In Citizens Insurance Co. of America v. Mullins Food Products, Inc., No. 24-1524, 2025 U.S. App. LEXIS 10682 (7th Cir. May 2, 2025), the Seventh Circuit Court of Appeals vacated the United States District Court for the Northern District of Illinois’s decision, holding that the Access or Disclosure Exclusion unambiguously bars coverage for claims arising from violations of the Illinois Biometric Information Privacy Act (“BIPA”), while the Statutory Violations Exclusion does not. In the underlying case, a former Mullins employee sued for violations of BIPA, alleging Mullins scanned its employees’ fingerprints and in turn disseminated the biometric data obtained to third-party vendors without informing its employees or obtaining consent to disseminate such data (the “Galan Lawsuit”). The District Court held that both exclusions within the Citizens policies applied to bar coverage, and Mullins appealed following the Seventh Circuit’s decision in Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., 102 F.4th 438, (7th Cir. 2024).
The Seventh Circuit first addressed the Access or Disclosure Exclusion found within the 2016 and 2017 Citizen policies, which precluded coverage for any claim "arising out of any access to or disclosure of any person's or organization's confidential or personal information." The list of information qualifying as confidential or personal included, in relevant part, “any other type of nonpublic information." The Seventh Circuit found that this exclusion was straightforward and explicit, and the ordinary understanding of an individual's "confidential or personal information" plainly includes their biometric identifiers. Thus, the Court held that the exclusion precludes coverage for BIPA claims, and Citizens did not owe Mullins a duty to defend or indemnify under the 2016 and 2017 policies.
Because the 2015 Citizens policy did not include the Access or Disclosure Exclusion, the Seventh Circuit next analyzed whether the Statutory Violations Exclusion found within the 2015 Citizens policy applied to preclude coverage. In this exclusion, violations of the TCPA, the CAN-SPAM Act of 2003, and the FCRA are expressly excluded from coverage. The exclusion also ends with a broad catchall that purports to exclude coverage for violations of "[a]ny federal, state or local statute, ordinance or regulation, other than the [three federal statutes listed] that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.” The Seventh Circuit, applying Thermoflex, determined that the court must look at the statutes expressly identified immediately preceding the catchall to properly understand the scope of the catchall. The Court found that the TCPA, CAN-SPAM Act, and the FRCA are patently different in kind from BIPA such that the catchall provision does not include BIPA violations. Therefore, the Seventh Circuit held that, assuming there was timely notice, Citizens owed Mullins a duty to defend the Galan Lawsuit and indemnify Mullins insofar as the suit implicated the 2015 Citizens policy.
The Seventh Circuit further vacated the entry of summary judgment against Mullins on their breach of contract counterclaim. Thus, if the notice issue is resolved in Mullins’ favor, confirming Citizens owed Mullins a duty to defend the Galan Lawsuit under the 2015 Citizens policy, and Citizens will be liable for the costs and fees Mullins incurred in defending itself in Galan. However, the Court clarified that estoppel is off the table.