Motions for judgment on the pleadings are brought under Federal Rule of Civil Procedure 12(c)¸ which tests the sufficiency of claims based on the pleadings. Fed. R. Civ. P. 12(c); see Scottsdale Ins. Co. v. Columbia Ins. Grp., Inc., 972 F.3d 915, 919 (7th Cir. 2020). A party may move for judgment on the pleadings after the pleadings are closed. Fed. R. Civ. P. 12(c). When reviewing a Rule 12(c) motion, the Court takes all facts pleaded in the complaint as true and draws “all reasonable inferences and facts in favor of the nonmovant.” Wagner v. Teva Pharm. USA, Inc., 840 F.3d 355, 358 (7th Cir. 2016). The Court will grant a motion for judgment on the pleadings if “it appears beyond doubt that the nonmovant cannot prove facts sufficient to support its position, and that the plaintiff is entitled to relief.” Scottsdale Ins., 972 F.3d at 919. III. Analysis As a preliminary matter, the parties agree that Illinois law applies. Compare, e.g., Citizens’ Mem. Law Supp. Mot. J. Pleadings at 8 (“Citizens’ Mem.”), ECF No. 65, with, e.g., Mem. Law Supp. Wynndalco & Thornley Defs.’ Mots. J. Pleadings & Opp’n Citizens’ Mot. J. Pleadings at 9, ECF No. 86. Furthermore, all material facts are undisputed, and Citizens does not contest that, if it has a duty to defend Wynndalco, it also must defend its officers. With that, the Court turns to the question at hand, namely, whether the policy Citizens issued to Wynndalco provides coverage for the defense of the Lawsuits. See Mashallah, Inc. v. W. Bend Mut. Ins. Co., 20 F.4th 311, 319 (7th Cir. 2021) (“Under Illinois law, the interpretation of an insurance policy, like any other contract, is a question of law.”). To answer this question, the Court must look to the language of the insurance policy. “The goal in interpreting an insurance policy is to ascertain and give effect to the intention of the parties, as expressed in the policy language.” Scottsdale Ins., 972 F.3d at 919 (cleaned up). Furthermore, under Illinois law, “insurance policies are to be liberally construed in favor of coverage, and where an ambiguity exists in the insurance contract, it will be resolved in favor of the insured and against the insurer.” United Servs. Auto. Ass’n v. Dare, 830 N.E.2d 670, 678 (Ill. App. Ct. 2005). At the same time, policy language is not ambiguous “simply because the parties disagree as to its meaning[,]” and the court should not “strain to find an ambiguity where none exists.” Founders Ins. Co. v. Munoz, 930 N.E.2d 999, 1004 (Ill. 2010). When seeking coverage, “[a]n insured has the burden of proving that a claim falls within the coverage of the policy. . . . Once the insured satisfies this burden, the insurer has the burden of proving that the loss was limited or excluded by a contract provision.” Travelers Pers. Ins. Co. v. Edwards, 48 N.E.3d 298, 303 (Ill. App. Ct. 2016). What is more, “[a]n insurer can only refuse to defend if the allegations of the underlying complaint preclude any possibility of coverage.” Ill. Tool Works, Inc. v. Travelers Cas. & Sur. Co., 26 N.E.3d 421, 428 (Ill. App. Ct. 2015). But a single unequivocal exclusion is sufficient to show that an insurer does not have a duty to defend the insured. See, e.g., Hartford Cas. Ins. Co. v. Dental USA, Inc., No. 13 C 7637, 2014 WL 2863164, at *4 (N.D. Ill. June 24, 2014) (applying Illinois law). Finally, to “determine whether the insurer’s duty to defend has arisen, the court must compare the allegations of the underlying complaint to the policy language.” Id. “If the court determines that these allegations fall within, or potentially within, the policy’s coverage, the insurer has a duty to defend the insured against the underlying complaint.” Metzger v. Country Mut. Ins. Co., 986 N.E.2d 756, 761 (Ill. App. Ct. 2013) (cleaned up). In this case, the dispute focuses on whether the Statutory Violation exclusion precludes coverage for the Lawsuits. The Court begins with the language of the exclusion. As noted above, the Statutory Violation exclusion disavows coverage for: [P]ersonal and advertising injury . . . arising directly or indirectly out of any action or omission that violates or is alleged to violate . . . [the TCPA, CAN-SPAM, FCRA, or FACTA] [or a]ny other laws, statutes[,] ordinances[,] or regulations that address, prohibit or limit the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information. Policy at 92. Citizens argues, as an initial matter, that this language is not ambiguous because BIPA is a “statute” that regulates the “dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.” Id. But the Supreme Court of Illinois recently held that a nearly identical provision was ambiguous. W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., ___ N.E.3d ____, 2021 WL 2005464, at *10 (Ill. May 20, 2021). As an authoritative construction of Illinois law by the state’s highest court, Krishna’s holding is binding on this Court unless it can be distinguished. See Kaiser v. Johnson & Johnson, 947 F.3d 996, 1013 (7th Cir. 2020). Citizens’ attempt to do so is not persuasive. First, Citizens points out that the exclusion in Krishna had a more specific title: “Violation of Statutes that Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or Information.” Citizens’ Mem. at 11. Because the Supreme Court of Illinois began the Krishna analysis with the title of the exclusion, see 2021 WL 2005464, at *10, Citizens argues, the case is inapposite. At the outset, this Court is not convinced that the difference in the titles makes these exclusions substantively different. See, e.g., First Mercury Ins. Co. v. Triple Location LLC, 536 F. Supp. 3d 326, 331–32 (N.D. Ill. 2021) (referring to the exclusion at issue in Krishna as “materially identical” to one with the title “Distribution of Material in Violation of Statutes,” and otherwise identical substance). But even if the change in title were material, Citizens’ arguments would still fail. In a literal sense, it is true that BIPA, like the other enumerated statutes, “regulates the dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of . . . information.” Citizens’ Reply at 6. But as Wynndalco observes, reading the exclusion in this way would swallow the rule. Most statutes “regulate . . . information” to some degree. To interpret the exclusion to cover every statute that concerns a person or entity doing practically anything whatsoever with “information” would make certain coverage provisions illusory, including, for example, those that provide coverage for injuries “arising out of . . . [o]ral or written publication, in any manner, of material that violates a person’s right of privacy.” Policy at 100. Other provisions of the Policy also belie Citizens’ expansive reading. See Founders Ins., 930 N.E.2d at 1004 (courts must interpret provisions in light of the entire policy). The Policy explicitly covers slander and libel claims, false advertising claims, and claims for copyright infringement. See Policy at 100. These claims also arise under statutes—such as the Illinois Slander and Libel Act, 740 Ill. Comp. Stat. 145/0.01 et seq., the Lanham Act, 15 U.S.C. § 1051 et seq., and the Copyright Act, 17 U.S.C. § 101 et seq.—that “regulate the dissemination . . . or distribution of material or information.” Compl. ¶ 17; see, e.g., 17 U.S.C. § 106(3) (protecting the copyright owner’s right “to distribute copies or phonorecords of the copyrighted work to the public”). Under Citizens’ construction, the Statutory Violation exclusion would bar coverage for violations of the very statutes under which slander, libel, false advertising, and copyright claims arise. The Court refuses to adopt such a nonsensical reading of the Policy. Because the language of the exclusion is ambiguous on its face, the Court turns, as did the Supreme Court of Illinois in Krishna, to canons of statutory construction for guidance. Unfortunately, these are of limited utility here. Krishna employed ejusdem generis, which counsels that, “where general words follow specific words . . . the general words are [usually] construed to embrace only objects similar in nature to those objects enumerated by the preceding specific words.” Yates v. United States, 574 U.S. 528, 545 (2015) (quoting Wash. State Dep’t of Soc. and Health Servs. v. Guardianship Estate of Keffeler, 537 U.S. 371, 384 (2003) (first alteration omitted)); see 2021 WL 2005464, at *10. The policy in Krishna listed only the TCPA, the CAN-SPAM Act, and the catchall. 2021 WL 2005464, at *10. Accordingly, the Krishna court found that BIPA did not fall within the catchall because, unlike the TCPA and the CAN-SPAM Act, BIPA does not regulate “methods of communication.” See id. In this case, however, the exclusion also includes FCRA and FACTA. Neither of these statutes are directed towards regulating methods of communication. FCRA regulates the credit reporting industry with a purpose “to promote ‘fair and accurate credit reporting’ and to protect consumer privacy.” TransUnion LLC v. Ramirez, ___ U.S. ___, 141 S. Ct. 2190, 2200 (2021) (quoting 15 U.S.C. § 1681(a)). And FACTA is an amendment to FCRA that imposes restrictions on the disclosure of credit and debit account information, enacted in response to a perceived increase in identity theft. Meyers v. Oneida Tribe of Indians of Wis., 836 F.3d 818, 819–20 (7th Cir. 2016), cert. denied, 137 S. Ct. 1331 (2017). Thus, the interpretive tool of ejusdem generis is unhelpful in this case, because ejusdem generis requires the general term to share a characteristic that is common to all the specific terms. See Saxon v. Sw. Airlines Co., 993 F.3d 492, 496 (7th Cir. 2021).2 But, even if the Court were to apply ejusdem generis here, the result is not what Citizens advocates. According to Citizens, the application of ejusdem generis shows that BIPA is “like” the TCPA, CAN-SPAM Act, FCRA, and FACTA because “[those statutes] all protect privacy interests generally, and BIPA and the FCRA/FACTA more specifically protect against identity theft.” Citizens’ Reply Supp. Mot. J. Pleadings Resp. Opp’n Defs.’ Mot. J. Pleadings at 6 (“Citizens’ Reply”), ECF No. 88. For one thing, Citizens’ proposed commonalities do not even link the four listed statutes. The parallel Citizens attempts to draw between FCRA/FACTA and BIPA— that each statute protects against the disclosure of personal information—does not apply to the TCPA or the CAN-SPAM Act, which do not regulate the collection or 2 It bears mentioning that, while Krishna’s substantive holding that the Statutory Violation exclusion is ambiguous is binding on this Court, its application of ejusdem generis is not. See Cabeda v. Att’y Gen., 971 F.3d 165, 171 n.4 (3d Cir. 2020) (“[S]hifting interpretive methodologies are not usually viewed as carrying the force of stare decisis.”); Abbe R. Gluck, The States as Laboratories of Statutory Interpretation: Methodological Consensus and the New Modified Textualism, 119 YALE L.J. 1750, 1765 (2010) (noting that “the [U.S. Supreme] Court does not give stare decisis effect to any statements of statutory interpretation methodology. The interpretive rule used in one case . . . is not viewed as ‘law’ for the next case.” (citation omitted)). And even if Krishna mandated applying ejusdem generis in the context of an exclusion containing only the TCPA and the CAN-SPAM Act, the exclusion in the instant Policy is distinguishable because it includes FCRA and FACTA. See Blount v. Stroud, 904 N.E.2d 1, 15 (Ill. 2009) (“[T]he precedential scope of our decision is limited to the facts that were before us.”). dissemination of personal information. See generally 15 U.S.C. § 7701 et seq.; 47 U.S.C. § 227 et seq. And even if the Court were to entertain Citizens’ broader argument that all five statutes protect “privacy” in a generalized sense, they still are not sufficiently similar to justify reading the exclusion’s catchall to cover BIPA. The TCPA and the CAN-SPAM Act protect “privacy” by regulating unauthorized communications that private citizens receive (e.g., telemarketing calls and spam emails). By contrast, FCRA, FACTA, and BIPA protect “privacy” in a different sense, by regulating how private entities must handle private information that citizens give away (e.g., credit card numbers and facial scans). This distinction tracks closely to the different definitions of “privacy,” a term that can mean both “freedom from unauthorized intrusion,” and “secrecy” or “a private matter.” Privacy, MERRIAM- WEBSTER.COM, https://www.merriam-webster.com/dictionary/privacy (last visited Feb. 26, 2022); see Am. States Ins. Co. v. Cap. Assocs. of Jackson Cnty., Inc., 392 F.3d 939, 941–43 (7th Cir. 2004) (instructing lower courts to “distinguish secrecy from seclusion, [and] to appreciate that [drafters of statutes and insurance policies] may use the word ‘privacy’ in different ways”). Because the type of “privacy” that BIPA protects is dissimilar to the type of privacy that the TCPA and the CAN-SPAM Act regulate, ejusdem generis does not do the work that Citizens would have it do. See American States, 392 F.3d at 941–43 (holding that an exclusion covering advertising injury did not cover the TCPA because the TCPA protects “privacy” in the sense of seclusion, while advertising injury impinges on “privacy” in the sense of secrecy); Evanston Ins. Co. v. Gene by Gene, Ltd., 155 F. Supp. 3d 706, 713 (S.D. Tex. 2016) (finding that the TCPA and the CAN-SPAM Act were not like statute regulating disclosure of genetic information). To support its ejusdem generis argument, Citizens points to Massachusetts Bay Insurance Co. v. Impact Fulfillment Services, LLC, No. 1:20CV926, 2021 WL 4392061 (M.D.N.C. Sept. 24, 2021).3 That case applied ejusdem generis to hold that BIPA fell within a nearly identical exclusion, which listed the TCPA, the CAN-SPAM Act, FCRA, and FACTA as specific examples followed by a catchall term. See id. at *3, 7. But the Massachusetts Bay court did not grapple with the distinction between the two types of privacy that are implicated in the enumerated statutes—privacy of personal information (as concerns FCRA and FACTA), versus privacy from unwanted communications (as concerns the TCPA and the CAN-SPAM Act). In this way, Massachusetts Bay does not square with the Seventh Circuit’s admonition in American States that a court interpreting an insurance policy must not “say . . . that [a statute] protects privacy, and then stop the analysis” without considering whether the statute in question covers the same type of privacy interest as the policy is meant to cover. 392 F.3d at 942. Thus, the Court respectfully disagrees with the holding in Massachusetts Bay. 3 Citizens cites numerous other cases holding that various other statutes fell within similar exclusions because they protect privacy. See OneBeacon Am. Ins. Co. v. Urb. Outfitters, Inc., 21 F. Supp. 3d 426, 440 (E.D. Pa. 2014), aff’d, 625 F. App’x 177 (3d Cir. 2015); Big 5 Sporting Goods Corp. v. Zurich Am. Ins. Co., 957 F. Supp. 2d 1135, 1149–50 (C.D. Cal. 2013), aff’d, 635 F. App’x 351 (9th Cir. 2015); Hartford Cas. Ins. Co. v. Greve, No. 3:17CV183- GCM, 2017 WL 5557669, at *4–5 (W.D.N.C. Nov. 17, 2017), aff'd on other grounds sub nom. Hartford Cas. Ins. Co. v. Ted A. Greve & Assocs., 742 F. App'x 738 (4th Cir. 2018). The Court finds these cases unpersuasive, however, because they do not consider this particular exclusion with reference to the distinction between “privacy” as seclusion and “privacy” as secrecy. See 21 F. Supp. 3d at 440; 957 F. Supp. 2d at 1150; 2017 WL 5557669, at *4–5. Nor does the noscitur a sociis canon (a broader relative of ejusdem generis) add clarity. That rule provides that “a word is known by the company it keeps,” or, in other words, an ambiguous term should be read to mean something similar to the words that surround it. Yates, 574 U.S. at 543. The only discernible resemblance between the TCPA, the CAN-SPAM Act, FCRA, and FACTA is that they all protect “privacy.” But once more, “privacy” in the BIPA context means something much different than “privacy” in the TCPA context, so the similarity is superficial at best. “[W]ithout a common feature to extrapolate” onto the ambiguous term, noscitur a sociis “is no help.” S.D. Warren Co. v. Me. Bd. of Envt’l Prot., 547 U.S. 370, 379–80 (2006). With neither the plain text nor these canons of construction pointing to a clear meaning, the Court concludes that the Statutory Violation exclusion is intractably ambiguous. Thus, Citizens has not met its burden to “affirmatively establish” that the exclusion applies, much less that its application is “clear and free from doubt,” as it must in order to rebut Wynndalco’s initial showing of coverage. Mashallah, 20 F.4th at 320 (quoting 4220 Kildare, LLC v. Regent Ins. Co., 171 N.E.3d 957, 966 (Ill. App. Ct. 2020)). Accordingly, the BIPA claims in the Thornley and Calderon Lawsuits trigger Citizens’ duty to defend Wynndalco.4 See Krishna, 2021 WL 2005464, at *10 (to the extent that language in an insurance policy is ambiguous, it must be construed in favor of coverage); Bradley Hotel Corp. v. Aspen Specialty Ins. Co., 19 F.4th 1002, 4 To the extent that Wynndalco seeks a declaratory judgment as to indemnification, that request is denied as premature. See Lear Corp. v. Johnson Elec. Holdings Ltd., 353 F.3d 580, 583 (7th Cir. 2003) (“[T]he determination of whether [defendant] has a duty to indemnify is not ripe until the underlying litigation is terminated.” (cleaned up)). 1006 (7th Cir. 2021). Moreover, because Citizens has a duty to defend Wynndalco with respect to the BIPA claims, it also has a duty to defend Wynndalco with respect to the common law claims in the Thornley Lawsuit. See Mesa Lab’ys, Inc. v. Fed. Ins. Co., 994 F.3d 865, 868 (7th Cir. 2021) (under linois law, “if even one claim is covered, then the insurer has a duty to defend the entire suit’). IV. Conclusion For the foregoing reasons, Wynndalco’s motion for judgment on the pleadings is granted, and Citizens’ motion for judgment on the pleadings is denied. The Court holds that the Policy covers the Thornley and Calderon Lawsuits and that Citizens has a duty to defend Wynndalco and its officers, David Andalcio and Jose Flores, against the Thornley and Calderon Lawsuits. IT IS SO ORDERED. ENTERED: 3/30/22 — JohnZ.Lee —— United States District Judge 14