Citizens Ins. Co. of Am. v. Wynndalco Enters., LLC

• Docket Number: 22-2313
• Decision Date: 15 June 2023
• Parties: CITIZENS INSURANCE COMPANY OF AMERICA, Plaintiff-Appellant, v. WYNNDALCO ENTERPRISES, LLC, et al., Defendants-Appellees.
• Court: U.S. Court of Appeals — Seventh Circuit

70 F.4th 987

CITIZENS INSURANCE COMPANY OF AMERICA, Plaintiff-Appellant, v. WYNNDALCO ENTERPRISES, LLC, et al., Defendants-Appellees.

No. 22-2313

United States Court of Appeals, Seventh Circuit

Argued February 14, 2023

Decided June 15, 2023

Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 20-cv-03873 — John Z. Lee, Judge.

Kelly M. Ognibene, Jeffrey Alan Goldwater, Attorneys, Lewis Brisbois Bisgaard & Smith LLP, Chicago, IL, for Plaintiff-Appellant.

Zachary J. Freeman, Rachel Ellen Simon, Attorneys, MILLER Shakman Levine & Feldman LLP, Chicago, IL, David S. Golub, Attorney, Silver Golub & Teitell LLP, Stamford, CT, Kevin M. Forde, Brian P. O'Meara, Attorneys, Forde & O'Meara LLP, Chicago, IL, for Defendants-Appellees Melissa Thornley, Deborah Benjamin-Koller, Josue Herrera.

David S. Golub, Attorney, Silver Golub & Teitell LLP, Stamford, CT, for Defendants-Appellees David Andalcio, Jose Flores.

Before Rovner, Kirsch, and Jackson-Akiwumi, Circuit Judges.

Rovner, Circuit Judge.

This business insurance coverage dispute calls on us to decide whether a broad catch-all provision in a violation-of-statutes exclusion relieves the insurer of the duty to defend its insured in litigation over violations of Illinois' Biometric Information Privacy Act ("BIPA"), 740 ILCS 141 et seq. After Wynndalco Enterprises, LLC was sued in two putative class actions for violating BIPA, its business liability insurer, Citizens Insurance Company of America, filed this action seeking a declaration that it has no obligation under the terms of the insurance contract to indemnify Wynndalco for the BIPA violations or to supply Wynndalco with a defense. Citizens' theory is that alleged violations of BIPA are expressly excluded from the coverage of the policy. Wynndalco counterclaimed seeking a declaration to the contrary that Citizens is obligated to provide it with a defense in both actions. The district court entered judgment on the pleadings for Wynndalco, finding that the language of the catch-all exclusion is ambiguous on its face and that, construing that ambiguity in favor of the insured, Citizens consequently had a duty to defend Wynndalco.¹ We agree with the district court that the facial breadth of the catch-all provision gives rise to an ambiguity in the policy, in that the catch-all provision appears to nullify coverage that the policy elsewhere purports to provide. Citizens Ins. Co. of Am. v. Wynndalco Enters., LLC, 595 F.Supp.3d 668 (N.D. Ill. 2022). The narrowing construction that Citizens proposes to resolve that ambiguity is not supported by the language of the provision and does not, in fact, resolve the ambiguity. In view of what the district court described as the "intractabl[e] ambigu[ity]" of the provision, Citizens must defend Wynndalco in the two class actions. Id. at 676.

I.

The litigation that has given rise to this coverage dispute stems from a massive database of facial-image scans assembled by Clearview AI, an artificial intelligence firm that specializes in facial recognition software. We accept as true the following factual allegations gleaned from the two complaints filed against Wynndalco.

Clearview AI allegedly has extracted or "scraped" in excess of three billion photographs of individuals from online social media, content-sharing, and digital payment platforms (including Facebook, Twitter, Instagram, TikTok, Snapchat, YouTube, Google Photos, LinkedIn, and Venmo); converted those images into biometric facial recognition identifiers using proprietary algorithms; collected the original images and their biometric counterparts into its database; and paired those images with information as to where those images were found on the Internet. Clearview AI has also created a facial recognition application or "app" that allows a user to identify an individual by uploading a photograph of that person to the app. The app then allows the user to see other photographs of that same person on the media platforms or websites where they appear, along with the identifying information (including their name, address, and other personal information) associated with that individual. Thus, a user could take a photograph of a stranger on the street and upload the image to the app, which converts the photograph into a biometric facial scan, and (assuming the individual's photos and information are in Clearview AI's database), determine who that person is, and access any number of additional photographs of and associated content (tweets, Facebook and Instagram posts, YouTube and TikTok videos, LinkedIn profiles, etc.) created by and about that individual. Clearview AI marketed the app to law enforcement agencies, among others. See Kashmir Hill, The Secretive Company That Might End Privacy As We Know It, NEW YORK TIMES (Jan. 18, 2020), available at https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html?.

The Chicago Police Department, through its purchasing agent CDW-Government, gained access to the Clearview AI database and its facial-identification app by means of a two-year contract between CDW-Government and Wynndalco.

Melissa Thornley and Mario Calderon are the respective lead, named plaintiffs in two putative class actions filed on behalf of themselves and other Illinois residents whose facial images have been collected and scanned into the Clearview AI database: Thornley, et al. v. CDW-Government, LLC, et al., No. 2020 CH 04346 (Cir. Ct. Cook Cnty. filed May 27, 2020); Calderon, et al. v. Clearview AI, Inc., et al., No. 1:20-cv-01296-CM (S.D.N.Y. filed Jul. 22, 2020). We shall refer to the two suits using their surnames.

Wynndalco is an Illinois-based information technology services and consulting firm. The Thornley and Calderon complaints describe Wynndalco's relationship with Clearview AI in two different ways. According to the Thornley complaint, Clearview AI was not able to sell access to its database and app directly to the Chicago Police Department because it was not an approved vendor for the department, whereas Wynndalco was an approved vender. Thus, CDW-Government contacted Wynndalco and entered into an arrangement pursuant to which Wynndalco would purchase the product from Clearview AI and then re-sell it to CDW-Government. Wynndalco proceeded to make the purchase from Clearview AI in December 2019 for the sum of $47,500, and then immediately re-sold the product to CDW-Government for $48,450.00. CDW-Government in turn resold the product to the Chicago Police Department for $49,875. By contrast, the Calderon complaint alleges that Wynndalco is Clearview AI's agent and that Wynndalco licenses and supplies the product to customers on Clearview AI's behalf. The Calderon complaint alleges that on January 1, 2020, the Chicago Police Department, through its agent, CDW-Government, entered into a two-year, $49,875 contract with Clearview AI.

Both suits allege that Wynndalco's role in this transaction ran afoul of BIPA. Illinois became the first state in the nation to enact biometric data privacy legislation when it promulgated BIPA. Broadly speaking, BIPA codifies an individual's right of privacy in and control over his or her biometric identifiers and biometric information. See Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 621 (7th Cir. 2020) (quoting Rosenbach v. Six Flags Entm't Corp., 432 Ill.Dec. 654, 129 N.E.3d 1197, 1206 (Ill. 2019)). "[The Act] imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information. Under the Act, any person 'aggrieved' by a violation of its provisions 'shall have a right of action . . . against an offending party' and 'may recover for each violation' the greater of liquidated damages or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate." Rosenbach, 432 Ill. Dec. 654, 129 N.E.3d at 1199-1200 (quoting 740 ILCS 14/20). A violation of the statute as to one's biometric information is sufficient in and of itself to render an individual an "aggrieved person" entitled to pursue relief; he or she need not suffer an actual injury as a result of the violation. Id., 432 Ill.Dec. 654, 129 N.E.3d at 1205-07. BIPA currently provides the broadest private right of action among the states that have adopted similar statutory protections for biometric data. See Molly DiRago, The Litigation Landscape of Illinois' Biometric Information Privacy Act, American Bar Association Cybersecurity and Data Privacy Committee (Aug. 20, 2021), available at https://www.americanbar.org/groups/tort_trial_insurance_practice/committees/cyber-data-privacy/the-litigationlandscape/.

The amended complaint in Thornley includes three counts directed against Wynndalco.² The first of these counts alleges that Wynndalco intentionally or recklessly violated section 15(c) of BIPA, 740 ILCS 14/15(c), by profiting from the named plaintiffs' and putative class members' biometric identifiers or biometric information in the Clearview AI app database. Section 15(c) provides:

No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.

740 ILCS 14/15(c). The term "biometric identifier" is defined to include, among other attributes, "face geometry." 740 ILCS 14/10. A second, unjust enrichment count in the Thornley complaint alleges that Wynndalco has unjustly benefitted from its publication of the class members' biometric information, to the detriment of the named plaintiffs and the class. A third, invasion-of-privacy count alleges that Wynndalco's publication and exploitation of the plaintiffs' biometric data amounted to an unauthorized intrusion upon their seclusion, causing them...