West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc.

Digitally signed by Reporter of Decisions Reason: I attest Illinois Official Reports to the accuracy and integrity of this document Appellate Court Date: 2021.04.28 09:46:51 -05'00'

West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2020 IL App (1st) 191834

Appellate Court WEST BEND MUTUAL INSURANCE COMPANY, Plaintiff- Caption Appellant and Cross-Appellee, v. KRISHNA SCHAUMBURG TAN, INC., and KLAUDIA SEKURA, Defendants-Appellees (Krishna Schaumburg Tan, Inc., Cross-Appellant).

District & No. First District, Sixth Division No. 1-19-1834

Filed March 20, 2020

Decision Under Appeal from the Circuit Court of Cook County, No. 16-CH-7994; the Review Hon. Franklin Ulysses Valderrama, Judge, presiding.

Judgment Affirmed.

Counsel on Thomas F. Lucas, Kristin D. Tauras, and Kelly E. Purkey, of McKenna Appeal Storer, of Chicago, for appellant.

Ryan D. Andrews, Roger Perlstadt, Benjamin S. Thomassen, and Alexander G. Tievsky, of Edelson PC, of Chicago, for appellee Klaudia Sekura.

Richard M. Burgland and Robert Marc Chemers, of Pretzel & Stouffer, Chtrd., of Chicago, for other appellee.

Panel PRESIDING JUSTICE MIKVA delivered the judgment of the court, with opinion. Justices Connors and Harris concurred in the judgment and opinion.

OPINION

¶1 Plaintiff West Bend Mutual Insurance Company (West Bend) appeals from the circuit court’s partial grant of summary judgment in favor of defendants—its insured, Krishna Schaumburg Tan, Inc. (Krishna), and Klaudia Sekura, who sued Krishna for violating her statutory rights to privacy. Krishna sought coverage from West Bend in connection with that suit. West Bend agreed to defend Krishna under a reservation of rights, then filed the instant case, seeking a declaration that it had no duty to defend or indemnify Krishna. In its partial grant of summary judgment for defendants, the circuit court found that West Bend had a duty to defend Krishna in the underlying lawsuit. Krishna has also filed a cross-appeal from the circuit court’s grant of summary judgment in favor of West Bend on the issue of relief for a bad-faith denial of coverage under section 155 of the Insurance Code (215 ILCS 5/155 (West 2016)). For the following reasons, we affirm the rulings of the circuit court.

¶2 I. BACKGROUND ¶3 A. The Policies ¶4 The policies relevant to this appeal were issued by West Bend to Krishna, effective December 1, 2014, to December 1, 2015, and December 1, 2015, to December 1, 2016 (policies). Although there are two separate policies, the relevant provisions are identical except where noted. Under the “Businessowners Liability Coverage Form,” the policies provided that West Bend would pay “those sums that [Krishna] becomes legally obligated to pay as damages because of *** ‘personal injury’ *** to which this insurance applies” and that West Bend would have a duty to defend Krishna against “any ‘suit’ seeking those damages.” The policies further provided that the coverage would apply to “ ‘personal injury’ caused by an offense arising out of your business, excluding advertising, publishing, broadcasting or telecasting done by or for you.” ¶5 The policies defined “[p]ersonal injury” as: “[I]njury, other than ‘bodily injury,’ arising out of one or more of the following offenses: *** d. Oral or written publication of material that slanders or libels a person or organization ***; or e. Oral or written publication of material that violates a person’s right of privacy.” ¶6 The policies included an exclusion (violation of statutes exclusion) that provided as follows: “EXCLUSION—VIOLATION OF STATUTES THAT GOVERN E-MAILS, FAX, PHONE CALLS OR OTHER METHODS OF SENDING MATERIAL OR INFORMATION

-2-

*** This insurance does not apply to: DISTRIBUTION OF MATERIAL IN VIOLATION OF STATUTES ‘Bodily injury’, ‘property damage’, ‘personal injury’ or ‘advertising injury’ arising directly or indirectly out of any action or omission that violates or is alleged to violate: (1) The Telephone Consumer Protection Act (TCPA), including any amendment of or addition to such law; or (2) The CAN-SPAM ACT of 2003, including any amendment of or addition to such law; or (3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.” ¶7 The 2015-16 policy also included an endorsement titled “Illinois Data Compromise Coverage” (data compromise endorsement). That endorsement provided “an Additional Coverage” for “personal data compromise” under certain conditions. The definition section of that endorsement read as follows: 7. ‘Personal Data Compromise’ means the loss, theft, accidental release or accidental publication of ‘personally identifying information’ or ‘personally sensitive information’ as respects one or more ‘affected individuals.’ *** This definition is subject to the following provisions: *** b. ‘Personal Data Compromise’ includes disposal or abandonment of ‘personally identifying information’ or ‘personally sensitive information’ without appropriate safeguards such as shredding or destruction, subject to the following provisions: 1) The failure to use appropriate safeguards must be accidental and not reckless or deliberate.” ¶8 The parties’ arguments focus on these three provisions of the policies: the coverage for suits seeking damages for personal injury based on publication of material that violates a right to privacy, the violation of statutes exclusion, and the data compromise endorsement.

¶9 B. The Underlying Lawsuit ¶ 10 Ms. Sekura filed her proposed class action complaint against Krishna in April 2016, alleging in part that Krishna had violated her rights and the rights of those similarly situated under the Biometric Information Privacy Act (Act) (740 ILCS 14/1 et seq. (West 2014)). According to Ms. Sekura’s complaint, Krishna is an Illinois corporation and a franchisee of L.A. Tan Enterprises, Inc. Ms. Sekura alleged that when someone first purchases a service at Krishna, that customer is enrolled in the L.A. Tan national membership database to allow them to use their membership at any L.A. Tan location. Ms. Sekura further alleged that “Krishna Tan’s customers are required to have their fingerprints scanned” for the purpose of verifying their identification. Ms. Sekura alleged that she signed up for a membership with Krishna in April 2015, that she was enrolled by Krishna in the L.A. Tan corporate membership database at that time, and that Krishna required her to provide a scan of her fingerprint. Ms. Sekura

-3-

further stated that she was never provided with, nor signed, a written release allowing Krishna to disclose her biometric data to any third party. ¶ 11 Ms. Sekura alleged that Krishna violated the Act by, among other things, disclosing her fingerprint data to an out-of-state third-party vendor, SunLync, without her consent in violation of section 15(d)(1) of the Act (740 ILCS 14/15(d)(1) (West 2014)). ¶ 12 Ms. Sekura alleged three claims in total: (1) violation of the Act, for which she sought an injunction, statutory damages, and attorney fees; (2) unjust enrichment, for which she sought restitution; and (3) negligence based on Krishna’s violation of the Act, for which she sought damages for mental anguish and mental injury.

¶ 13 C. Procedural History ¶ 14 On June 14, 2016, West Bend filed its complaint for declaratory judgment against Krishna and Ms. Sekura. According to the complaint, Krishna tendered Ms. Sekura’s complaint to West Bend, seeking a defense and indemnity under its policies, and West Bend agreed to defend Krishna under a reservation of rights. West Bend then sought a declaration that it had no such duties. West Bend argued that Ms. Sekura’s lawsuit was not covered by the policies either because (1) her underlying allegations did not describe an “advertising injury” or a “personal injury,” (2) her allegations did not qualify for coverage under the data compromise endorsement, and (3) in the alternative, coverage for the underlying lawsuit was barred by the policies’ violation of statutes exclusion. ¶ 15 On January 18, 2017, Krishna filed an answer and counterclaim in response to West Bend’s complaint. In the counterclaim, Krishna sought a declaration that West Bend had a duty to defend it in the underlying lawsuit and also counterclaimed for attorney fees under section 155 of the Insurance Code (215 ILCS 5/155 (West 2016)). The counterclaim alleged that Ms. Sekura’s complaint “clearly create[d] the potential that West Bend ha[d] an obligation to provide a defense to Krishna,” that West Bend’s argument to the contrary had no good faith basis in law or fact, and that West Bend’s refusal to recognize its obligation to defend Krishna was vexatious and unreasonable. ¶ 16 In the fall of 2017, the parties filed cross-motions for summary judgment. Following a hearing on those motions, on May 14, 2018, the circuit court issued a 22-page written order. The court denied West Bend’s motion in part and granted Krishna’s motion in part, finding that West Bend had a duty to defend Krishna against Ms. Sekura’s claims. The circuit court found that those claims fell within the policies’ coverage for “personal injury” as a “publication which violates a person’s right to privacy” and that the noted exclusion did not preclude coverage. The court declined to reach the issue of whether the endorsement applied. ¶ 17 The circuit court denied Krishna’s motion for summary judgment with respect to its request for damages pursuant to section 155 of the Insurance Code and granted West Bend’s motion for summary judgment on this counterclaim, finding that “Krishna’s bare assertion that West Bend ha[d] engaged in what constitute[d] a ‘capricious’ denial of coverage [wa]s insufficient to meet the [s]ection 155 standard.”

¶ 18 II. JURISDICTION ¶ 19 West Bend appealed, and Krishna cross-appealed. Initially, this court dismissed those appeals for a lack of jurisdiction because the case was still pending relative to the duty to

-4-

indemnify. On August 28, 2019, the circuit court granted West Bend’s request for a finding under Illinois Supreme Court Rule 304(a) (eff. Mar. 8, 2016) that there was no just reason to delay enforcement or appeal of its orders dated May 14, 2018. On September 9, 2019, West Bend filed its notice of appeal from the circuit court’s orders of May 14, 2018. Krishna filed its notice of cross-appeal from the same orders on the same day. We thus have jurisdiction pursuant to Rule 304(a).

¶ 20 III. ANALYSIS ¶ 21 This case was resolved in the circuit court on cross-motions for summary judgment. “Summary judgment is appropriate when there is no genuine issue of material fact and the moving party is entitled to judgment as a matter of law.” Virginia Surety Co. v. Northern Insurance Co. of New York, 224 Ill. 2d 550, 556 (2007). We review de novo a circuit court’s rulings on cross-motions for summary judgment. A.B.A.T.E. of Illinois, Inc. v. Quinn, 2011 IL 110611, ¶ 22. This is also our standard of review here because this case turns on interpreting the policies, which is a question of law that we always review de novo. Travelers Insurance Co. v. Eljer Manufacturing, Inc., 197 Ill. 2d 278, 292 (2001).

¶ 22 A. West Bend’s Appeal ¶ 23 In its appeal, West Bend argues that the court erred in finding it had a duty to defend Krishna because (1) the allegations in the underlying complaint do not come within the policies’ definition of “personal injury,” (2) even if the allegations in the underlying complaint do allege a “personal injury,” the violation of statutes exclusion applies to bar coverage, and (3) the data compromise endorsement is inapplicable to the underlying allegations. ¶ 24 In response, Krishna and Ms. Sekura argue that the circuit court’s finding a duty to defend was proper because (1) the underlying allegations do potentially fall under the policies’ definition of “personal injury,” (2) the violation of statutes exclusion does not apply, and (3) the data compromise endorsement does apply and also provides coverage. Because the issue of the duty to defend can be resolved based on the first two issues, we do not reach this third issue on West Bend’s appeal.

¶ 25 1. The Underlying Complaint Alleged a Personal Injury ¶ 26 We first consider whether the allegations in Ms. Sekura’s complaint potentially come within the policies’ definition of “personal injury.” “Because an insurance policy is a contract, the rules applicable to contract interpretation govern the interpretation of an insurance policy.” Founders Insurance Co. v. Munoz, 237 Ill. 2d 424, 433 (2010). The court’s primary objective in interpreting an insurance policy is “to ascertain and give effect to the intentions of the parties as expressed by the language of the policy.” Valley Forge Insurance Co. v. Swiderski Electronics, Inc., 223 Ill. 2d 352, 362 (2006). “To determine whether an insurer has a duty to defend its insured from a lawsuit, a court must compare the facts alleged in the underlying complaint to the relevant provisions of the insurance policy” and the allegations “must be liberally construed in favor of the insured.” Id. at 363. If the underlying allegations “fall within, or potentially within, the policy’s coverage, the insurer is obligated to defend its insured.” Id. ¶ 27 West Bend’s policies provided that West Bend would defend Krishna in a lawsuit that alleged a “personal injury,” which the policies defined as “injury, other than ‘bodily injury,’

-5-

arising out of *** oral or written publication of material that violates a person’s right of privacy.” The parties argue, and we agree, that whether West Bend has a duty to defend specifically turns on the meaning of “publication” in the policies. ¶ 28 In the underlying complaint, Ms. Sekura alleged that Krishna violated the Act by providing her fingerprint data to a single third-party vendor, SunLync. The parties agree that this is the allegation that could potentially be considered “publication.” The policies do not define the term “publication.” “Undefined terms will be given their plain, ordinary and popular meaning, i.e., they will be construed with reference to the average, ordinary, normal, reasonable person.” Gillen v. State Farm Mutual Automobile Insurance Co., 215 Ill. 2d 381, 393 (2005). “If the policy language is susceptible to more than one reasonable meaning, it is considered ambiguous and will be construed against the insurer.” Id. ¶ 29 West Bend relies on our supreme court’s decision in Valley Forge to support its argument that “publication” requires communication of information to the public at large, not simply a single third party, and that Ms. Sekura’s allegation therefore does not charge Krishna with a “publication.” We reject West Bend’s argument that in Valley Forge our supreme court “defined” “publication” in the narrow manner that West Bend contends is controlling. ¶ 30 The underlying plaintiff in Valley Forge brought a proposed class action lawsuit against the insured for violating the Telephone Consumer Protection Act of 1991 (TCPA) (47 U.S.C. § 227 et seq. (2000)) by faxing advertisements to the proposed plaintiffs “without first obtaining the recipients’ permission to do so.” Valley Forge, 223 Ill. 2d at 355. The insurers argued that they had no duty to defend the insured in the underlying lawsuit because the claims in that lawsuit were not covered by their policies as an “advertising injury.” Id. at 358. The policies defined an “advertising injury” as “written *** publication *** of material that violates a person’s right of privacy.” (Internal quotation marks omitted.) Id. at 364. ¶ 31 The circuit and appellate courts found that the insurers had a duty to defend. Valley Forge Insurance Co. v. Swiderski Electronics, Inc., 359 Ill. App. 3d 872, 875 (2005). Before the appellate court, the parties argued about the definition of “publication,” specifically with respect to what scope of distribution was required. The insurers argued that “ ‘publication’ in the context of the polic[ies] require[d] injurious communication to a third party,” not simply an injurious communication to the party itself. Id. at 885. ¶ 32 On appeal, our supreme court also looked to the dictionary definitions of the term “publication.” The court acknowledged that the insurers had “abandoned” their argument that the underlying allegations “did not constitute ‘publication,’ ” but decided to discuss the issue nonetheless: “[I]n the interest of coherently interpreting all the relevant terms of the ‘advertising injury’ provision, we observe that [the underlying] complaint alleges conduct by [the insured] that amounted to ‘publication’ in the plain and ordinary sense of the word. By faxing advertisements to the proposed class of fax recipients as alleged in [the underlying] complaint, [the insured] published the advertisements in both the general sense of communicating information to the public and in the sense of distributing copies of the advertisements to the public.” Id. at 367. ¶ 33 West Bend seizes on this communicating “to the public” language in Valley Forge to argue that our supreme court conclusively “defined ‘publication’ to mean the communication or distribution of information to the public.” Putting aside whether the discussion in Valley Forge is a holding or is mere dicta, it is clear to us that the supreme court did not define the term

-6-

“publication” as being limited to requiring communication to any number of persons. Rather, the court recognized that “publication” included the actions alleged in the underlying complaint—sending numerous unsolicited faxes to the plaintiffs in the underlying case. Our supreme court specifically recognized that the complaint in the underlying case alleged a violation of the “fax recipient’s privacy interest in seclusion” and that there was “publication” by “faxing advertisements to the proposed class of fax recipients.” Id. at 366-67. ¶ 34 As the circuit court observed in this case, both the appellate and supreme courts in Valley Forge looked to what a reasonable person would understand the plain, ordinary meaning of the word “publication” to be and consulted dictionary definitions and common understanding. Id. at 367; Valley Forge, 359 Ill. App. 3d at 885. As our supreme court recognized in Valley Forge, where policy terms are not defined, the courts must give them their “plain, ordinary, and popular meanings,” consulting “dictionary definitions.” Valley Forge, 223 Ill. 2d at 366 (citing Outboard Marine Corp. v. Liberty Mutual Insurance Co., 154 Ill. 2d 90, 115-17 (1992)). ¶ 35 Common understandings and dictionary definitions of “publication” clearly include both the broad sharing of information to multiple recipients that the court viewed a “publication” in Valley Forge and a more limited sharing of information with a single third party. The Oxford English Dictionary, for example, defines “publication” as both “[t]he action of making something publicly known” and “Law. Notification or communication to a third party or to a limited number of people regarded as representative of the public.” Oxford English Dictionary (3d ed. 2007). Black’s Law Dictionary defines “publication” as “[g]enerally, the act of declaring or announcing to the public” and, in the defamation context, as “communication of defamatory words to someone other than the person defamed” and says specifically that “ ‘[a] letter sent to a single individual is sufficient.’ ” Black’s Law Dictionary (11th ed. 2019) (quoting Rollin M. Perkins & Ronald N. Boyce, Criminal Law 489 (3d ed. 1982)). ¶ 36 To the extent that West Bend suggests that “publication” means something different in the context of defamation than it does in the context of privacy rights, the policies use the exact same terminology of “[o]ral or written publication of material” as the basis for both a defamation-related injury and a privacy-related injury. These two definitions are immediately sequential in the policies. When construing insurance policies, “ ‘it is a general rule that absent language to the contrary, a word or phrase in one part is presumed to have the same meaning when it is used in another part of a policy.’ ” Universal Underwriters Insurance Co. v. LKQ Smart Parts, Inc., 2011 IL App (1st) 101723, ¶ 19 (quoting Hartford Accident & Indemnity Co. v. Case Foundation Co., 10 Ill. App. 3d 115, 123 (1973)). This should be particularly true where, as here, the two policy provisions are in the same section of the policies. ¶ 37 We also note that if West Bend wished the term “publication” to be limited to communication of information to a large number of people, it could have explicitly defined it as such in its policy. But it did not, choosing instead not to provide any definition of “publication.” “There is a strong presumption against provisions that easily could have been included in the contract but were not.” Wright v. Chicago Title Insurance Co., 196 Ill. App. 3d 920, 925 (1990). ¶ 38 The parties do not dispute that Ms. Sekura alleges facts that fit within the rest of the “personal injury” definition—that there was a provision of material in violation of her right to privacy. Because a common understanding of “publication” encompasses Krishna’s act of providing Ms. Sekura’s fingerprint data to a third party, there also exists potential that Ms. Sekura’s claim against Krishna is covered by the policies. As such, West Bend has a duty to

-7-

defend Krishna against the underlying complaint pursuant to the “personal injury” coverage provision.

¶ 39 2. The Violation of Statutes Exclusion Does Not Apply to Bar Coverage ¶ 40 West Bend next argues that, even if we find Ms. Sekura’s allegations come within the “personal injury” provision of the policies, coverage is barred by the violation of statutes exclusion. This exclusion specifically bars coverage for personal injuries “arising directly or indirectly out of any action or omission that violates or is alleged to violate” the TCPA, the CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq. (2012)), or “[a]ny statute, ordinance or regulation *** that prohibits or limits the sending, transmitting, communication or distribution of material or information.” ¶ 41 West Bend argues that this exclusion applies because the Act is a statute that “prohibits or limits the sending *** of material or information.” West Bend relies on section 15(d) of the Act, which provides that “[n]o private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person’s or a customer’s biometric identifier or biometric information unless” at least one of four specific conditions are met. 740 ILCS 14/15(d) (West 2014). West Bend claims that “[t]he only way to read” this section is that it “limits or prohibits the communication of biometric information unless the conditions set forth therein are met.” ¶ 42 The violation of statutes exclusion read in its entirety makes clear, however, that it was not intended to bar coverage for a violation of a statute like the Act. In fact, the exclusion is meant to bar coverage for the violation of a very limited type of statute that is evidenced first from the exclusion’s title, which West Bend conveniently shortens to “Violation of Statutes.” The title, as a whole, is: “Violation of Statutes That Govern E-Mails, Fax, Phone Calls or Other Method of Sending Material or Information.” (Emphasis added.) The title makes clear that the exclusion applies to statutes that govern certain methods of communication, i.e., e-mails, faxes, and phone calls, not to other statutes that limit the sending or sharing of certain information. ¶ 43 The text of the exclusion can easily be read consistently with the title. The exclusion explicitly applies to the TCPA and the CAN-SPAM Act—both statutes that regulate certain methods of communication. See, e.g., Standard Mutual Insurance Co. v. Lay, 2013 IL 114617, ¶ 27 (“The purposes of the TCPA are to protect the privacy interests of residential telephone customers by restricting unsolicited automated telephone calls to the home, and facilitating interstate commerce by restricting certain uses of fax machines and automatic dialers.”); Martin v. CCH, Inc., 784 F. Supp. 2d 1000, 1004 (N.D. Ill. 2011) (noting that the purpose of the CAN-SPAM Act is to, in part, “ ‘prohibit senders of [e-mail] for primarily commercial advertisement or promotional purposes from deceiving intended recipients or Internet service providers as to the source or subject matter of their e-mail messages’ ” (quoting S. Rep. No. 108-102, at 1 (2003), as reprinted in 2004 U.S.C.C.A.N. 2348, 2348). So only after listing two specific statutes—the violation of which the exclusion applies to—each with a clear purpose of governing methods of communication such as e-mails and phone calls, does the exclusion include a final catch-all provision for a statute “that prohibits or limits the sending, transmitting, communication or distribution of material or information.” In light of the title and the two specific statutes listed in the exclusion, the more reasonable reading of this third item is that it is meant to encompass any State or local statutes, rules, or ordinances that, like the TCPA and the CAN-SPAM Act, regulate methods of communication.

-8-

¶ 44 We are also unconvinced by West Bend’s argument that the exclusion was meant to apply to statutes that “lend themselves to class action litigation [and] pose serious insurance risks.” Nothing in the exclusion’s language suggests that was the purpose of the exclusion; if West Bend wanted the exclusion to have such an application, it could have written it so. As we stated above, “[t]here is a strong presumption against provisions that easily could have been included in the contract but were not.” Wright, 196 Ill. App. 3d at 925. ¶ 45 In short, the violation of statutes exclusion applies to bar coverage to violations of statutes that regulate methods of communication. The Act says nothing about methods of communication. It instead regulates “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g) (West 2014). As Ms. Sekura’s complaint alleges a violation of the Act, this exclusion does not apply to bar coverage to Krishna.

¶ 46 3. We Need Not Reach the Data Compromise Endorsement Issue ¶ 47 Because Ms. Sekura’s allegations against Krishna potentially fall within the policies’ definition of “personal injury” and the violation of statutes exclusion does not apply to bar coverage, we need not consider whether the data compromise endorsement would also provide coverage. West Bend has a duty to defend Krishna against Ms. Sekura’s lawsuit, and the circuit court correctly granted summary judgment in favor of defendants on that issue.

¶ 48 B. Krishna’s Cross-Appeal ¶ 49 On cross-appeal, Krishna argues that the circuit court erred in finding that West Bend did not violate section 155 of the Insurance Code (215 ILCS 5/155 (West 2016)). Initially, the parties disagree about the standard of review on this issue. Krishna argues that we should review this issue de novo, while West Bend argues that an abuse of discretion standard should be used. As we recently recognized in Evergreen Real Estate Service, LLC v. Hanover Insurance Co., 2019 IL App (1st) 181867, ¶¶ 34-35, Illinois courts have used both standards in reviewing section 155 rulings. See id. (and cases cited therein). Like the Evergreen court, however, we need not decide which standard of review is appropriate because, here, under either standard, we find the circuit court did not err in denying Krishna’s request for relief under section 155. ¶ 50 Section 155 provides “that an insured may collect attorney fees and costs where an insurer creates a ‘vexatious and unreasonable’ delay in settling a claim.” Illinois Founders Insurance Co. v. Williams, 2015 IL App (1st) 122481, ¶ 31 (quoting 215 ILCS 5/155(1) (West 2010)). When deciding whether an insurer’s conduct was vexatious and unreasonable, “[a] court should consider the totality of the circumstances” “including the insurer’s attitude, whether the insured was forced to sue to recover, and whether the insured was deprived of the use of his property.” (Internal quotation marks omitted.) Id. But where a bona fide coverage dispute exists, section 155 costs and sanctions are inappropriate. Id. ¶ 32. A bona fide dispute “is one that is real, actual, genuine, and not feigned.” (Internal quotation marks omitted.) Id. If an insurer reasonably relied upon such a bona fide dispute, that insurer did not act vexatiously or unreasonably. Id. ¶ 51 On appeal, Krishna only argues for section 155 damages based on the data compromise endorsement, apparently conceding that West Bend’s other defenses to coverage, while not

-9-

successful, were bona fide. Neither the circuit court nor this court have considered the issue of whether coverage is even available under the endorsement. ¶ 52 Under the endorsement, coverage is provided for a civil suit based on a “personal data compromise.” The endorsement defines “personal data compromise” as “the loss, theft, accidental release or accidental publication of ‘personally identifying information’ or ‘personally sensitive information.’ ” The endorsement also provides that “personal data compromise” “includes disposal or abandonment of ‘personally identifying information’ or ‘personally sensitive information’ without appropriate safeguards such as shredding or destruction.” The endorsement also states that “[t]he failure to use appropriate safeguards must be accidental and not reckless or deliberate.” The endorsement does not define “accidental,” but the parties point out that the term “accident” has been consistently defined by Illinois courts as “an unforeseen occurrence.” Aetna Casualty & Surety Co. v. Freyer, 89 Ill. App. 3d 617, 619 (1980). ¶ 53 Krishna now argues that there is no bona fide defense to coverage under this endorsement. Krishna’s articulation as to why the endorsement provides coverage was not put forward until its reply brief on the cross-appeal. For that reason alone, we could disregard it. See Ill. S. Ct. R. 341(h)(7) (“points not argued are forfeited and shall not be raised in the reply brief”). We choose to address this argument, as forfeiture is a limitation on the parties, not on the court. City of Highland Park v. Bryan, 2019 IL App (2d) 180662, ¶ 19. But we note that Krishna’s delay in articulating this understanding of the endorsement undermines any suggestion this is an obvious and irrefutable interpretation of the endorsement. ¶ 54 Krishna’s argument for coverage under the endorsement is that Ms. Sekura’s complaint alleges a “personal data compromise” by “disposal” of Ms. Sekura’s personally identifying or personally sensitive information to SunLync without appropriate safeguards. According to Krishna, the appropriate “safeguards” would have been following the data protection requirements of the Act, and the complaint alleges that the negligent failure to take note of changes in the law was “accidental.” ¶ 55 Krishna’s interpretation of the endorsement hinges on an interpretation of disposal as including the deliberate sharing of Ms. Sekura’s data with SunLync. It also would require an interpretation that “safeguards such as shredding or destruction” includes following new legal requirements. A court would have to also find that “accidental” means the failure to keep up on the law. None of these interpretations are necessarily correct and West Bend has compelling arguments to the contrary. ¶ 56 For example, West Bend argues that there is nothing in Ms. Sekura’s complaint that suggests that the lack of safeguards in this transfer of her biometric information was “accidental.” Instead, as West Bend points out, Krishna was alleged to have collected and used Ms. Sekura’s biometric data as part of its membership program, and thus, there was nothing “unforeseen” about it. Certainly, keeping up on the law is different than shredding or destroying confidential data so it is not at all clear that following the Act is a “safeguard” in the sense that word is used in the endorsement. In short, there is nothing in this interpretation that is so compelling that it renders West Bend’s defense frivolous or without merit. It is clear to us that West Bend has a bona fide argument for why the endorsement does not apply. Therefore, fees, costs, and damages under section 155 are not appropriate.

- 10 -

¶ 57 IV. CONCLUSION ¶ 58 Ms. Sekura’s allegations that Krishna violated the Act when it provided her fingerprint data to a third party potentially fall within the policies’ definition of “personal injury,” and Krishna is not barred from coverage by the violation of statutes exclusion. West Bend thus has a duty to defend Krishna in the underlying lawsuit. Additionally, there is a bona fide dispute as to whether Krishna would be entitled to coverage under the data compromise endorsement; therefore, Krishna is not entitled to damages under section 155 of the Insurance Code. We affirm the judgment of the circuit court—both in granting summary judgment in favor of defendants on the duty to defend issue and in favor of West Bend on the section 155 issue.

¶ 59 Affirmed.

- 11 -