West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc.

Digitally signed
by Reporter of
Decisions
Reason: I attest
Illinois Official Reports to the accuracy
and integrity of
this document
Appellate Court Date: 2021.04.28
09:46:51 -05'00'

West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc.,
2020 IL App (1st) 191834

Appellate Court WEST BEND MUTUAL INSURANCE COMPANY, Plaintiff-
Caption Appellant and Cross-Appellee, v. KRISHNA SCHAUMBURG TAN,
INC., and KLAUDIA SEKURA, Defendants-Appellees (Krishna
Schaumburg Tan, Inc., Cross-Appellant).

District & No. First District, Sixth Division
No. 1-19-1834

Filed March 20, 2020

Decision Under Appeal from the Circuit Court of Cook County, No. 16-CH-7994; the
Review Hon. Franklin Ulysses Valderrama, Judge, presiding.

Judgment Affirmed.

Counsel on Thomas F. Lucas, Kristin D. Tauras, and Kelly E. Purkey, of McKenna
Appeal Storer, of Chicago, for appellant.

Ryan D. Andrews, Roger Perlstadt, Benjamin S. Thomassen, and
Alexander G. Tievsky, of Edelson PC, of Chicago, for appellee
Klaudia Sekura.

Richard M. Burgland and Robert Marc Chemers, of Pretzel &
Stouffer, Chtrd., of Chicago, for other appellee.
 Panel PRESIDING JUSTICE MIKVA delivered the judgment of the court,
with opinion.
Justices Connors and Harris concurred in the judgment and opinion.

OPINION

¶1 Plaintiff West Bend Mutual Insurance Company (West Bend) appeals from the circuit
court’s partial grant of summary judgment in favor of defendants—its insured, Krishna
Schaumburg Tan, Inc. (Krishna), and Klaudia Sekura, who sued Krishna for violating her
statutory rights to privacy. Krishna sought coverage from West Bend in connection with that
suit. West Bend agreed to defend Krishna under a reservation of rights, then filed the instant
case, seeking a declaration that it had no duty to defend or indemnify Krishna. In its partial
grant of summary judgment for defendants, the circuit court found that West Bend had a duty
to defend Krishna in the underlying lawsuit. Krishna has also filed a cross-appeal from the
circuit court’s grant of summary judgment in favor of West Bend on the issue of relief for a
bad-faith denial of coverage under section 155 of the Insurance Code (215 ILCS 5/155 (West
2016)). For the following reasons, we affirm the rulings of the circuit court.

¶2 I. BACKGROUND
¶3 A. The Policies
¶4 The policies relevant to this appeal were issued by West Bend to Krishna, effective
December 1, 2014, to December 1, 2015, and December 1, 2015, to December 1, 2016
(policies). Although there are two separate policies, the relevant provisions are identical except
where noted. Under the “Businessowners Liability Coverage Form,” the policies provided that
West Bend would pay “those sums that [Krishna] becomes legally obligated to pay as damages
because of *** ‘personal injury’ *** to which this insurance applies” and that West Bend
would have a duty to defend Krishna against “any ‘suit’ seeking those damages.” The policies
further provided that the coverage would apply to “ ‘personal injury’ caused by an offense
arising out of your business, excluding advertising, publishing, broadcasting or telecasting
done by or for you.”
¶5 The policies defined “[p]ersonal injury” as:
“[I]njury, other than ‘bodily injury,’ arising out of one or more of the following
offenses:
***
d. Oral or written publication of material that slanders or libels a person or
organization ***; or
e. Oral or written publication of material that violates a person’s right of
privacy.”
¶6 The policies included an exclusion (violation of statutes exclusion) that provided as
follows:
“EXCLUSION—VIOLATION OF STATUTES THAT GOVERN E-MAILS,
FAX, PHONE CALLS OR OTHER METHODS OF SENDING MATERIAL OR
INFORMATION

-2-
 ***
This insurance does not apply to:
DISTRIBUTION OF MATERIAL IN VIOLATION OF STATUTES
‘Bodily injury’, ‘property damage’, ‘personal injury’ or ‘advertising injury’ arising
directly or indirectly out of any action or omission that violates or is alleged to violate:
(1) The Telephone Consumer Protection Act (TCPA), including any
amendment of or addition to such law; or
(2) The CAN-SPAM ACT of 2003, including any amendment of or addition to
such law; or
(3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM
Act of 2003, that prohibits or limits the sending, transmitting, communicating or
distribution of material or information.”
¶7 The 2015-16 policy also included an endorsement titled “Illinois Data Compromise
Coverage” (data compromise endorsement). That endorsement provided “an Additional
Coverage” for “personal data compromise” under certain conditions. The definition section of
that endorsement read as follows:
7. ‘Personal Data Compromise’ means the loss, theft, accidental release or
accidental publication of ‘personally identifying information’ or ‘personally sensitive
information’ as respects one or more ‘affected individuals.’ *** This definition is
subject to the following provisions:
***
b. ‘Personal Data Compromise’ includes disposal or abandonment of
‘personally identifying information’ or ‘personally sensitive information’ without
appropriate safeguards such as shredding or destruction, subject to the following
provisions:
1) The failure to use appropriate safeguards must be accidental and not
reckless or deliberate.”
¶8 The parties’ arguments focus on these three provisions of the policies: the coverage for
suits seeking damages for personal injury based on publication of material that violates a right
to privacy, the violation of statutes exclusion, and the data compromise endorsement.

¶9 B. The Underlying Lawsuit
¶ 10 Ms. Sekura filed her proposed class action complaint against Krishna in April 2016,
alleging in part that Krishna had violated her rights and the rights of those similarly situated
under the Biometric Information Privacy Act (Act) (740 ILCS 14/1 et seq. (West 2014)).
According to Ms. Sekura’s complaint, Krishna is an Illinois corporation and a franchisee of
L.A. Tan Enterprises, Inc. Ms. Sekura alleged that when someone first purchases a service at
Krishna, that customer is enrolled in the L.A. Tan national membership database to allow them
to use their membership at any L.A. Tan location. Ms. Sekura further alleged that “Krishna
Tan’s customers are required to have their fingerprints scanned” for the purpose of verifying
their identification. Ms. Sekura alleged that she signed up for a membership with Krishna in
April 2015, that she was enrolled by Krishna in the L.A. Tan corporate membership database
at that time, and that Krishna required her to provide a scan of her fingerprint. Ms. Sekura

-3-
 further stated that she was never provided with, nor signed, a written release allowing Krishna
to disclose her biometric data to any third party.
¶ 11 Ms. Sekura alleged that Krishna violated the Act by, among other things, disclosing her
fingerprint data to an out-of-state third-party vendor, SunLync, without her consent in violation
of section 15(d)(1) of the Act (740 ILCS 14/15(d)(1) (West 2014)).
¶ 12 Ms. Sekura alleged three claims in total: (1) violation of the Act, for which she sought an
injunction, statutory damages, and attorney fees; (2) unjust enrichment, for which she sought
restitution; and (3) negligence based on Krishna’s violation of the Act, for which she sought
damages for mental anguish and mental injury.

¶ 13 C. Procedural History
¶ 14 On June 14, 2016, West Bend filed its complaint for declaratory judgment against Krishna
and Ms. Sekura. According to the complaint, Krishna tendered Ms. Sekura’s complaint to West
Bend, seeking a defense and indemnity under its policies, and West Bend agreed to defend
Krishna under a reservation of rights. West Bend then sought a declaration that it had no such
duties. West Bend argued that Ms. Sekura’s lawsuit was not covered by the policies either
because (1) her underlying allegations did not describe an “advertising injury” or a “personal
injury,” (2) her allegations did not qualify for coverage under the data compromise
endorsement, and (3) in the alternative, coverage for the underlying lawsuit was barred by the
policies’ violation of statutes exclusion.
¶ 15 On January 18, 2017, Krishna filed an answer and counterclaim in response to West Bend’s
complaint. In the counterclaim, Krishna sought a declaration that West Bend had a duty to
defend it in the underlying lawsuit and also counterclaimed for attorney fees under section 155
of the Insurance Code (215 ILCS 5/155 (West 2016)). The counterclaim alleged that Ms.
Sekura’s complaint “clearly create[d] the potential that West Bend ha[d] an obligation to
provide a defense to Krishna,” that West Bend’s argument to the contrary had no good faith
basis in law or fact, and that West Bend’s refusal to recognize its obligation to defend Krishna
was vexatious and unreasonable.
¶ 16 In the fall of 2017, the parties filed cross-motions for summary judgment. Following a
hearing on those motions, on May 14, 2018, the circuit court issued a 22-page written order.
The court denied West Bend’s motion in part and granted Krishna’s motion in part, finding
that West Bend had a duty to defend Krishna against Ms. Sekura’s claims. The circuit court
found that those claims fell within the policies’ coverage for “personal injury” as a “publication
which violates a person’s right to privacy” and that the noted exclusion did not preclude
coverage. The court declined to reach the issue of whether the endorsement applied.
¶ 17 The circuit court denied Krishna’s motion for summary judgment with respect to its request
for damages pursuant to section 155 of the Insurance Code and granted West Bend’s motion
for summary judgment on this counterclaim, finding that “Krishna’s bare assertion that West
Bend ha[d] engaged in what constitute[d] a ‘capricious’ denial of coverage [wa]s insufficient
to meet the [s]ection 155 standard.”

¶ 18 II. JURISDICTION
¶ 19 West Bend appealed, and Krishna cross-appealed. Initially, this court dismissed those
appeals for a lack of jurisdiction because the case was still pending relative to the duty to

-4-
 indemnify. On August 28, 2019, the circuit court granted West Bend’s request for a finding
under Illinois Supreme Court Rule 304(a) (eff. Mar. 8, 2016) that there was no just reason to
delay enforcement or appeal of its orders dated May 14, 2018. On September 9, 2019, West
Bend filed its notice of appeal from the circuit court’s orders of May 14, 2018. Krishna filed
its notice of cross-appeal from the same orders on the same day. We thus have jurisdiction
pursuant to Rule 304(a).

¶ 20 III. ANALYSIS
¶ 21 This case was resolved in the circuit court on cross-motions for summary judgment.
“Summary judgment is appropriate when there is no genuine issue of material fact and the
moving party is entitled to judgment as a matter of law.” Virginia Surety Co. v. Northern
Insurance Co. of New York, 224 Ill. 2d 550, 556 (2007). We review de novo a circuit court’s
rulings on cross-motions for summary judgment. A.B.A.T.E. of Illinois, Inc. v. Quinn, 2011 IL
110611, ¶ 22. This is also our standard of review here because this case turns on interpreting
the policies, which is a question of law that we always review de novo. Travelers Insurance
Co. v. Eljer Manufacturing, Inc., 197 Ill. 2d 278, 292 (2001).

¶ 22 A. West Bend’s Appeal
¶ 23 In its appeal, West Bend argues that the court erred in finding it had a duty to defend
Krishna because (1) the allegations in the underlying complaint do not come within the
policies’ definition of “personal injury,” (2) even if the allegations in the underlying complaint
do allege a “personal injury,” the violation of statutes exclusion applies to bar coverage, and
(3) the data compromise endorsement is inapplicable to the underlying allegations.
¶ 24 In response, Krishna and Ms. Sekura argue that the circuit court’s finding a duty to defend
was proper because (1) the underlying allegations do potentially fall under the policies’
definition of “personal injury,” (2) the violation of statutes exclusion does not apply, and
(3) the data compromise endorsement does apply and also provides coverage. Because the
issue of the duty to defend can be resolved based on the first two issues, we do not reach this
third issue on West Bend’s appeal.

¶ 25 1. The Underlying Complaint Alleged a Personal Injury
¶ 26 We first consider whether the allegations in Ms. Sekura’s complaint potentially come
within the policies’ definition of “personal injury.” “Because an insurance policy is a contract,
the rules applicable to contract interpretation govern the interpretation of an insurance policy.”
Founders Insurance Co. v. Munoz, 237 Ill. 2d 424, 433 (2010). The court’s primary objective
in interpreting an insurance policy is “to ascertain and give effect to the intentions of the parties
as expressed by the language of the policy.” Valley Forge Insurance Co. v. Swiderski
Electronics, Inc., 223 Ill. 2d 352, 362 (2006). “To determine whether an insurer has a duty to
defend its insured from a lawsuit, a court must compare the facts alleged in the underlying
complaint to the relevant provisions of the insurance policy” and the allegations “must be
liberally construed in favor of the insured.” Id. at 363. If the underlying allegations “fall within,
or potentially within, the policy’s coverage, the insurer is obligated to defend its insured.” Id.
¶ 27 West Bend’s policies provided that West Bend would defend Krishna in a lawsuit that
alleged a “personal injury,” which the policies defined as “injury, other than ‘bodily injury,’

-5-
 arising out of *** oral or written publication of material that violates a person’s right of
privacy.” The parties argue, and we agree, that whether West Bend has a duty to defend
specifically turns on the meaning of “publication” in the policies.
¶ 28 In the underlying complaint, Ms. Sekura alleged that Krishna violated the Act by providing
her fingerprint data to a single third-party vendor, SunLync. The parties agree that this is the
allegation that could potentially be considered “publication.” The policies do not define the
term “publication.” “Undefined terms will be given their plain, ordinary and popular meaning,
i.e., they will be construed with reference to the average, ordinary, normal, reasonable person.”
Gillen v. State Farm Mutual Automobile Insurance Co., 215 Ill. 2d 381, 393 (2005). “If the
policy language is susceptible to more than one reasonable meaning, it is considered
ambiguous and will be construed against the insurer.” Id.
¶ 29 West Bend relies on our supreme court’s decision in Valley Forge to support its argument
that “publication” requires communication of information to the public at large, not simply a
single third party, and that Ms. Sekura’s allegation therefore does not charge Krishna with a
“publication.” We reject West Bend’s argument that in Valley Forge our supreme court
“defined” “publication” in the narrow manner that West Bend contends is controlling.
¶ 30 The underlying plaintiff in Valley Forge brought a proposed class action lawsuit against
the insured for violating the Telephone Consumer Protection Act of 1991 (TCPA) (47 U.S.C.
§ 227 et seq. (2000)) by faxing advertisements to the proposed plaintiffs “without first
obtaining the recipients’ permission to do so.” Valley Forge, 223 Ill. 2d at 355. The insurers
argued that they had no duty to defend the insured in the underlying lawsuit because the claims
in that lawsuit were not covered by their policies as an “advertising injury.” Id. at 358. The
policies defined an “advertising injury” as “written *** publication *** of material that
violates a person’s right of privacy.” (Internal quotation marks omitted.) Id. at 364.
¶ 31 The circuit and appellate courts found that the insurers had a duty to defend. Valley Forge
Insurance Co. v. Swiderski Electronics, Inc., 359 Ill. App. 3d 872, 875 (2005). Before the
appellate court, the parties argued about the definition of “publication,” specifically with
respect to what scope of distribution was required. The insurers argued that “ ‘publication’ in
the context of the polic[ies] require[d] injurious communication to a third party,” not simply
an injurious communication to the party itself. Id. at 885.
¶ 32 On appeal, our supreme court also looked to the dictionary definitions of the term
“publication.” The court acknowledged that the insurers had “abandoned” their argument that
the underlying allegations “did not constitute ‘publication,’ ” but decided to discuss the issue
nonetheless:
“[I]n the interest of coherently interpreting all the relevant terms of the ‘advertising
injury’ provision, we observe that [the underlying] complaint alleges conduct by [the
insured] that amounted to ‘publication’ in the plain and ordinary sense of the word. By
faxing advertisements to the proposed class of fax recipients as alleged in [the
underlying] complaint, [the insured] published the advertisements in both the general
sense of communicating information to the public and in the sense of distributing copies
of the advertisements to the public.” Id. at 367.
¶ 33 West Bend seizes on this communicating “to the public” language in Valley Forge to argue
that our supreme court conclusively “defined ‘publication’ to mean the communication or
distribution of information to the public.” Putting aside whether the discussion in Valley Forge
is a holding or is mere dicta, it is clear to us that the supreme court did not define the term

-6-
 “publication” as being limited to requiring communication to any number of persons. Rather,
the court recognized that “publication” included the actions alleged in the underlying
complaint—sending numerous unsolicited faxes to the plaintiffs in the underlying case. Our
supreme court specifically recognized that the complaint in the underlying case alleged a
violation of the “fax recipient’s privacy interest in seclusion” and that there was “publication”
by “faxing advertisements to the proposed class of fax recipients.” Id. at 366-67.
¶ 34 As the circuit court observed in this case, both the appellate and supreme courts in Valley
Forge looked to what a reasonable person would understand the plain, ordinary meaning of
the word “publication” to be and consulted dictionary definitions and common understanding.
Id. at 367; Valley Forge, 359 Ill. App. 3d at 885. As our supreme court recognized in Valley
Forge, where policy terms are not defined, the courts must give them their “plain, ordinary,
and popular meanings,” consulting “dictionary definitions.” Valley Forge, 223 Ill. 2d at 366
(citing Outboard Marine Corp. v. Liberty Mutual Insurance Co., 154 Ill. 2d 90, 115-17 (1992)).
¶ 35 Common understandings and dictionary definitions of “publication” clearly include both
the broad sharing of information to multiple recipients that the court viewed a “publication” in
Valley Forge and a more limited sharing of information with a single third party. The Oxford
English Dictionary, for example, defines “publication” as both “[t]he action of making
something publicly known” and “Law. Notification or communication to a third party or to a
limited number of people regarded as representative of the public.” Oxford English Dictionary
(3d ed. 2007). Black’s Law Dictionary defines “publication” as “[g]enerally, the act of
declaring or announcing to the public” and, in the defamation context, as “communication of
defamatory words to someone other than the person defamed” and says specifically that “ ‘[a]
letter sent to a single individual is sufficient.’ ” Black’s Law Dictionary (11th ed. 2019)
(quoting Rollin M. Perkins & Ronald N. Boyce, Criminal Law 489 (3d ed. 1982)).
¶ 36 To the extent that West Bend suggests that “publication” means something different in the
context of defamation than it does in the context of privacy rights, the policies use the exact
same terminology of “[o]ral or written publication of material” as the basis for both a
defamation-related injury and a privacy-related injury. These two definitions are immediately
sequential in the policies. When construing insurance policies, “ ‘it is a general rule that absent
language to the contrary, a word or phrase in one part is presumed to have the same meaning
when it is used in another part of a policy.’ ” Universal Underwriters Insurance Co. v. LKQ
Smart Parts, Inc., 2011 IL App (1st) 101723, ¶ 19 (quoting Hartford Accident & Indemnity
Co. v. Case Foundation Co., 10 Ill. App. 3d 115, 123 (1973)). This should be particularly true
where, as here, the two policy provisions are in the same section of the policies.
¶ 37 We also note that if West Bend wished the term “publication” to be limited to
communication of information to a large number of people, it could have explicitly defined it
as such in its policy. But it did not, choosing instead not to provide any definition of
“publication.” “There is a strong presumption against provisions that easily could have been
included in the contract but were not.” Wright v. Chicago Title Insurance Co., 196 Ill. App. 3d
920, 925 (1990).
¶ 38 The parties do not dispute that Ms. Sekura alleges facts that fit within the rest of the
“personal injury” definition—that there was a provision of material in violation of her right to
privacy. Because a common understanding of “publication” encompasses Krishna’s act of
providing Ms. Sekura’s fingerprint data to a third party, there also exists potential that Ms.
Sekura’s claim against Krishna is covered by the policies. As such, West Bend has a duty to

-7-
 defend Krishna against the underlying complaint pursuant to the “personal injury” coverage
provision.

¶ 39 2. The Violation of Statutes Exclusion Does Not Apply to Bar Coverage
¶ 40 West Bend next argues that, even if we find Ms. Sekura’s allegations come within the
“personal injury” provision of the policies, coverage is barred by the violation of statutes
exclusion. This exclusion specifically bars coverage for personal injuries “arising directly or
indirectly out of any action or omission that violates or is alleged to violate” the TCPA, the
CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq. (2012)), or “[a]ny statute, ordinance or
regulation *** that prohibits or limits the sending, transmitting, communication or distribution
of material or information.”
¶ 41 West Bend argues that this exclusion applies because the Act is a statute that “prohibits or
limits the sending *** of material or information.” West Bend relies on section 15(d) of the
Act, which provides that “[n]o private entity in possession of a biometric identifier or biometric
information may disclose, redisclose, or otherwise disseminate a person’s or a customer’s
biometric identifier or biometric information unless” at least one of four specific conditions
are met. 740 ILCS 14/15(d) (West 2014). West Bend claims that “[t]he only way to read” this
section is that it “limits or prohibits the communication of biometric information unless the
conditions set forth therein are met.”
¶ 42 The violation of statutes exclusion read in its entirety makes clear, however, that it was not
intended to bar coverage for a violation of a statute like the Act. In fact, the exclusion is meant
to bar coverage for the violation of a very limited type of statute that is evidenced first from
the exclusion’s title, which West Bend conveniently shortens to “Violation of Statutes.” The
title, as a whole, is: “Violation of Statutes That Govern E-Mails, Fax, Phone Calls or Other
Method of Sending Material or Information.” (Emphasis added.) The title makes clear that the
exclusion applies to statutes that govern certain methods of communication, i.e., e-mails, faxes,
and phone calls, not to other statutes that limit the sending or sharing of certain information.
¶ 43 The text of the exclusion can easily be read consistently with the title. The exclusion
explicitly applies to the TCPA and the CAN-SPAM Act—both statutes that regulate certain
methods of communication. See, e.g., Standard Mutual Insurance Co. v. Lay, 2013 IL
114617, ¶ 27 (“The purposes of the TCPA are to protect the privacy interests of residential
telephone customers by restricting unsolicited automated telephone calls to the home, and
facilitating interstate commerce by restricting certain uses of fax machines and automatic
dialers.”); Martin v. CCH, Inc., 784 F. Supp. 2d 1000, 1004 (N.D. Ill. 2011) (noting that the
purpose of the CAN-SPAM Act is to, in part, “ ‘prohibit senders of [e-mail] for primarily
commercial advertisement or promotional purposes from deceiving intended recipients or
Internet service providers as to the source or subject matter of their e-mail messages’ ” (quoting
S. Rep. No. 108-102, at 1 (2003), as reprinted in 2004 U.S.C.C.A.N. 2348, 2348). So only
after listing two specific statutes—the violation of which the exclusion applies to—each with
a clear purpose of governing methods of communication such as e-mails and phone calls, does
the exclusion include a final catch-all provision for a statute “that prohibits or limits the
sending, transmitting, communication or distribution of material or information.” In light of
the title and the two specific statutes listed in the exclusion, the more reasonable reading of
this third item is that it is meant to encompass any State or local statutes, rules, or ordinances
that, like the TCPA and the CAN-SPAM Act, regulate methods of communication.

-8-
¶ 44 We are also unconvinced by West Bend’s argument that the exclusion was meant to apply
to statutes that “lend themselves to class action litigation [and] pose serious insurance risks.”
Nothing in the exclusion’s language suggests that was the purpose of the exclusion; if West
Bend wanted the exclusion to have such an application, it could have written it so. As we stated
above, “[t]here is a strong presumption against provisions that easily could have been included
in the contract but were not.” Wright, 196 Ill. App. 3d at 925.
¶ 45 In short, the violation of statutes exclusion applies to bar coverage to violations of statutes
that regulate methods of communication. The Act says nothing about methods of
communication. It instead regulates “the collection, use, safeguarding, handling, storage,
retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g) (West
2014). As Ms. Sekura’s complaint alleges a violation of the Act, this exclusion does not apply
to bar coverage to Krishna.

¶ 46 3. We Need Not Reach the Data Compromise Endorsement Issue
¶ 47 Because Ms. Sekura’s allegations against Krishna potentially fall within the policies’
definition of “personal injury” and the violation of statutes exclusion does not apply to bar
coverage, we need not consider whether the data compromise endorsement would also provide
coverage. West Bend has a duty to defend Krishna against Ms. Sekura’s lawsuit, and the circuit
court correctly granted summary judgment in favor of defendants on that issue.

¶ 48 B. Krishna’s Cross-Appeal
¶ 49 On cross-appeal, Krishna argues that the circuit court erred in finding that West Bend did
not violate section 155 of the Insurance Code (215 ILCS 5/155 (West 2016)). Initially, the
parties disagree about the standard of review on this issue. Krishna argues that we should
review this issue de novo, while West Bend argues that an abuse of discretion standard should
be used. As we recently recognized in Evergreen Real Estate Service, LLC v. Hanover
Insurance Co., 2019 IL App (1st) 181867, ¶¶ 34-35, Illinois courts have used both standards
in reviewing section 155 rulings. See id. (and cases cited therein). Like the Evergreen court,
however, we need not decide which standard of review is appropriate because, here, under
either standard, we find the circuit court did not err in denying Krishna’s request for relief
under section 155.
¶ 50 Section 155 provides “that an insured may collect attorney fees and costs where an insurer
creates a ‘vexatious and unreasonable’ delay in settling a claim.” Illinois Founders Insurance
Co. v. Williams, 2015 IL App (1st) 122481, ¶ 31 (quoting 215 ILCS 5/155(1) (West 2010)).
When deciding whether an insurer’s conduct was vexatious and unreasonable, “[a] court
should consider the totality of the circumstances” “including the insurer’s attitude, whether the
insured was forced to sue to recover, and whether the insured was deprived of the use of his
property.” (Internal quotation marks omitted.) Id. But where a bona fide coverage dispute
exists, section 155 costs and sanctions are inappropriate. Id. ¶ 32. A bona fide dispute “is one
that is real, actual, genuine, and not feigned.” (Internal quotation marks omitted.) Id. If an
insurer reasonably relied upon such a bona fide dispute, that insurer did not act vexatiously or
unreasonably. Id.
¶ 51 On appeal, Krishna only argues for section 155 damages based on the data compromise
endorsement, apparently conceding that West Bend’s other defenses to coverage, while not

-9-
 successful, were bona fide. Neither the circuit court nor this court have considered the issue of
whether coverage is even available under the endorsement.
¶ 52 Under the endorsement, coverage is provided for a civil suit based on a “personal data
compromise.” The endorsement defines “personal data compromise” as “the loss, theft,
accidental release or accidental publication of ‘personally identifying information’ or
‘personally sensitive information.’ ” The endorsement also provides that “personal data
compromise” “includes disposal or abandonment of ‘personally identifying information’ or
‘personally sensitive information’ without appropriate safeguards such as shredding or
destruction.” The endorsement also states that “[t]he failure to use appropriate safeguards must
be accidental and not reckless or deliberate.” The endorsement does not define “accidental,”
but the parties point out that the term “accident” has been consistently defined by Illinois courts
as “an unforeseen occurrence.” Aetna Casualty & Surety Co. v. Freyer, 89 Ill. App. 3d 617,
619 (1980).
¶ 53 Krishna now argues that there is no bona fide defense to coverage under this endorsement.
Krishna’s articulation as to why the endorsement provides coverage was not put forward until
its reply brief on the cross-appeal. For that reason alone, we could disregard it. See Ill. S. Ct.
R. 341(h)(7) (“points not argued are forfeited and shall not be raised in the reply brief”). We
choose to address this argument, as forfeiture is a limitation on the parties, not on the court.
City of Highland Park v. Bryan, 2019 IL App (2d) 180662, ¶ 19. But we note that Krishna’s
delay in articulating this understanding of the endorsement undermines any suggestion this is
an obvious and irrefutable interpretation of the endorsement.
¶ 54 Krishna’s argument for coverage under the endorsement is that Ms. Sekura’s complaint
alleges a “personal data compromise” by “disposal” of Ms. Sekura’s personally identifying or
personally sensitive information to SunLync without appropriate safeguards. According to
Krishna, the appropriate “safeguards” would have been following the data protection
requirements of the Act, and the complaint alleges that the negligent failure to take note of
changes in the law was “accidental.”
¶ 55 Krishna’s interpretation of the endorsement hinges on an interpretation of disposal as
including the deliberate sharing of Ms. Sekura’s data with SunLync. It also would require an
interpretation that “safeguards such as shredding or destruction” includes following new legal
requirements. A court would have to also find that “accidental” means the failure to keep up
on the law. None of these interpretations are necessarily correct and West Bend has compelling
arguments to the contrary.
¶ 56 For example, West Bend argues that there is nothing in Ms. Sekura’s complaint that
suggests that the lack of safeguards in this transfer of her biometric information was
“accidental.” Instead, as West Bend points out, Krishna was alleged to have collected and used
Ms. Sekura’s biometric data as part of its membership program, and thus, there was nothing
“unforeseen” about it. Certainly, keeping up on the law is different than shredding or
destroying confidential data so it is not at all clear that following the Act is a “safeguard” in
the sense that word is used in the endorsement. In short, there is nothing in this interpretation
that is so compelling that it renders West Bend’s defense frivolous or without merit. It is clear
to us that West Bend has a bona fide argument for why the endorsement does not apply.
Therefore, fees, costs, and damages under section 155 are not appropriate.

- 10 -
¶ 57 IV. CONCLUSION
¶ 58 Ms. Sekura’s allegations that Krishna violated the Act when it provided her fingerprint data
to a third party potentially fall within the policies’ definition of “personal injury,” and Krishna
is not barred from coverage by the violation of statutes exclusion. West Bend thus has a duty
to defend Krishna in the underlying lawsuit. Additionally, there is a bona fide dispute as to
whether Krishna would be entitled to coverage under the data compromise endorsement;
therefore, Krishna is not entitled to damages under section 155 of the Insurance Code. We
affirm the judgment of the circuit court—both in granting summary judgment in favor of
defendants on the duty to defend issue and in favor of West Bend on the section 155 issue.

¶ 59 Affirmed.

- 11 -