Remprex v. Lloyd's London

228 N.E.3d 321

2023 IL App (1st) 211097

REMPREX, LLC, Plaintiff-Appellant,

v.CERTAIN UNDERWRITERS AT LLOYD’S LONDON, Syndicates 2623/623, Defendant-Appellee.

Nos. 1-21-1097 & 1-22-0308 (cons.)

Appellate Court of Illinois, First District, SIXTH DIVISION.

Filed March 31, 2023

Appeal from the Circuit Court of Cook County. No. 20 CH 5507, The Honorable Anna M. Loftus, Judge, Presiding.

J. Timothy Eaton, Jonathan B. Amarilio, Daniel R. Saeedi, and Paul J. Coogan, of Taft Stettinius & Hollister LLP, of Chicago, for appellant.

Paul Berks, of Massey & Gail LLP, of Chicago, and Bryce L. Friedman (pro hac vice) and Joshua C. Polster (pro hac vice), of Simpson Thacher & Bartlett LLP, of New York, New York, for appellee.

OPINION

JUSTICE ODEN JOHNSON delivered the judgment of the court, with opinion.

¶ 1 This appeal stems from a declaratory judgment action filed by plaintiff, Rem- prex, LLC (Remprex), against defendant, Certain Underwriters at Lloyd’s London, Syndicates 2623/623 (Lloyd’s), in which plaintiff sought a declaration that Lloyd’s had a duty to defend it with regard to alleged violations of the Biometric Information Privacy Act (Privacy Act) (740 ILCS 14/1 et seq. (West 2018)). Remprex’s complaint also alleged breach of contract, bad-faith claims practices, vexatious and unreasonable conduct, violations of the Consumer Fraud and Deceptive Business Practices Act (Consumer Fraud Act) (815 ILCS 505/1 et seq. (West 2018)), and common law fraud. The circuit court granted Lloyd’s section 2-615 (735 ILCS 5/2-615 (West 2020)) motion to dismiss the complaint in its entirety, and Remprex appeals from that order. On appeal, Remprex contends that Lloyd’s had a duty to defend it in the two underlying lawsuits that alleged Privacy Act violations pursuant to two provisions of the policy, which provided coverage for claims based on the dissemination of information to the public and for claims based on a loss for which Remprex was liable. For the reasons that follow, we affirm in part, reverse in pari, and remand for calculation of damages.¹

¶ 2 I. BACKGROUND

¶ 3 Briefly stated, this case concerns a dispute over whether Remprex had insurance coverage for costs sustained by it with regard to two class action lawsuits involving alleged violations of the Privacy Act. The facts are taken from the parties’ pleadings filed during the course of Remprex’s declaratory judgment action, which was initially filed on August 24, 2020.

¶ 4 A. BNSF Lawsuit

¶ 5 According to Remprex, it was implicated by BNSF Railway Company (BNSF) in a class action suit initiated by truck driver Richard Rogers against BNSF (BNSF lawsuit) in April 2019. The BNSF lawsuit alleged that BNSF violated his privacy rights by collecting, capturing, storing, transferring, using, or otherwise obtaining his biometric information in a negligent or reckless manner. Remprex was never a named defendant in the BNSF lawsuit; however, BNSF’s answer and affirmative defenses alleged that it contracted with Remprex to provide a number of services at BNSF facilities, including automated gate systems, since July 1, 2007. Additionally, BNSF indicated in an affirmative defense that any alleged use of fingerprints would have been provided to and at the request of Remprex. Remprex’s letter to Lloyd’s requesting coverage for this matter indicated that BNSF sought indemnification pursuant to the terms of a contract between Remprex and BNSF.

¶ 6 In March 2020, Remprex indicated that it attended an unsuccessful mediation session between the named parties to the BNSF lawsuit before JAMS (a provider of mediation, arbitration, and alternate dispute resolution services) at the request of both Rogers’s counsel and BNSF. Remprex believed that, based on communication between the parties before and after the mediation, it would be expected to contribute to any proposed settlement.

¶ 7 On August 5, 2020, Remprex received a broad subpoena for records, and in response, it produced thousands of documents to the parties. Additionally, two of Remprex’s principals received deposition notices from Rogers’s counsel and were deposed. Remprex further contended that its continued participation was sought by the parties in the ongoing BNSF lawsuit, and it participated in a second unsuccessful mediation on April 7, 2021. We take judicial notice that the BNSF lawsuit went to trial and resulted in a jury award in favor of the class and against BNSF on October 12, 2022. Beyond the actions mentioned here, Remprex was never otherwise involved in the BNSF lawsuit.

¶ 8 B. CN Lawsuit

¶ 9 On July 26, 2019, Rogers filed a second class action lawsuit for alleged violations of the Privacy Act against Remprex, Illinois Central Railroad Company (ICRC) and CN Transportation, Ltd. (CN), an affiliate of the Canadian National Railway Company (CN lawsuit). The suit raised similar allegations to those raised in the BNSF lawsuit. With respect to Remprex, Rogers alleged that it engineered, designed, installed, operated, and managed biometric technology software and hardware. Additionally, Rogers alleged that CN used Remprex’s technology at its railyards and the two companies acted jointly in violating his privacy rights by collecting, capturing, storing, transferring, using, or otherwise obtaining his biometric information in a negligent or reckless manner. Further, Rogers alleged that Remprex used and shared his and other truck drivers’ fingerprint scans in an unauthorized manner as part of a biometric-based automated gate system at Illinois railyards for companies like CN and improperly disseminated that information.

¶ 10 Remprex moved to dismiss Rogers’s complaint on August 30, 2019, and on November 14, 2019, Rogers voluntarily dismissed Remprex from the case.

¶ 11 C. Remprex’s Claims and Circuit Court Proceedings

¶ 12 Remprex maintained a "Beazley Breach Response" (BBR) policy, underwritten by Lloyd’s that covered a policy period of July 30, 2018, to July 30, 2019. Among other things, the policy provided coverage for data and network liability and media liability. The policy also contained a choice of law provision, which provided that New York law governed disputes about its terms.

¶ 13 In June 2019, Remprex notified Lloyd’s of its claims under its policy, namely under the data and network liability and media liability provisions, which Remprex contended were applicable to the BNSF and CN lawsuits. In its correspondence to Lloyd’s, Remprex explained that both suits concerned the unlawful creation, collection, dissemination, and unauthorized disclosure of private personal information in the form of fingerprint data, by or on behalf of Remprex, which triggered the coverage and Lloyd’s corresponding responsibility to cover all reasonable and necessary legal costs and expenses resulting from the investigation and defense of those suits.

¶ 14 Lloyd’s responded in writing on November 19, 2019, denying coverage because it determined that neither the CN lawsuit nor the BNSF lawsuit implicated the policy’s coverage. Specifically, Lloyd’s stated that neither the data and network liability nor the media liability provisions covered the circumstances in the two underlying lawsuits. Both parties engaged in correspondence back and forth for a few months, with Lloyd’s final correspondence about the matter occurring in April 2020.

¶ 15 Remprex filed suit against Lloyd’s on August 24, 2020. Lloyd’s responded by filing its appearance on November 20, 2020, and a section 2-615 (735 ILCS 5/2-615 (West 2020)) motion to dismiss on December 21, 2020. Remprex subsequently filed its six-count, first amended complaint on April 19, 2021. Count I sought a declaration that Lloyd’s had a duty to defend and indemnity it in the CN and BNSF lawsuits, count II alleged breach of contract, count III alleged bad faith, count IV alleged vexatious and unreasonable conduct, count V alleged a violation of the Consumer Fraud Act (815 ILCS 505/1 et seq. (West 2020)), and count VI alleged common law fraud. Remprex based the allegations of its complaint on the underlying CN and BNSF complaints, the BNSF answer and subpoena, and Lloyd’s written denials of its claims for coverage.

¶ 16 Lloyd’s responded with a second section 2-615 motion to dismiss. Lloyd’s first contended that it had no duty to defend Remprex for either the CN or BNSF complaints because a comparison of the underlying complaint and the insurance policy showed that there was no duty to defend under the media liability or data and network liability coverages.

¶ 17 With respect to the CN lawsuit, Lloyd’s noted that the policy’s definition of media liability covered liability for creating, displaying, broadcasting, disseminating, or releasing media material to the public, and the CN complaint did not allege that Remprex did any of those things. Rather, the CN complaint alleged that Remprex violated the Privacy Act by "capturing and obtaining" and "collecting and storing" biometric information without appropriate consents, and there was no allegation that any information was released to the public or that Remprex took any action directed to the public. Lloyd’s disagreed with Remprex’s wide interpretation of "to the public," namely that an allegation of dissemination to certain select entities would be sufficient to satisfy the policy language requiring dissemination to the public. Lloyd’s concluded that because there was no allegation in the CN complaint that Remprex disseminated any information to the public, it had no duty to defend the CN complaint under the media liability coverage of the policy.

¶ 18 Lloyd’s further contended that it had no duty to defend the CN lawsuit under the data and network liability coverage of the policy because there was no allegation of a data breach or security breach in the CN complaint. Lloyd’s noted that the CN complaint was not a claim against Remprex for the theft or loss of information that in Remprex’s care, custody, or control or the disclosure of such information without...