In the

    United States Court of Appeals
                 For the Seventh Circuit
                     ____________________
No. 24-1524
CITIZENS INSURANCE COMPANY
OF AMERICA,
                                                   Plaintiff-Appellee,

                                 v.

MULLINS FOOD PRODUCTS, INC.,
                                               Defendant-Appellant.
                     ____________________

         Appeal from the United States District Court for the
           Northern District of Illinois, Eastern Division.
            No. 1:22-cv-01334 — Jorge L. Alonso, Judge.
                     ____________________

     ARGUED OCTOBER 28, 2024 — DECIDED MAY 2, 2025
                ____________________

   Before ROVNER, BRENNAN, and KOLAR, Circuit Judges.
    ROVNER, Circuit Judge. This is yet another of the many in-
surance coverage disputes presenting the interplay between
claims against an insured for violations of Illinois’ Biometric
Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq., and
various exclusions in the insured’s commercial liability insur-
ance policy. The insured in this case, defendant-appellant
Mullins Food Products, Inc. (“Mullins”) was sued in Illinois
2                                                    No. 24-1524

state court for violating BIPA. Mullins tendered defense of the
suit to its liability insurer, Citizens Insurance Company of
America (“Citizens”), but Citizens declined to defend Mul-
lins. Instead, Citizens filed this federal suit seeking a declara-
tory judgment that it has no duty to defend or indemnify Mul-
lins based on two different exclusions in the commercial lia-
bility insurance policies Citizens issued to Mullins in 2015,
2016, and 2017. While this suit was pending, Mullins settled
the state-court action. The district court ultimately agreed
with Citizens that the policy exclusions for the Access Or Dis-
closure Of Confidential Or Personal Information (the “Access
or Disclosure” exclusion) and the Recording And Distribution
Of Material Or Information In Violation Of Law (the “Statu-
tory Violations Exclusion”) relieved Citizens of the duty to
defend or indemnify Mullins. Citizens Ins. Co. of Am. v. Mullins
Food Prods., Inc., 

 (N.D. Ill. 2024); R. 98.
     We vacate and remand for further proceedings. We con-
clude that the Access or Disclosure Exclusion, found only in
the 2016 and 2017 policies issued to Mullins, bars coverage for
BIPA claims, but the Statutory Violation Exclusion, found in
all three of the policies, does not. Assuming that Mullins com-
plied with the duty to provide notice of the state-court action
to Citizens “as soon as practicable”—a matter that remains to
be decided on remand—Citizens will have been obliged to de-
fend and indemnify Mullins in the state litigation pursuant to
the 2015 policy and will be liable to reimburse Mullins for its
fees and costs in defending that action.
                                I.
   As relevant here, BIPA imposes restrictions on how a pri-
vate employer may collect, retain, and disclose an individ-
ual’s biometric identifiers, including fingerprints, retina or
No. 24-1524                                                    3

iris scans, voiceprints, and scans of hand or face geometry.
Among other requirements, an employer must obtain a
worker’s written consent to collection of his biometric identi-
fiers, may not distribute such data without the employee’s
consent, and must have a written plan regarding the retention
and elimination of such data. 740 ILCS 14/15; see Citizens Ins.
Co. of Am. v. Wynndalco Enters., LLC, 

, 991–93 (7th
Cir. 2023).
    Mullins is a food ingredient manufacturer with a plant in
Broadview, Illinois, employing 503 individuals. In 2018, Mul-
lins was acquired by Newly Wed Foods, Inc., an international
firm which has some 25 to 30 plants worldwide; Newly Wed
is headquartered in Chicago.
    Mullins scanned its employees’ fingerprints in order to
help monitor and manage its workers’ time on the job. Mul-
lins in turn allegedly disseminated electronic information de-
rived from scanning its employees’ biometric identifiers to
third-party vendors for timekeeping, data storage, and pay-
roll purposes. In contravention of BIPA, Mullins allegedly did
not formally inform its employees that it was collecting and
disseminating their biometric identifiers, it did not obtain
their written consent to do so, and it did not draft and publish
a policy regarding how such biometric information would be
collected, used, stored, or disseminated.
    In February 2021, Ricardo Galan, a former Mullins em-
ployee, filed a putative class action against Mullins in the Cir-
cuit Court of Cook County seeking damages for the com-
pany’s BIPA violations. Not until January 2022 was Citizens,
Mullins’ commercial liability insurer, given notice of a claim
under the terms of the insurance policies in force during the
relevant time period.
4                                                            No. 24-1524

    In March 2022, Citizens filed this action seeking a declara-
tion that it has no duty to defend or indemnify Mullins
against the Galan lawsuit. Mullins in turn filed an answer and
counterclaim seeking a contrary declaration. Count II of Mul-
lins’ counterclaim alleges that Citizens breached the insur-
ance policies by not providing a defense for Mullins in the Ga-
lan lawsuit and seeks an award of the costs and attorney’s fees
it bore in defending the suit on its own. Mullins settled with
the Galan plaintiffs in 2024, so its fees and costs presumably
are now a fixed number. See Galan v. Mullins Food Prods., Inc.,
No. 2021-CH-00898, Order Granting Final Approval to Class
Action Settlement and Final Judgment (Cir. Ct. Cook Cnty.
Oct. 2, 2024), reproduced at https://mullinsbipasettle-
ment.com/media/5062204/mlgl_order_granting_final_ap-
proval_to_class_action_settlement_and_final_judgment.pdf
[https://perma.cc/XQ9E-MDKF] (visited May 2, 2025).
   There are three Citizens insurance policies at issue in this
case, each effective for a period of one year beginning on
March 24; the first became effective on March 24, 2015, and
the last expired on March 24, 2018. For the sake of simplicity,
we will refer to these as the 2015, 2016, and 2017 policies.
    “Coverage B” in each of the three policies purported to
give Mullins liability coverage for a “personal and advertising
injury” (R. 1-1 at 167, 403, 686) which was expressly defined
to include, among other things, “[o]ral or written publication,
in any manner, of material that violates a person’s right of pri-
vacy” (R. 1-1 at 175, 412, 695). 1 Thus, in the absence of an

    1 Also covered as personal and advertising injuries are injuries arising

out of false arrest, detention, or imprisonment; malicious prosecution;
wrongful eviction from a personal residence by or on behalf of a landlord;
                                                              (continued)
No. 24-1524                                                              5

applicable exclusion, the policies would provide coverage for
the injuries alleged in the Galan lawsuit, as BIPA violations
are, essentially, privacy violations. West Bend Mut. Ins. Co. v.
Krishna Schaumburg Tan, Inc., 

. Citizens
would therefore have a duty to defend Mullins in the Galan
litigation.
   However, each of the three policies also includes one or
more exclusions that, in Citizens’ view, foreclose coverage of
the claims made in the Galan litigation and relieve it of the
duty to provide Mullins with a defense.
   The Access or Disclosure Exclusion bars coverage for a
personal and advertising injury
        arising out of any access to or disclosure of any
        person’s or organization’s confidential or per-
        sonal information, including patents, trade se-
        crets, processing methods, customer lists, finan-
        cial information, credit card information, health
        information or any other type of nonpublic in-
        formation.
R. 1-1 at 421, 712. Again, the Access or Disclosure Exclusion
was included (by endorsement) only in the 2016 and 2017 po-
lices; it was not included in the 2015 policy.




oral or written publication of material that slanders or libels a person or
organization or disparages a person’s or organization’s goods, products,
or services; use of another’s advertising idea in an advertisement; and in-
fringing upon another’s copyright, trade dress, or slogan in an advertise-
ment. R. 1-1 at 175, 412, 695.
6                                                 No. 24-1524

    As noted, the Statutory Violations Exclusion was included
in all three policies. This is a somewhat more complex exclu-
sion; it excludes coverage for:
      “Personal and advertising injury” arising di-
      rectly or indirectly out of any action or omission
      that violates or is alleged to violate:

      (1) The Telephone Consumer Protection Act
      (TCPA), including any amendment of or addi-
      tion to such law;

      (2) The CAN-SPAM Act of 2003, including any
      amendment of or addition to such law;

      (3) The Fair Credit Reporting Act (FCRA), and
      any amendment of or addition to such law, in-
      cluding the Fair and Accurate Credit Transac-
      tions Act (FACTA); or

      (4) Any federal, state or local statute, ordinance
      or regulation, other than the TCPA, CAN-
      SPAM Act of 2003 or FCRA and their amend-
      ments and additions, that addresses, prohibits,
      or limits the printing, dissemination, disposal,
      collecting, recording, sending, transmitting,
      communicating or distribution of material or in-
      formation.
R. 1-1 at 178, 404, 687. Citizens reads this exclusion to unam-
biguously exclude coverage for the BIPA claims asserted in
Galan, in that such claims involve the collecting, recording,
and dissemination of a person’s biometric “information.”
    Our decision in Wynndalco, however, found a version of
this exclusion similar (though not identical) to the one
No. 24-1524                                                                 7

presented in this case not to foreclose the insurer’s duty to de-
fend its insured against a BIPA claim. 2 We acknowledged that
although it was possible to read the catchall language in iso-
lation to include BIPA claims, as well as a wide range of other
statutory claims, such a reading would also nullify or “swal-
low” a substantial portion of the coverage that the policy pur-
ported to provide for personal and advertising injuries. 70
F.4th at 997–98. It was not possible to avoid that problem by
construing the exclusion to reach only statutory causes of ac-
tion relating to privacy: There was no hint of privacy any-
where in the language of the exclusion, and to narrow the ex-
clusion in this way would presume that the exclusion’s other-
wise sweeping language meant something other than what it
said. 

 at 998–99. For that reason, we treated the catchall ex-
clusion as ambiguous. Id. at 999. Resort to the doctrines of
ejusdem generis and noscitur a sociis did not resolve the ambi-
guity, as there was no readily discernible theme among the
three statutes cited immediately prior to the catchall—includ-
ing Citizens’ posited theme of privacy—that would suggest

    2  There are two differences between the exclusion at issue in
Wynndalco and the one presented in this case. First, the catchall provision
of the Wynndalco exclusion lacked the “other than” clause referencing the
statutes cited by name immediately prior to the catchall provision; in
Wynndalco, the catchall simply referenced “[a]ny other laws, statutes, ordi-
nances, or regulations, that address, prohibit or limit the printing, dissem-
ination, disposal, collecting, recording, sending, transmitting, communi-
cating or distribution of material or information.” 

 (empha-
sis added). Second, whereas the heading of the exclusion in this case refers
to the “Recording and Distribution of Material or Information in Violation
of Law,” the exclusion in Wynndalco referred more generically and broadly
to the “Distribution of Material in Violation of Statutes.” See 

 Apart from
those differences, the two catchall provisions are materially identical.
8                                                     No. 24-1524

how the scope of the broad catchall provision could be con-
strued in a way that was consistent with the terms of the over-
all exclusion and yet did not eliminate a broad swath of the
coverage that the policy otherwise ostensibly provided for
personal and advertising injuries. 

 at 1000–04. We therefore
construed the provision in the insured’s favor and held that
Citizens had a duty to defend the insured. 

 at 1004–05.
    Initially, the district court in this case rejected Citizens’
contention on summary judgment that the Access or Disclo-
sure Exclusion and the Statutory Violations Exclusion re-
lieved it of the duty to defend Mullins. Citizens Ins. Co. of Am.
v. Mullins Food Prods., Inc., 

 (N.D. Ill. 2023);
R. 61. The court deemed our Wynndalco decision to “directly
control[ ]” as to the Statutory Violations Exclusion and found
that exclusion to be ambiguous. R. 61 at 15. The court likewise
found the Access or Disclosure Exclusion (which was not ad-
dressed in Wynndalco) to be ambiguous. R. 16 at 16–22. As to
the question of whether Mullins had provided timely notice
of the Galan lawsuit to Citizens, the court concluded that there
were disputes of material fact that precluded summary judg-
ment. R. 16 at 26–28. Resolution of Citizens’ duty to defend
Mullin in the Galan litigation would thus have to wait until a
trial could be conducted on the notice issue. However, the
court did enter summary judgment against Mullins on its
counterclaim for breach of contract, reasoning that Citizens’
timely commencement of this declaratory judgment action
precluded a finding that Citizens had breached its duty to de-
fend Mullins even if the court were ultimately to conclude
that Citizens owed Mullins a defense in the Galan suit. R. 61
at 29–31.
No. 24-1524                                                     9

    However, based on the Illinois Appellate Court’s interven-
ing decision in Nat’l Fire Ins. Co. of Hartford v. Visual Pak Co.,

, app. denied, 

 (Ill. 2024),
the district court subsequently reconsidered its decision and
granted summary judgment to Citizens, concluding that both
the Statutory Violations Exclusion and the Access or Disclo-
sure Exclusion barred coverage for BIPA claims and thus re-
lieved Citizens of the obligation to defend Mullins. R. 98.
    In Visual Pak, the Illinois Appellate Court disagreed with
our application of the “swallowing” principle in Wynndalco.
That principle only applies, the court said, when an exclusion
truly eliminates all of the coverage provided elsewhere in the
policy. Id. ¶¶ 84, 96. Thus, if one reads the catchall provision
literally and broadly to include violations of statutory privacy
protections, the result would be to bar coverage for BIPA
claims, yes, but it would still leave coverage in place for com-
mon law violations arising from an invasion of one’s privacy.
Id. ¶¶ 99–100; see also Thornley v. Clearview AI, Inc., 

 (7th Cir. 2021) (Hamilton, J., concurring) (noting
that injuries in cases alleging BIPA violations “would be com-
parable to injuries in invasion-of-privacy and unjust enrich-
ment that the law has long recognized”). The same could be
said for other types of personal and advertising injuries for
which the policy provided coverage: statutory violations
might be excluded from coverage by dint of a plain-text read-
ing of the catchall, but violations of common law rights would
remain covered. 2023 Ill. App. (1st) 221160 ¶¶ 104–05. Thus, a
broad reading of the exclusion would not “swallow” the cov-
erage provided for in the personal and advertising injury pro-
vision, and thus did not render the policy ambiguous. And
although the court appeared to acknowledge that Wynndalco
might possibly be right in positing that some forms of
10                                                  No. 24-1524

personal and advertising injuries, like copyright violations,
could only be redressable through statutory causes of actions
(with no common law counterparts)—the court observed that
those types of injuries were not related to privacy and were
not at issue in the case before it and as such did not need to
be considered. 

 ¶¶ 112–121.
    Visual Pak went on to reason that there was also a more
focused understanding of the catchall that would nonetheless
bar coverage for BIPA claims. The insurer in Visual Pak, like
the insurer in Wynndalco, argued that the common thread
among the three statutes cited by name immediately preced-
ing the catchall is privacy, such that the catchall itself should
be construed to reach only injuries arising out of statutory pri-
vacy violations. We, of course, had rejected that argument in
Wynndalco, whether as a plausible narrowing construction of
the Statutory Violations Exclusion in order to avoid an ambi-
guity or as an application of ejusdem generis to resolve such
ambiguity. 70 F.4th at 998–99, 1002–04. We noted, inter alia,
that reading a policy gloss into the exclusion required a fairly
nuanced analysis and understanding of the various statutes
cited by name in the exclusion that would be beyond the com-
prehension of the ordinary commercial insured. 

 at 1003–
04. Not so, said the court in Visual Pak. “[W]e [do not] deem it
especially sophisticated for an insured purchasing this busi-
ness liability insurance to understand that these groups of
statutes touch on various aspects of an individual's personal
privacy, though not precisely in the same way.” 2023 Ill. App.
(1st) 221160 ¶ 70. The Visual Pak court went on to note that the
heading of the exclusion there referred specifically to the “Re-
cording and Distribution of Material or Information in Viola-
tion of Law” (emphasis added) rather than simply to the “Dis-
tribution of Material in Violation of Statutes” as was the case
No. 24-1524                                                    11

in Wynndalco. Id. ¶ 71. “That is no small difference” in terms
of signaling that the exclusion was focused on privacy. ¶ 72.
The court added that some terms in the catchall provision of
the exclusion—including in particular the “disposal, collect-
ing, and recording” of material or information—“only make
sense in the context of the secrecy element of privacy.” Id.
¶ 73. Thus, in view of what the court found to be the shared
thread of privacy among the three statutes cited by name in
the exclusion, the heading of the exclusion, and the terms
used in the catchall provision of the exclusion, it was “not un-
reasonable at all” to construe the catchall to reach privacy-re-
lated statutes like BIPA. Id. ¶ 73.
    Following Visual Pak’s lead, the district court on reconsid-
eration concluded that the catchall provision of the Statutory
Violations Exclusion should be understood to exclude cover-
age for injuries arising from BIPA violations. First, the court
noted that our own decision in Wynndalco and the state court’s
decision in Visual Pak agreed that a literal, plain-text reading
of the catchall provision would reach BIPA violations. R. 98 at
17. Second, as in Visual Pak, the heading of the exclusion in
this case—“Recording And Distribution Of Material Or Infor-
mation In Violation Of Law”—is worded in such a way as to
suggest that the exclusion overall is aimed at privacy-related
violations. R. 98 at 17. Third, reading the exclusion, including
the catchall, as being privacy-focused obviates the need to re-
sort to ejusdem generis or other interpretive canons. R. 98 at 18.
Fourth, by limiting the exclusion to violations of the named
statutes and other privacy-related violations, one avoids the
potential “swallowing” problem that we referenced in
Wynndalco. R. 98 at 18–20.
12                                                  No. 24-1524

    The court relied on Visual Pak to further conclude that the
Access or Disclosure Exclusion likewise bars coverage for in-
juries arising from BIPA violations. Looking a second time at
the Access or Disclosure Exclusion in light of Visual Pak, the
court concluded that this exclusion unambiguously excludes
coverage for gathering or disclosing an individual’s biometric
identifiers or information. The exclusion reaches injuries aris-
ing from “any access to or disclosure of any person’s … con-
fidential or personal information … .” The policies do not de-
fine “personal information,” but “it takes no stretch of the im-
agination to find that it would include information typically
kept private.” R. 98 at 22. Although the subsequent list of ex-
amples in the policy omits mention of fingerprints or other
biometric information, such information, like one’s financial
and health information, is another aspect of one’s private data
and information. R. 98 at 23. Finally, reading the Access or
Disclosure Exclusion to reach injuries resulting from BIPA vi-
olations would again not present the “swallowing” problem
with which we were concerned in Wynndalco. R. 98 at 28.
    Having now concluded that both of the two foregoing ex-
clusions reached BIPA claims, the district court found that
Citizens had no duty to defend or indemnify Mullins in the
Galan litigation. The court vacated its prior ruling on the ques-
tion of whether Mullins had given Citizens timely notice of
the Galan suit (which found that disputes of material fact pre-
cluded summary judgment), given that its new ruling as to
the exclusions rendered the notice question moot. R. 98 at 28.
The court declined to reconsider its prior ruling against Mul-
lins on its counterclaim for breach of contract. R. 98 at 28–29.
   After the district court’s reconsideration decision in favor
of Citizens, this court in Thermoflex Waukegan, LLC v. Mitsui
No. 24-1524                                                  13

Sumitomo Ins. USA, Inc., 

, 440–41 (7th Cir. 2024),
held that an Access or Disclosure Exclusion identical to the
one in the Citizens policy unambiguously excluded coverage
for BIPA claims. However, the court also found that an exclu-
sion quite similar to the Statutory Violations Exclusion at is-
sue in Visual Pak and in this case did not apply to BIPA claims.

. In reaching that conclusion, the court set aside the
Illinois Appellate Court’s Visual Pak decision and this court’s
Wynndalco decision and instead relied on the Illinois Supreme
Court’s decision in West Bend Mut. Ins. Co. v. Krishna Schaum-
burg Tan, Inc., 

, to conclude that the Statutory
Violations Exclusion did not unambiguously exclude cover-
age for BIPA claims. Thermoflex, 102 F.4th at 441–42.
   Mullins now appeals. It argues first and principally that
we should certify to the Illinois Supreme Court the question
of whether the two policy exclusions at issue in this case ex-
clude coverage for BIPA claims, given the conflicting deci-
sions among federal and state courts as to the proper under-
standing of these exclusions. Alternatively, Mullins urges that
we follow Wynndalco and Thermoflex to find the Statutory Vi-
olations Exclusion here to be ambiguous. As to the Access or
Disclosure Exclusion, Mullins acknowledges that Thermoflex
finds this provision to unambiguously exclude coverage for
BIPA claims, but Mullins criticizes the logic of that decision
and suggests that we overrule Thermoflex in that respect.
    For its part, Citizens urges that we follow Thermoflex and
hold that the Access or Disclosure Exclusion is clear and ex-
cludes coverage for BIPA claims. As to the Statutory Viola-
tions Exclusion, however, Citizens urges us to follow the Illi-
nois Appellate Court’s decision in Visual Pak and to overrule
both Wynndalco and Thermoflex to find that this exclusion also
14                                                  No. 24-1524

unambiguously bars coverage for BIPA claims. Alternatively,
Citizens asks that we affirm on an independent ground that
the district court did not reach, which is the timeliness of Mul-
lins’ notification of the Galan suit.
                               II.
   As we explain below, our recent decision in Thermoflex re-
solves the parties’ dispute as to the clarity of the two exclu-
sions at issue in this case: the Access or Disclosure Exclusion
unambiguously excludes coverage for BIPA claims, whereas
the Statutory Violations Exclusion does not.
    We see no need to extend the litigation further by certify-
ing the proper understanding of either exclusion to the Illinois
Supreme Court. The Access or Disclosure Exclusion is clear
on its face, and we are confident that the Illinois Supreme
Court would find, as we have, that it excludes coverage for
BIPA claims. As for the Statutory Violations Exclusion, this
court in Thermoflex (with the benefit of the Illinois Appellate
Court’s decision in Visual Pak) followed the Illinois Supreme
Court’s own example in Krishna of construing this exclusion
and finding it not to unambiguously exclude coverage for in-
juries resulting from BIPA violations. We have no reason to
think that the Illinois Supreme Court would depart from the
approach it took in Krishna.
    Consequently, Citizens has no duty to defend or indem-
nify Mullins under the 2016 and 2017 policies, each of which
contains the Access or Disclosure Provision; it does, however,
have a duty to defend and indemnify Mullins under the 2015
policy, which lacks the Access or Disclosure Provision and
has only the Statutory Violations Exclusion, which we have
held not to exclude coverage for BIPA claims.
No. 24-1524                                                  15

    This assumes, of course, that Mullins gave timely notice to
Citizens of the Galan litigation. The district court has not yet
reached that question—having vacated its prior ruling on the
notice issue—and so we will remand in order to allow it to do
so.
    Finally, the district court incorrectly granted summary
judgment to Citizens on Mullins’ counterclaim seeking con-
tractual damages for Citizens’ failure to supply Mullins with
a defense in the Galan litigation to date. That Citizens had a
right to file this declaratory action to seek a decision on its
duty to defend does not relieve Citizens of the obligation to
reimburse its insured in the event the court determines that
Citizens owed Mullins a defense and that Mullins gave Citi-
zens timely notice of the Galan suit.
A. The Access or Disclosure Exclusion
    This is the more straightforward of the two policy exclu-
sions at issue in this case. Again, the exclusion bars coverage
for any claim “arising out of any access to or disclosure of any
person’s or organization’s confidential or personal infor-
mation,” and the list of information qualifying as confidential
or personal includes “patents, trade secrets, processing meth-
ods, customer lists, financial information, credit card infor-
mation, health information or any other type of nonpublic infor-
mation.” (Emphasis ours.) This court’s opinion in Thermoflex
finds this exclusion to unambiguously exclude coverage for
BIPA claims, affirming then-District Judge Lee’s decision be-
low on this point.
   As we noted in Thermoflex, Judge Lee reasoned that “the
ordinary understanding of ‘confidential or personal infor-
mation’ includes handprints and other biometric identifiers
16                                                  No. 24-1524

usable for identity theft.” 

. (BIPA itself, Judge
Lee noted, describes biometric identifiers as confidential, i.e.
nonpublic, information. See 

.) We endorsed
that conclusion and went on to reject the insured’s argument
that because patents are expressly identified as one of the
types of information covered by the exclusion, and patents are
public, the clause was ambiguous.
       True, the list contains mismatched items. But
       how does this create ambiguity about either the
       opening phrase (“any person’s or organiza-
       tion’s confidential or personal information”) or
       the catchall “any other type of nonpublic infor-
       mation”)? Sticking one blue item into a list that
       begins “all red items including …” and closes
       “plus anything pink” does not nullify the lan-
       guage’s application to ruby-colored things.

 (citation omitted).
    Finally, although the insured in Thermoflex pointed to this
court’s decision in Wynndalco and contended that a broad
reading of the exclusion threatened to nullify or “swallow”
coverage that the insurance policy purported elsewhere to
provide, we rejected that argument. We acknowledged that
the Illinois Appellate Court’s decision in Visual Pak found that
Wynndalco misapprehended Illinois law on this point. 

. But we saw no need to “try to predict whether the Su-
preme Court of Illinois is more likely to follow Visual Pak than
to follow Wynndalco. It is enough that the exclusion in this pol-
icy does not have the flaw that led to the decision in
Wynndalco. It leaves plenty of room for coverage of the main
insured hazards.” 

No. 24-1524                                                      17

   Thermoflex leaves no doubt that the Access or Disclosure
Exclusion bars coverage for BIPA claims. Mullins criticizes
the decision and argues that it is inconsistent with the inter-
pretive approach we took in Wynndalco, but it is enough to say
here that Wynndalco did not address the Access or Disclosure
Exclusion—it was not presented in that case.
    This exclusion is straightforward and explicit, and the or-
dinary understanding of an individual’s “confidential or per-
sonal information” plainly includes their biometric identifi-
ers. Thermoflex, 102 F.4th at 440–41. As there can be no reason-
able doubt that the exclusion excludes coverage for BIPA
claims, Citizens does not owe Mullins a duty of defense or
indemnification in the Galan litigation under the 2016 and
2017 policies.
B. The Statutory Violations Exclusion
    A question remains as to whether Citizens owes Mullins a
duty of defense under the 2015 policy, which does not include
the Access or Disclosure Exclusion. The 2015 policy does in-
clude the Statutory Violations Exclusion, which the district
court ultimately found to bar coverage for BIPA claims and
relieve Citizens of a duty to defend.
    What makes this provision more challenging to construe
is that it lists several statutory violations that are expressly ex-
cluded by name from coverage (violations of the Telephone
Consumer Protection Act, CAN-SPAM Act, and the Fair
Credit Reporting Act) but then concludes with a broad
catchall that purports to exclude coverage for violations of
“[a]ny federal, state or local statute, ordinance or regulation,
other than the [three federal statutes listed previously] that
addresses, prohibits, or limits the printing, dissemination,
18                                                  No. 24-1524

disposal, collecting, recording, sending, transmitting, com-
municating or distribution of material or information.”
    Wynndalco, as we have noted, found the catchall to be am-
biguous in large part because a plain-text reading of the ex-
clusion in isolation would purport to exclude or “swallow”
coverage for a large swath of statutory claims—including, but
not limited to, BIPA privacy claims (see n.1, supra) —that Cov-
erage B of the policy would lead an insured to believe were
covered by the policy as claims for personal and advertising
injuries.
    The Illinois Appellate Court’s decision in Visual Pak, of
course, disagreed with our application of the “swallowing”
principle, emphasizing that even a broad understanding of
the exclusion’s catchall provision for statutory violations
would leave a number of corresponding common-law claims
for personal and advertising injuries—including defamation,
commercial disparagement, and as relevant here, invasion of
privacy—covered by the policy. 

,
¶¶ 99–102, 105. But the court also placed a privacy gloss on
the exclusion that significantly narrowed the scope of the
catchall provision and obviated the swallowing concern. 

¶¶ 57–78.
    This court in Thermoflex had the full benefit of the Illinois
court’s decision in Visual Pak as well as our prior decision in
Wynndalco, put both decisions aside, turned to the Illinois Su-
preme Court’s decision in Krishna, and concluded that the
catchall provision of the Statutory Violations Exclusion did
not unambiguously exclude coverage for BIPA violations.
Krishna focused on the statutes expressly mentioned in the ex-
clusion just prior to the final catchall provision—there, the
Telephone Consumer Protection Act (which regulates
No. 24-1524                                                             19

telephone calls and faxes) and the CAN-SPAM Act (which
regulates emails)—and observed that “regulating telephone
calls, faxes, and emails is fundamentally different from regu-
lating the collection, use, storage, and retention of biometric
identifiers and information … .” 

. 3 Apply-
ing the ejusdem generis canon to determine what the catchall
language meant by statutes “other than” the TCPA and CAN-
SPAM Act, the court “construe[d] the ‘other than’ language to
mean other statutes of the same general kind that regulate
methods of communication like the TCPA and the CAN-
SPAM Act.” Id., ¶ 58. BIPA was not such a statute. Id.
    Taking our cue from Krishna, our Thermoflex decision
looked to the statutes cited immediately in advance of the
catchall provision to determine what types of statutory provi-
sions the latter provision was meant to reach. We noted that
the exclusion began with the same two statutes cited by name
in Krishna and added a third: the Fair Credit Reporting Act.

. 4
        One need not get beyond the name of that stat-
        ute to see how different it is from BIPA. In this
        diversity suit, we are bound by the way the Su-
        preme Court of Illinois has treated language
        structured like the Statutory Violation



    3 The heading of the exclusion at issue in Krishna read, “Violation of

Statutes That Govern E-Mails, Fax, Phone Calls or Other Methods of Send-
ing Material or Information.” 

.
    4 The exclusion at issue in Thermoflex was unaccompanied by a head-

ing. See Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., No. 21
C 788, 

, at *6 (N.D. Ill. Jan. 19, 2023).
20                                                           No. 24-1524

          Exclusion, so we agree with the district court
          that this exclusion … does not apply to BIPA.

    Thermoflex leaves no doubt as to how we should read the
catchall provision here. For a proper understanding of the
scope of the catchall, we look to the three statutes expressly
identified immediately preceding (and cited in the “other
than” clause of) the catchall for guidance as to what other
types of statutory violations are subsumed within the
catchall. Krishna noted that the two statutes named in that
case—the TCPA and the CAN-SPAM Act—were unlike BIPA
in that they regulated communications. Here as in Thermoflex,
there is an added third statute—the FCRA—which deals with
how individual’s credit history is reported to third parties
and, as we noted in Thermoflex, is also patently different in
kind from BIPA. Viewed through the lens of Krishna, the
catchall provision does not include BIPA violations. 5


      5 Whereas the exclusion at issue in Thermoflex had no heading, the ex-

clusion here is titled, “Recording And Distribution Of Material Or Infor-
mation In Violation Of Law.” That distinction does not counsel in favor of
a different result. A heading can inform the understanding of the text that
follows, but it cannot broaden the reach of the exclusion. See Wynndalco,

 n.10. Visual Pak found the wording of an identical heading
significant, because one of the multiple meanings of the term “recording”
includes the “inscribing on a tangible medium or sorting in an electronic
or other medium in such a way as to make it retrievable in perceivable
form.” 

. As Visual Pak saw things, this mean-
ing of the term “recording” was a strong indicator that the exclusion was
focused on privacy, because it was suggestive of the collection of biometric
identifiers and information. But the terms “recording” and “distribution”
both have many meanings and potentially could apply to a broad range
                                                                (continued)
No. 24-1524                                                               21

    The Statutory Violations Exclusion therefore does not re-
lieve Citizens of the duty to defend and indemnify Mullins in
the Galan litigation. Assuming that Mullins gave Citizens
timely notice of the litigation (a point we address below), then
Citizens owed Mullins a defense in the Galan suit and must
also indemnify Mullins insofar as the suit implicates the 2015
policy. 6




of information and material, including, for example, the recording and
disseminating (via radio or internet) of a copyrighted piece of music; mak-
ing a digital scan of the drawings and specifications for a patented ma-
chine and emailing them to a competitor of the patent holder; download-
ing the results of an individual’s DNA profile and selling it to medical
researchers; printing a driver’s tollway history and sharing it with law en-
forcement; assembling a consumer’s credit history and transmitting it to
retailers and employers; and so on. Here, what gives us the best indication
of what types of “recording” and “distribution” the catchall provision was
meant to capture are the three statutes identified immediately prior to the
catchall, and those statutes, as Thermoflex recognized, are very different
from BIPA.
    6 For purposes of the settlement with Mullins, the class period was

defined to commence on February 24, 2016, several weeks prior to the end
of the 2015 policy coverage period. See Galan v. Mullins Food Prods., Inc.,
No. 2021-CH-00898, Order Preliminarily Approving Class Action Settle-
ment and Certifying the Settlement Class, at 3 (Cir. Ct. Cook Cnty. Jul. 5,
2024), reproduced at https://mullinsbipasettlement.com/media/4878149/
mlgl_order_preliminarily_approving_class_action_settlement_and_certi-
fying_the_settlement_class.pdf [https://perma.cc/87G3-4STM] (visited
May 2, 2025). The parties do not address the import, if any, of the fact that
only one of the three policy periods overlaps with the Galan lawsuit. That
is a matter that can be addressed on remand in the event the district court
ultimately concludes that Citizens has a duty to defend and indemnify
Mullins.
22                                                   No. 24-1524

C. Breach of the duty to defend
    As we have noted, when Mullins answered Citizens’ de-
claratory judgment complaint, it also filed a counterclaim,
Count I of which seeks a declaratory judgment that Citizens
owed Mullins a defense in the Galan litigation, and Count II
of which alleges that Citizens breached its contractual obliga-
tion to provide Mullins with that defense. Pursuant to its
breach-of-contract claim, Mullins sought reimbursement for
the attorney fees and other defense costs it had incurred in the
Galan litigation to date. In granting Citizens’ motion for sum-
mary judgment on this claim, the district court relied on a line
of Illinois cases holding that an insurer may decline to defend
the insured and still preserve its contractual defenses by seek-
ing declaratory relief, as well as an Illinois appellate prece-
dent holding that when an insurer files a declaratory judg-
ment action challenging its duty to defend its insured, the in-
surer’s duty of defense is suspended. See Those Certain Under-
writers at Lloyd’s v. Prof’l Underwriters Agency, Inc., 

 (Ill. App. Ct. 2006). That suspension, in the district
court’s view, relieved the insurer of its duty to defend until
such time as the court concluded that the insurance contract
obligated the insurer to provide a defense to its insured. Con-
sequently, there could be no breach of the duty to defend dur-
ing the period of suspension that would support an award of
damages compensating the insured for its defense costs dur-
ing that period. “A finding that Citizens breached its duty to
defend by contesting coverage and promptly seeking a decla-
ration of no duty to defend would, without more, render
No. 24-1524                                                    23

illusory the declaratory judgment option that Illinois courts
have long upheld.” R. 61 at 30–31.
    As we shall see, the parties’ dispute on this point is less
about the fact of Citizens’ prospective liability to Mullins than
about how to characterize that liability. Citizens’ position,
which the district court adopted, is that it cannot be said to
have breached an obligation to defend Mullins given that it
filed this declaratory action. Mullins, on the other hand, ar-
gues that if the district court ultimately concludes that Citi-
zens had a duty to defend it, then Citizens necessarily will
have breached that duty by not providing that defense (in the
form of a lawyer or payment for one) in the three-plus years
since Mullins notified Citizens of the Galan suit.
    Citizens does not contest that, if the court finds a duty to
defend, it must reimburse Mullins for its defense costs. Its
quarrel is with the label “breach of the duty to defend” and
the baggage that carries as a matter of Illinois insurance law:
breach of the duty to defend is typically identified as a basis
for estopping the insurer from raising contractual defenses to
policy coverage. Because Citizens timely sought declaratory
relief as to its duty to defend, it cannot be estopped from as-
serting such defenses. Yet, as Citizens concedes, filing this suit
does not shield Citizens from responsibility for Mullins’ de-
fense costs if the court ultimately rules in Mullins’ favor.
Where Illinois law is unclear is on what legal theory the obli-
gation to compensate Mullins can be made part of a judgment
in its favor. As we conclude below, because Citizens concedes
that if it owed Mullins a duty of defense it must reimburse
Mullins for its defense costs, we need not resolve that issue
definitively. In the event the district court resolves this action
in Mullins’ favor, the district court must provide Mullins with
24                                                          No. 24-1524

an appropriate remedy as to its defense costs, if only as an
aspect of the declaratory relief it awards to Mullins. 7
     As a matter of Illinois law, by timely filing a declaratory
judgment action as to coverage, an insurer avoids the pro-
spect of being estopped from raising coverage defenses.
Santa’s Best Craft, LLC v. St. Paul Fire & Marine Ins. Co., 

, 349–50 (7th Cir. 2010) (applying Illinois law); State
Farm Fire & Cas. Co. v. Martin, 

 (Ill. 1999).
Illinois was among the first of a minority of state jurisdictions
to adopt an estoppel rule in the context of the duty to defend.
See Stanley C. Nardoni, Estoppel for Insurers Who Breach Their
Duty to Defend: Answering the Critics, 50 J. MARSHALL L. REV.
53, 56–64, 70–77 (2016). Generally, where a suit against the in-
sured alleges facts that are potentially within the coverage of
the insurance policy, and when the insurer takes the position
that the policy does not cover the claim, the insurer must fol-
low one of two courses in order to fully preserve its rights:
(1) defend the suit under a reservation of rights, or (2) seek a
declaratory judgment that there is no duty to defend. Std.
Mut. Ins. Co. v. Lay, 

. The estoppel rule
applies when the insured notifies its insurer of a claim against
it and the insurer, believing it has no duty to defend, takes
neither of these two avenues; instead, it does nothing, leaving
the insured to its own devices. In that scenario, if it is later
determined that the insurer wrongfully denied its insured a
defense, then the insurer will be estopped from raising any
policy defenses. E.g., Emp’rs Ins. of Wausau v. Ehlco Liquidating

     7 We understand Mullins’ breach-of-contract claim to be seeking only

compensation for its defense costs in the Galan litigation and no other re-
lief. Our analysis is therefore limited to the request for reimbursement of
Mullins’ defense costs, including its attorney fees, in the Galan action.
No. 24-1524                                                     25

Trust, 

, 1134–35 (Ill. 1999). Thus, even if it
turns out that the underlying claim against the insured falls
outside the coverage provided by the policy, the insurer will
nonetheless be deemed liable to pay the claim. See Thornton v.
Paul, 

 (Ill. 1978), overruled in part on other
grounds by Am. Fam. Mut. Ins. Co. v. Savickas, 

,
449–51 (Ill. 2000); Martin, 710 N.E.2d at 1231–32. The rationale
for estoppel is that where the insurer has, without justifica-
tion, refused to defend its insured against a suit that plausibly
falls within the coverage of the policy and taken no steps to
independently confirm that it is not contractually required to
defend the insured, it has effectively repudiated the policy
and therefore should not be heard later to claim that the pol-
icy terms do not provide coverage. “[T]he insurer has no right
to insist that the insured be bound by the provisions of the
insurance contract inuring to its benefit, i.e., the ‘Exclusions’
provisions, when it has already breached the contract by vio-
lating the provisions inuring to the benefit of the insured, i.e.,
the defense provisions. In this sense it may properly be said
to be estopped.” Sims v. Ill. Nat’l Cas. Co., 

(Ill. App. Ct. 1963); see also Clemmons v. Travelers Ins. Co., 

 (Ill. 1981) (“The court will not enforce the
insurer’s protections under the policy where the insurer has
failed to act equitably, that is, failed to defend under a reser-
vation of rights or to bring a declaratory judgment action to
determine whether there was coverage under the policy.”) (ci-
tations omitted); Edward T. Joyce & Assocs., P.C. v. Prof’ls Direct
Ins. Co., 

 (7th Cir. 2016) (“Under Illinois law,
‘an insurer’s duty to defend under a liability insurance policy
is so fundamental an obligation that a breach of that duty con-
stitutes a repudiation of the contract.’”) (quoting Ehlco, 708
26                                                   No. 24-1524

N.E.2d at 1135); Ehlco, 

 (“The insurer cannot
simply abandon its insured.”).
    Citizens did not repudiate its agreement with Mullins but
rather sought prompt judicial resolution of its contention that
the Galan suit was clearly excluded from coverage under the
policy and that it thus had no duty to defend Mullins. See
Waste Mgmt., Inc. v. Int’l Surplus Lines Ins. Co., 

 (Ill. 1991). In the ideal course of events, the declaratory
judgment action would resolve the insurer’s duty to defend
before the underlying claim proceeds to litigation, so that if
the insured is owed a defense under the insurance policy, it is
given one. See 

 (“It is the purpose of the declaratory
judgment action to settle actual controversies before they
have ripened into violations of law or legal duty or breach of
contractual obligations. The parties involved in the contro-
versy can then learn the consequences of their action before
they act.“) (citations omitted). But events do not always play
out as the parties might wish. Not infrequently, the underly-
ing claim against the insured may proceed to litigation, even
judgment, before the declaratory judgment action finally re-
solves the duty to defend. In that eventuality, the insured will
have been left to defend the underlying action entirely on its
own, as Mullins was here, before the parties learn whether the
insured was owed a defense. Even in that scenario, however,
so long as the insurer timely filed suit for declaratory judg-
ment, the insurer will still enjoy the benefit of a safe harbor
from estoppel, as the Illinois Supreme Court held in Martin,

. The Illinois Appellate Court’s decision in
Those Certain Underwriters in turn construes Martin to mean
that once the insurance company has filed a declaratory judg-
ment action, its duty to represent the insured is “suspended”
No. 24-1524                                                             27

unless and until the court determines that the insurer is obli-
gated to defend the insured. 

.
    The district court here understood Those Certain Under-
writers to signal that an insurer’s decision to seek declaratory
relief precludes a subsequent finding that the insurer
breached its duty to defend by leaving the insured to defend
itself in the meantime without help from the insurer, even if
the district court later concludes that the insurance contract in
fact obligated the insurer to defend the insured. R. 61 at 30–
31.
   We are not so sure. Those Certain Underwriters itself recog-
nizes that an insurer will be liable to the insured for its de-
fense costs in the event the declaratory judgment action cul-
minates in a finding that the insurer is bound to defend the
insured:
        As defendants note in their reply brief, once a
        court has ruled that an insurer breached its duty
        to defend, the insurer will be liable to its insured
        for defense costs. General Star Indemnity Co. [v.
        Lake Bluff Sch. Dist. No. 65, 

        (Ill. App. Ct. 2004)]. Thus, should the insurer ul-
        timately fail in its declaratory judgment action
        … it may be liable for the cost of the defense it
        should have provided during the period of suspen-
        sion. …

 (emphasis ours). 8


    8 Those Certain Underwriters was a rescission case: the insurer alleged

that the insured had made fraudulent misrepresentations in its application
for insurance and sought a declaration that it had no duty to defend the
                                                              (continued)
28                                                            No. 24-1524

    The court’s citation to General Star Indemnity reinforces the
point. General Star Indemnity reviewed a trial court’s declara-
tory judgment that an insurance company was obliged to de-
fend its insured (a school district) on two of three claims as-
serted against the insured in a federal disability rights law-
suit. The appellate court affirmed the lower court as to those
two claims but reversed the trial court as to the third claim,
concluding that the policy in question entitled the insured to
a defense on that claim as well. It proceeded to award the in-
sured the costs and fees it had incurred in defending that third
claim, reasoning that the insured was entitled to recovery of
those expenses for the insurer’s breach of contract. Gen. Star
Indem., 

. See also Nat’l Cas. Co. v. S. Shore Iron
Works, Inc., 

 (N.D. Ill. 2018) (finding
that insurer breached its duty to defend insured by rejecting
the insured’s tender of claim notwithstanding insurer’s deci-
sion to file declaratory judgment action), app. dismissed, 

 (7th Cir. Dec. 13, 2018); Am. Alt. Ins. Corp. v. Metro
Paramedic Servs., Inc., 

 (N.D. Ill. 2014)
(same), j. aff’d, 

 (7th Cir. 2016).
   Thus, even taking at face value Those Certain Underwriters’
language about an insurer’s duty to defend being suspended
until the declaratory judgment has been resolved, 9 that


insured on that basis. Although the case was distinct in this sense from the
run-of-the mill duty to defend case, Those Certain Underwriters applied tra-
ditional duty-to-defend cases and in turn has been cited as authoritative
in such cases.
     9 This aspect of Those Certain Underwriters has been criticized. Allianz

Ins. Co. v. Guidant Corp., 

, 418–19 (Ind. Ct. App. 2008) (citing
John S. Vishneski III, The Illinois Supreme Court Gives Policyholders a Break
from the Two-Front War, 

, 59–60 (2006)).
No. 24-1524                                                                  29

precedent itself suggests that once a court has entered a de-
claratory judgment recognizing that the insured is bound to
defend its insured, the insurer will be liable in contract for the
fees and costs the insured has shouldered to date. Filing the
declaratory judgment action will have insulated the insurer
from estoppel—thus preserving the insurer’s contractual de-
fenses—but not from (eventual) liability for the cost of the de-
fense “it should have provided” to the insured while the duty
to defend was being litigated in the declaratory action. 

. 10
    Ultimately, Citizens’ concern is less with the logic of its
prospective liability to Mullins than with the label “breach,”
which it reads as being inconsistent with Those Certain Under-
writers and exposing it to estoppel. How then to reconcile Cit-
izens’ potential liability for having failed to defend Mullins
with Citizens’ right to avoid estoppel? One way to do so
might be to distinguish between a breach of the duty to de-
fend so serious that it amounts to a repudiation of the insur-
ance agreement—thus meriting estoppel—and a more quo-
tidian breach that results only in liability for defense costs.
Another might be to say that the insurer’s duty to defend is
suspended upon filing an action for declaratory judgment
and remains so until such time as the court finds that the

    10 This is consistent with the principle that the duty to defend arises

at the time an insured gives its carrier notice of a claim potentially within
the scope of the insurance policy, as opposed to the point at which a court
later confirms that the insurer is obligated to defend its insured. See St.
Paul Guardian Ins. Co. v. Walsh Constr. Co., 

 (7th Cir.
2024) (citing Lyons v. State Farm Fire & Cas. Co., 

 (Ill.
App. Ct. 2004)); Lexington Ins. Co. v. Chi. Flameproof & Wood Specialties
Corp., 

 (7th Cir. 2020); Cent. Ill. Light Co. v. Home Ins. Co.,

 (Ill. 2004).
30                                                  No. 24-1524

insurer is obligated to defend the insured, at which point the
insurer becomes retroactively liable for failing to defend its
insured and will now owe the insured a defense going for-
ward (if the underlying claim remains unresolved) and reim-
bursement for its accrued defense costs as an “amount due,”
but not as damages for a breach of contract. Either view
would be based on the contract, and in this case, relief pre-
sumably could be ordered pursuant to Mullins’ contractual
claim. Alternatively, the obligation to compensate Mullins
could be made part of the relief on its counterclaim for declar-
atory relief.
    But we need not resolve the appropriate theoretical basis
for ordering Citizens to reimburse Mullins in the event the
court determines that Citizens was obliged to defend Mullins.
Citizens has made clear both below and on appeal that it does
not contest its obligation to reimburse Mullins if the court
finds that Citizens owed it a defense. See Citizens Br. 44, 46;
R. 89 at 6. There being no dispute on that score, we leave it to
the parties and the district court on remand to arrive at an
agreeable means of ensuring that Mullins is appropriately re-
imbursed for its defense costs in the event that the court en-
ters declaratory relief in favor of Mullins and against Citizens.
   To eliminate any doubt: estoppel is off the table, but reim-
bursement to Mullins for its defense costs is not.
   For these reasons, we vacate the entry of summary judg-
ment against Mullins on Count II of the counterclaim. In the
event the district court ultimately resolves the notice issue in
favor of Mullins, thus confirming that Citizens owes Mullins
a duty of defense in the Galan suit under the 2015 policy, Cit-
izens will be liable to Mullins for the costs and fees Mullins
has incurred in defending itself in Galan.
No. 24-1524                                                       31

D. Timeliness of Mullins’ notice of the Galan litigation
     The insurance policies include a provision requiring the
insured, in the event a claim is made or a suit is filed against
it, to notify Citizens in writing “as soon as practicable.” R. 1-1
at 172, 408, 691. Not until nearly a year after it learned of the
Galan suit did Mullins notify Citizens of the action and re-
quest a defense. Citizens argued below that this was too late
to constitute timely notice under the policy.
    The district court initially denied summary judgment on
this question, finding that there were unresolved issues of
material fact that precluded summary judgment. R. 61 at 25–
28. Subsequently, when the court, on reconsideration con-
cluded that the Access or Disclosure and Statutory Violations
Exclusions barred coverage for the BIPA violations alleged in
the Galan suit, the court vacated its summary judgment ruling
as to notice as moot. R. 98 at 28. Citizens now asks us to take
up the notice question and hold that it is entitled to summary
judgment on the issue.
    We leave it to the district court, however, to revisit the no-
tice issue on remand. Given that the district court vacated its
prior ruling on the issue, there is, at present, no ruling for us
to review. Moreover, the court’s previous ruling on notice
was one denying summary judgment, which is ordinarily not
appealable under 

. Dupree v. Younger, 

, 733–34 (2023); Plumhoff v. Rickard, 

 (2014);
Tousis v. Billiot, 

 (7th Cir. 2023). Citizens is, of
course, free to renew its arguments as to the timeliness of
Mullins’ notice in the district court on remand, but we leave
it to the district court’s discretion how best to resolve the is-
sue, including the option of reinstating its prior decision on
this subject.
32                                                 No. 24-1524

                              III.
    For the foregoing reasons, we have concluded that the Ac-
cess or Disclosure Exclusion found in the 2016 and 2017 com-
mercial liability policies that Citizens issued to Mullins bars
coverage for injuries resulting from BIPA violations, whereas
the Statutory Violations Exclusion, found in the 2015 policy as
well as the 2016 and 2017 policies, does not. Citizens may
therefore owe Mullins a duty of defense and indemnification
under the 2015 policy, assuming that Mullins gave timely no-
tice of the underlying claim to Citizens. The question of timely
notice is to be resolved on remand. In the event the district
court concludes that Mullins did provide Citizens with timely
notice of the underlying claim and was thus owed a defense
by Citizens in the Galan litigation, the judgment must incor-
porate reimbursement to Mullins for the fees and costs it in-
curred defending the Galan suit on its own while Citizens pur-
sued this declaratory action. We therefore VACATE the judg-
ment of the district court and REMAND for further proceed-
ings consistent with this opinion. The parties shall bear their
own costs of appeal.