Exclusions in a custom car floormat maker’s umbrella policy do not apply to preclude an insurer from defending it against a class action over alleged violations of Illinois’ Biometric Information Privacy Act, a 7th U.S. Circuit Court of Appeals panel ruled Friday.

The three-judge appellate panel in Thermoflex Waukegan LLC v. Mitsui Sumitomo Insurance USA Inc. said alleged violations of BIPA do not fall within the umbrella policy’s exclusions for employment-related practices, data breach liability and statutory violations.

The panel said it was persuaded by the Illinois Supreme Court’s decision in West Bend Mutual Insurance Co. v. Krishna Schaumburg, in which the state high court found that an exclusion only applied to claims arising from laws similar to the Telephone Consumer Protection Act and CAN-SPAM Act of 2003.

The panel said the exclusions in Thermoflex’s primary and excess policies from Mitsui relieved the insurer from providing a defense against a state court class action filed by Gregory Gates.

Mitsui issued commercial general liability, excess and umbrella policies to Thermoflex. The policyholder asked Mitsui to fund a defense under the policies after Mr. Gates filed suit accusing the company of violating BIPA.

According to the lawsuit, Thermoflex required employees to scan their handprints each time they clocked in and out of work. Mr. Gates claims the Waukegan, Illinois-based company illegally transmitted biometric data to a third party without his permission and did not provide employees with a publicly available policy that included a data retention schedule and procedures, court records show.

In a  January 2023 ruling, the trial judge said an exclusion in Mitsui’s primary policy excluded coverage for claims based on laws and statutes that prohibit the dissemination of material or information relieved the insurer from defending against Mr. Gates’ suit.

The appellate panel agreed with a different trial judge that an exclusion in the excess policy relieved Mitsui of its defense obligations.

Thermoflex attorney David Goodman, managing member of Goodman Law Group, said the panel correctly found that coverage is available under the umbrella policy but that the Illinois Supreme Court has yet to address the “hopelessly ambiguous” data confidentiality exclusion in the primary policy.

“That exclusion, with its word salad of ‘examples’ of ‘confidential’ or ‘proprietary’ information that are inconsistent with the common meanings of those terms, holds the key to whether there is coverage for BIPA claims under most CGL policies,” he said.

A representative for Mitsui declined comment.