Clarifying Insurer Duty to Defend BIPA Claims: Access or Disclosure vs. Statutory Violations Exclusions

Introduction

This commentary examines Citizens Insurance Company of America v. Mullins Food Products, Inc., a 2025 decision by the Seventh Circuit clarifying how two distinct policy exclusions interact with Illinois’ Biometric Information Privacy Act (BIPA). Plaintiff‐appellee Citizens Insurance sought a declaration that it owed no duty to defend or indemnify Mullins—defendant‐appellant—in a putative class action alleging BIPA violations. The underlying class suit accused Mullins of scanning and disclosing employees’ fingerprints without written consent or a published biometric‐data policy. Citizens declined the tender of defense, citing two exclusions in its 2015–2017 commercial general liability policies: (1) the “Access or Disclosure of Confidential or Personal Information” exclusion, and (2) the “Recording and Distribution of Material or Information in Violation of Law” (Statutory Violations) exclusion.

Summary of the Judgment

The Seventh Circuit vacated the district court’s grant of summary judgment for Citizens and remanded with these holdings:

The Access or Disclosure exclusion (found only in the 2016 and 2017 policies) unambiguously bars coverage for BIPA claims because biometric identifiers are quintessentially “confidential or personal … nonpublic information.”
The Statutory Violations exclusion (present in the 2015–2017 policies) does not unambiguously exclude BIPA claims. Applying the Illinois Supreme Court’s decision in West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., and the ejusdem generis canon, the court held that the catchall clause must be limited to statutes of the same general kind as those expressly named (e.g., TCPA, CAN-SPAM Act, FCRA), which regulate methods of communication or credit reporting—unlike BIPA’s biometric‐privacy framework.
Accordingly, Citizens owes Mullins a defense (and ultimately indemnification) under the 2015 policy, assuming Mullins gave timely notice of the suit. The notice issue was remanded for the district court to decide.
Civil estoppel does not apply because Citizens promptly filed a declaratory‐judgment action. Nevertheless, if Citizens is found to have owed Mullins a defense, it must reimburse the fees and costs Mullins incurred while defending itself.

Analysis

Precedents Cited

Citizens Ins. Co. v. Wynndalco Enters., LLC (7th Cir. 2023) – Held a materially similar statutory‐violation exclusion ambiguous under Illinois law because a plain‐text reading would “swallow” coverage for numerous statutory privacy claims.
Nat’l Fire Ins. Co. v. Visual Pak Co. (Ill. App. Ct. 2023) – Distinguished Wynndalco, finding no swallowing problem (common‐law privacy remedies remain) and reading the exclusion as privacy‐focused based on its heading and statutory context, thus unambiguously barring BIPA claims.
West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc. (Ill. 2021) – Interpreted a similar exclusion by limiting the catchall to statutes of the same kind as the TCPA and CAN-SPAM Act (i.e., communications statutes), excluding BIPA.
Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. (7th Cir. 2024) – Followed Krishna to hold that the statutory‐violation exclusion does not unambiguously bar BIPA claims, but that an Access or Disclosure exclusion does.
General Star Indemnity Co. v. Lake Bluff Sch. Dist. No. 65 (Ill. App. Ct. 2004) – Awarded defense costs to an insured when the insurer was found contractually obliged to defend after filing a declaratory action.
Those Certain Underwriters at Lloyd’s v. Prof’l Underwriters Agency, Inc. (Ill. App. Ct. 2006) – Held an insurer’s duty to defend is suspended once it files a declaratory‐judgment suit, but acknowledged that if the insurer loses, it must pay the insured’s defense costs.

Legal Reasoning

The court employed well‐established canons of insurance‐policy interpretation under Illinois law:

Plain‐text analysis: The Access or Disclosure exclusion’s language—“any … disclosure of … confidential or personal information … any other type of nonpublic information”—plainly encompasses biometric data.
Avoidance of “swallowing”: In Wynndalco, a literal reading of the statutory‐violation exclusion threatened to eliminate coverage for a broad swath of personal and advertising injuries. Visual Pak and Krishna showed how to limit the catchall through ejusdem generis, avoiding a coverage‐vs. exclusion conflict.
Ejusdem generis: Construed “other … statutes” to mean statutes of the same general kind as those named immediately before—TCPA, CAN-SPAM, FCRA (communications and credit‐reporting statutes)—not BIPA.
Estoppel and duty to defend: While an insurer that neither defends nor seeks a declaratory judgment may be estopped from raising coverage defenses, an insurer who files promptly preserves its contractual defenses. Nonetheless, if the insurer is ultimately held to owe a defense, it must reimburse the insured’s defense expenses.

Impact

This decision brings clarity to insurers and insureds in Illinois and elsewhere:

Policy drafters will know that a standalone “Access or Disclosure” exclusion will unambiguously bar coverage for biometric‐privacy claims under BIPA and similar statutes.
Insurers relying on sweeping “statutory violations” exclusions must tailor their language or risk ambiguity if they intend to exclude BIPA‐type claims. They should specifically name biometric‐privacy statutes.
Counsel representing insureds can confidently challenge blanket statutory‐violation exclusions that lump BIPA in with communications and credit‐reporting statutes.
The case reinforces the importance of timely notification to insurers and the strategic use of declaratory‐judgment actions to preserve coverage defenses without risking estoppel.

Complex Concepts Simplified

BIPA: Illinois law restricting how private entities collect, store, use, and share biometric identifiers (e.g., fingerprints, iris scans). Requires written consent and a public data‐retention policy.
Access or Disclosure Exclusion: Bars coverage for any claim “arising out of … disclosure of … confidential or personal … nonpublic information.” Biometric data is nonpublic personal information.
Statutory Violations Exclusion: Excludes personal‐injury claims arising out of named federal statutes (TCPA, CAN-SPAM, FCRA) and “any other” statute regulating printing, distribution, collection, or communication of information. Under ejusdem generis, “other” must be statutes like those named—communications‐ or credit‐reporting statutes—not BIPA.
Swallowing principle: If an exclusion’s plain text eliminates coverage for everything the policy otherwise covers, the exclusion is ambiguous and construed against the insurer.
Duty to defend vs. estoppel: An insurer must either defend under a reservation of rights or seek declaratory relief. If it does neither, it may be estopped from denying coverage later. Filing for declaratory relief suspends—but does not eliminate—its duty to reimburse defense costs if it loses.

Conclusion

Citizens Insurance Company of America v. Mullins Food Products, Inc. underscores two key principles in insurance coverage for BIPA claims under Illinois law:

An explicit “Access or Disclosure of Confidential or Personal Information” exclusion will unambiguously bar defense and indemnity for biometric‐privacy violations.
A broad “Statutory Violations” exclusion must be limited by ejusdem generis to the same genre of statutes expressly named; without specific mention of biometric‐privacy laws, such an exclusion does not clearly preclude coverage for BIPA claims.

Applying these principles, Citizens owes Mullins a defense under its 2015 policy but owes no duty under the 2016 and 2017 policies. The case also reconfirms that insurers may preserve coverage defenses by promptly seeking declaratory relief, yet remain liable to reimburse insureds for defense costs if those defenses fail.