IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

AMERICAN FAMILY MUTUAL, )

INSURANCE COMPANY, S.I. and )

AUSTIN MUTUAL INSURANCE ) 

COMPANY, )

)

Plaintiffs, )

) No. 20 C 3665

v. )

) Judge John Z. Lee

CARNAGIO ENTERPRISES, )

INC., an Illinois corporation, )

and ANGELA KARIKARI, )

individually and on behalf of all )

others similarly situated, )

)

Defendants. )

MEMORANDUM OPINION AND ORDER

Defendant Carnagio Enterprises, Inc. (“Carnagio”), is a McDonald’s franchisee 

insured by both Plaintiff American Family Mutual Insurance Company, S.I. 

(“American Family”) and Plaintiff Austin Mutual Insurance Company (“Austin 

Mutual”) (collectively “Plaintiffs”). In early 2019, Defendant Angela Karikari 

(“Karikari”) filed a class action lawsuit against Carnagio, alleging violations of 

Illinois’s Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1 et seq. (“BIPA”). 

Carnagio informed the insurance companies of the lawsuit and requested coverage.1 

1 Although Plaintiffs initially raised a notice argument as part of their motion for 

summary judgment, they have since withdrawn that argument on the record. See ECF No. 

86. The Court notes that the exact date of notice is disputed and any arguments as to notice 

are irrelevant for the purposes of this decision. To the extent summary judgment is granted

to either party in this decision, it should be understood as ruling only on the interpretation 

of the exclusions invoked by Plaintiffs. 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 1 of 24 PageID #:4269
2

Plaintiffs then brought this suit, seeking a declaratory judgment that violations of 

BIPA are excluded under the policies they had issued to Carnagio. As a result, 

Plaintiffs contend that they have no duty to defend Carnagio in Karikari’s suit. 

This Court now addresses the parties’ cross-motions for summary judgment. 

For the reasons stated below, Plaintiffs’ motion for summary judgment is granted in 

part and denied in part, and Karikari’s motion for summary judgment is granted. 

I. Background2

A. Carnagio’s Insurance Policies

Carnagio operates thirteen McDonald’s restaurant franchises in Illinois. Pls.’ 

Statement Material Fact (“PSOF”) ¶ 31, ECF No. 76. From March 1, 2015, to March 

1, 2020, all of Carnagio’s McDonald’s locations were insured under policies issued by 

American Family. Id. ¶¶ 7–11. From March 1, 2020 to March 1, 2021, Carnagio’s 

restaurants were covered under Businessowners’ Liability Insurance policies issued 

by Austin Mutual. Id. ¶ 12. Each of these policies promises coverage for “the sums 

that the insured becomes legally obligated to pay as damages because of ‘bodily 

injury’, ‘property damage’ or ‘personal and advertising injury’ to which this insurance 

applies.” Id. ¶ 15. The policies further acknowledge that American Family and 

Austin Mutual have a duty to defend Carnagio “against any ‘suit’ seeking damages 

for” those covered harms. Id. 

The policies define “personal and advertising injury” as:

[Any] injury, including consequential “bodily injury”, arising out 

of one or more of the following offenses:

2 The following facts are undisputed or deemed admitted, unless otherwise noted. 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 2 of 24 PageID #:4270
3

a. False arrest, detention or imprisonment;

b. Malicious prosecution;

c. The wrongful eviction from, wrongful entry into, or invasion of 

the right of private occupancy of a room, dwelling or premises 

that a person occupies, committed by or on behalf of its owner, 

landlord or lessor;

d. Oral or written publication, in any matter, of material that 

slanders or libels a person or organization or disparages a 

person’s or organization’s goods, products or services;

e. Oral or written publication, in any manner, of material that 

violates a person’s right of privacy;

f. The use of another’s advertising idea in your “advertisement”; 

or

g. Infringing upon another’s copyright, trade dress or slogan in 

your “advertisement”.

Id. ¶ 19. 

The policies also contain identical exclusion provisions, entitled “EmploymentRelated Practices” (“ERP exclusion”) and “Distribution Of Material In Violation Of 

Statutes” (“Statutory Violation exclusion”) Id. ¶¶ 22–23. The ERP exclusion states, 

in relevant part:

This insurance does not apply to:

a. “Bodily injury” or ‘‘personal and advertising injury” to:

i. A person arising out of any:

1. Refusal to employ that person;

2. Termination of that person’s employment; or

3. Employment-related practices, policies, acts or 

omissions, such as coercion, demotion, evaluation, 

reassignment, discipline, defamation, harassment, 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 3 of 24 PageID #:4271
4

humiliation or discrimination directed at that person . . 

. .

b. This exclusion applies:

i. Whether the insured may be liable as an employer or in any 

other capacity; and

ii. To any obligation to share damages with or repay someone 

else who must pay damages because of the injury.

Id. ¶ 22.

In turn, the Statutory Violation exclusion states:

This insurance does not apply to:

Distribution Of Material In Violation Of Statutes

“Bodily injury”, “property damage”, or “personal and advertising 

injury” arising directly or indirectly out of any action or omission 

that violates or is alleged to violate:

(1) The Telephone Consumer Protection Act (TCPA), including 

any amendment or addition to such law; or

(2) The CAN-SPAM Act of 2003, including any amendment of 

or addition to such law; or

(3) Any statute, ordinance or regulation, other than the TCPA 

or CAN-SPAM Act of 2003, that prohibits or limits the 

sending, transmitting, communicating or distribution of 

material or information.

Id. ¶ 23. 

Additionally, the Austin Mutual policy includes an exclusion dealing with 

access to or disclosure of confidential or personal information (“Access/Disclosure 

exclusion”). The exclusion provides, in relevant part:

This insurance does not apply to:

[] Access Or Disclosure Of Confidential Or Personal 

Information And Data-related Liability

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 4 of 24 PageID #:4272
5

(1) Damages, other than damages because of “personal and 

advertising injury”, arising out of any access to or 

disclosure of any person’s or organization’s confidential or 

personal information, including patents, trade secrets, 

processing methods, customer lists, financial information, 

credit card information, health information, or any other 

type of nonpublic information, or

(2) Damages arising out of the loss of, loss of use of, damage 

to, corruption of, inability to access, or inability to 

manipulate electronic data.

Id. ¶ 24. 

B. The Underlying Lawsuit

Karikari alleges that she worked at one of Carnagio’s McDonald’s restaurants 

starting in 2017. Id. ¶ 38. According to her, Carnagio required her to clock in and 

out of each shift using a fingerprint scanner. Id. ¶ 35. Despite its use of fingerprints 

for timekeeping and identification, Karikari claims, Carnagio never informed “its 

employees of the complete purposes for which it collects their sensitive biometric data 

or to whom the data is disclosed if at all”; never gave its employees “a written, publicly 

available policy identifying its retention schedule, and guidelines for permanently 

destroying its employees’ fingerprints”; and never had her sign a release allowing 

Carnagio to collect her fingerprints. Id. ¶¶ 36–37, 43. 

In March 2019, Karikari filed a lawsuit against Carnagio in state court for 

violating provisions of BIPA. Id. ¶ 27. See 740 Ill. Comp. Stat. 14/20. And Carnagio 

tendered notice of the lawsuit to the insurance companies. Plaintiffs then filed this 

lawsuit, seeking a declaratory judgment that they have no duty to defend Carnagio 

against Karikari’s claims in state court. 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 5 of 24 PageID #:4273
6

II. Legal Standard

Summary judgment is appropriate where “the movant shows that there is no 

genuine dispute as to any material fact and the movant is entitled to judgment as a 

matter of law.” Fed. R. Civ. P. 56(a). The evidence considered for summary judgment 

“must be admissible if offered at trial, except that affidavits, depositions, and other 

written forms of testimony can substitute for live testimony.” Malin v. Hospira, Inc., 

762 F.3d 552, 554–55 (7th Cir. 2014). On cross-motions for summary judgment, the 

court “view[s] the facts and draw[s] reasonable inferences in favor of ‘the party 

against whom the motion at issue was made.’” Woodring v. Jackson Cnty., 986 F.3d 

979, 984 (7th Cir. 2021) (quoting Tripp v. Scholz, 872 F.3d 857, 862 (7th Cir. 2017)). 

The moving party has the initial burden of demonstrating the absence of a

genuine issue of material fact. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). The 

nonmoving party must then “come forward with specific facts showing that there is a 

genuine issue for trial.” LaRiviere v. Bd. of Trs. of S. Ill. Univ., 926 F.3d 356, 359 

(7th Cir. 2019) (quoting Spierer v. Rossman, 798 F.3d 502, 507 (7th Cir. 2015)). To 

satisfy that ultimate burden, the nonmoving party must “do more than simply show 

that there is some metaphysical doubt as to the material facts,” Matsushita Elec. 

Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 586 (1986), and instead must 

“establish some genuine issue for trial such that a reasonable jury could return a 

verdict in her favor,” Gordon v. FedEx Freight, Inc., 674 F.3d 769, 772–73 (7th Cir. 

2012); see also Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986) (“[S]ummary 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 6 of 24 PageID #:4274
7

judgment will not lie . . . if the evidence is such that a reasonable jury could return 

a verdict for the nonmoving party.”).

III. Analysis

As a preliminary matter, the parties agree that Illinois law applies. See Pls.’ 

Mem. Supp. Mot. Summ. J. at 5, ECF No. 70; Def. Karikari Resp. Opp’n Pls.’ Mot. 

Summ. J. at 2, ECF No. 75; Def. Carnagio Resp. Opp’n Pls.’ Mot. Summ. J. at 2

(“Carnagio Resp.”), ECF No. 77. Furthermore, the parties have not conducted 

discovery in this case, and all facts relevant to the cross-motions are undisputed. 

Accordingly, the Court turns to the question at hand, namely, whether any of 

Carnagio’s insurance policies provide coverage for the defense of Karikari’s lawsuit. 

See Roman Cath. Diocese of Springfield v. Md. Cas. Co., 139 F.3d 561, 565 (7th Cir. 

1998) (“Illinois law . . . treats the interpretation of an insurance policy and the 

respective rights and obligations of the insurer and the insured as questions of law 

that the court may resolve summarily.”).

To answer this question, the Court must look to the language of the insurance 

policies. “The goal in interpreting an insurance policy is to ascertain and give effect 

to the intention of the parties, as expressed in the policy language.” Scottsdale Ins. 

Co. v. Columbia Ins. Grp., Inc., 972 F.3d 915, 919 (7th Cir. 2020) (cleaned up). 

Furthermore, under Illinois law, “insurance policies are to be liberally construed in 

favor of coverage, and where an ambiguity exists in the insurance contract, it will be 

resolved in favor of the insured and against the insurer.” United Servs. Auto. Ass’n 

v. Dare, 830 N.E.2d 670, 678 (Ill. App. Ct. 2005). At the same time, policy language 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 7 of 24 PageID #:4275
8

is not ambiguous “simply because the parties disagree as to its meaning[,]” and the 

court should not “strain to find an ambiguity where none exists.” Founders Ins. Co. 

v. Munoz, 930 N.E.2d 999, 1004 (Ill. 2010). 

When seeking coverage, “[a]n insured has the burden of proving that a claim 

falls within the coverage of the policy. . . . Once the insured satisfies this burden, the 

insurer has the burden of proving that the loss was limited or excluded by a contract 

provision.” Travelers Pers. Ins. Co. v. Edwards, 48 N.E.3d 298, 303 (Ill. App. Ct.

2016). What is more, “[a]n insurer can only refuse to defend if the allegations of the 

underlying complaint preclude any possibility of coverage.” Ill. Tool Works, Inc. v. 

Travelers Cas. & Sur. Co., 26 N.E.3d 421, 428 (Ill. App. Ct. 2015). But a single 

unequivocal exclusion is sufficient to show that an insurer does not have a duty to 

defend the insured. See, e.g., Hartford Cas. Ins. Co. v. Dental USA, Inc., No. 13 C 

7637, 2014 WL 2863164, at *4 (N.D. Ill. June 24, 2014) (applying Illinois law). 

Finally, to “determine whether the insurer’s duty to defend has arisen, the 

court must compare the allegations of the underlying complaint to the policy 

language.” Id. “If the court determines that these allegations fall within, or 

potentially within, the policy’s coverage, the insurer has a duty to defend the insured 

against the underlying complaint.” Metzger v. Country Mut. Ins. Co., 986 N.E.2d 756, 

761 (Ill. App. Ct. 2013) (internal quotation marks omitted). 

In this case, all parties agree that a lawsuit arising under BIPA constitutes a 

claim asserting a “personal injury” that triggers coverage under Carnagio’s policies.3 

3 In light of a recent Supreme Court of Illinois decision on the matter, Plaintiffs could 

not reasonably argue otherwise. See W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 8 of 24 PageID #:4276
9

The dispute is whether any of the exclusions in the policies operate to preclude 

coverage for Karikari’s lawsuit. 

A. ERP Exclusion

Plaintiffs first contend that the ERP exclusion precludes coverage because 

“[t]he BIPA violations alleged in the Underlying Complaint unquestionably arise out 

of the employment relationship and occurred while [Karikari] and the other 

employees . . . were performing the work-related duty of using a biometric time clock 

to record their hours.” Pls.’ Mem. Law Supp. Summ. J. (“Pls.’ Mem.”) at 7, ECF No. 

70. Not surprisingly, Defendants disagree. 

While Illinois courts have not yet addressed whether BIPA claims are 

unambiguously excluded by the ERP exclusion, courts in this district are split on the 

issue. Compare Am. Fam. Mut. Ins. Co. v. Caremel, Inc., No. 20 C 637, 2022 WL 

79868, at *4 (N.D. Ill. Jan. 7, 2022) (“[A] BIPA violation is of the same nature as the 

exemplar employment-related practices listed in the Policy. Each of ‘coercion, 

demotion, evaluation, reassignment, discipline, defamation, harassment, 

humiliation’ reflect a practice that can cause an individual harm to an employee.”), 

with State Auto. Mut. Ins. Co. v. Tony’s Finer Foods Enters., Inc., No. 20-CV-6199, 

2022 WL 683688, at *7 (N.D. Ill. Mar. 8, 2022) (holding that scanning employees’ 

fingerprints is “categorically different” from the practices listed in the exclusion). 

And some courts outside of this district have found the language in the provision

Inc., ___ N.E.3d ____, 2021 WL 2005464, at *8 (May 20, 2021) (finding a violation of BIPA to 

be a potential violation of a person’s “right to privacy,” and bringing it within the definition 

of “personal injury” for insurance purposes). 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 9 of 24 PageID #:4277
10

ambiguous, thereby finding a duty to defend. See, e.g., Perkins v. Md. Cas. Co., 388 

F. App’x 641, 643 (9th Cir. 2010) (holding that it was unclear whether the ERP

exclusion covered claims of false imprisonment against an employer).

With this background, the Court starts with the language of the ERP exclusion. 

In relevant part, it excludes coverage for ‘‘personal and advertising injury” to a person 

arising out of “any” (1) “refusal to employ that person”; (2) “termination of that 

person’s employment”; or (3) “employment-related practices, policies, acts or 

omissions, such as coercion, demotion, evaluation, reassignment, discipline, 

defamation, harassment, humiliation or discrimination directed at that person.” 

PSOF ¶ 22. Karikari does not allege that Carnagio improperly refused to employ her 

or wrongfully terminated her, so the first two reasons for exclusion do not apply. 

Instead, the insurance companies rely upon the third category, arguing that 

Carnagio’s practice of requiring employees to clock in and out using their handprints 

was an “employment-related practice” that arose out of the employer-employee 

relationship.

In response, Carnagio and Karikari argue that the fingerprint requirement 

does not fall within the third exclusionary clause, because it is not the type of 

“employment-related practice” intended by the ERP exclusion. Whether explicitly or 

not, Defendants invoke the canon of interpretation noscitur a sociis—which counsels 

that the meaning of neighboring words can help guide a word’s meaning. See CFTC 

v. Worth Bullion Grp., Inc., 717 F.3d 545, 550-51 (7th Cir. 2013) (“Under the principle 

of noscitur a sociis, the fact that several items in a list share an attribute counsels in 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 10 of 24 PageID #:4278
11

favor of interpreting the other items as possessing that attribute as well.” (cleaned 

up)). 

Here, the first two clauses—refusal to hire and termination—address an action 

that an employer takes against a particular employee or prospective employee. 

Similarly, the examples offered in the third clause—coercion, demotion, evaluation, 

reassignment, discipline, defamation, harassment, humiliation or discrimination—

also consist of actions that an employer or someone else in the workplace takes 

against a particular employee. In fact, the third clause expressly describes this 

conduct as conduct “directed at that person” (i.e., the person claiming injury). By 

contrast, Carnagio’s practice of requiring its employees to provide their fingerprints 

when clocking in or out is one that applies generally to all employees. Accordingly, 

applying the interpretative tool noscitur a sociis, the Court concludes that Carnagio’s 

practice does not fall within the scope of the activities described in the ERP exclusion. 

This interpretation finds support in Illinois cases that construe the ERP

exclusion in other contexts. From them, it is clear that just because an alleged injury 

takes place at work does not by itself trigger the exclusion. See Am. All. Ins. Co. v. 

1212 Rest. Grp., L.L.C., 794 N.E.2d 892, 900 (Ill. App. Ct. 2003) (holding “the fact that 

the [allegations giving rise to the underlying claim] arose out of [an insured’s]

business does not necessarily mean they were an employment-related act within the 

meaning of the exclusion”); see also Peterborough Oil Co. v. Great Am. Ins. Co., 397 

F. Supp. 2d 230, 238 (D. Mass. 2005) (“If every injury arising out of an act that 

somehow related to an employee were to be excluded, the exclusion would effectively 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 11 of 24 PageID #:4279
12

swallow the coverage. The term is therefore necessarily narrower.”); Diversified 

Commc’ns Servs., Inc. v. Landmark Am. Ins. Co., No. CV 08-7703 PSG (SSX), 2009 

WL 772952, at *8 (C.D. Cal. Mar. 17, 2009).

Rather, “the salient question is whether the alleg[ations giving rise to the 

underlying complaint] were made in the context of employment and related to . . . 

employment performance.” 1212 Rest. Grp., 794 N.E.2d at 900 (emphasis added); see 

also Am. Econ. Ins. Co. v. Haley Mansion, Inc., No. 3-12-0368, 2013 WL 1760600, at 

*4 (Ill. App. Ct. Apr. 23, 2013) (holding that an employment relationship between 

plaintiff and defendant alone was not enough to invoke the ERP coverage exclusion). 

In other words, it is not enough that the underlying claim simply arise out of an

employer-employee relationship, as Plaintiffs argue. The claim must involve an 

action related to an employee’s performance. 

Finally, the insurance companies rely on the word “any” that precedes 

“employment-related practice” to argue that the latter term should be given wide 

breadth. And to be sure, “any” is a broad term. But, here, “any” modifies 

“employment-related practice,” followed by a list of examples. And, as Carnagio 

points out, “such as,” like including, is “a phrase of general similitude indicating that 

there are includable other matters of the same kind which are not specifically 

enumerated by the standard.” White v. United Airlines, Inc., 416 F. Supp. 3d 736, 740 

(N.D. Ill. 2019) (cleaned up), rev’d on other grounds, 987 F.3d 616 (7th Cir. 2021)

(emphasis added). To put it another way, the scope of “any” in this exclusion is only 

as broad as the definition of “employment-related practices” allows it to be. 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 12 of 24 PageID #:4280
13

For these reasons, the Court concludes that Carnagio’s practice of requiring its 

employees to provide their fingerprints when clocking in and out of work does not fall 

within the ERP exclusion. At a minimum, there is significant ambiguity as to 

whether the exclusion disavows coverage of Karikari’s claims. And, under Illinois 

law, such ambiguity must be resolved in the insured’s favor. See United Servs. Auto., 

830 N.E.2d at 678.

B. Statutory Violation Exclusion

The Statutory Violation exclusion precludes coverage for injuries arising out 

of: 

(1) The Telephone Consumer Protection Act (TCPA), including 

any amendment or addition to such law; or

(2) The CAN-SPAM Act of 2003, including any amendment of or 

addition to such law; or

(3) Any statute, ordinance or regulation, other than the TCPA or 

CAN-SPAM Act of 2003, that prohibits or limits the sending, 

transmitting, communicating or distribution of material or 

information.

PSOF ¶ 23. 

In West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., the 

Supreme Court of Illinois held that a nearly identical provision did not exclude 

violations of BIPA from coverage. 2021 WL 2005464, at *10. But Plaintiffs contend 

the result in Krishna does not control this case, because the provision in Krishna, 

although otherwise identical, had a more specific title: “Violation of Statutes that 

Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or 

Information.” Pls.’ Mem. at 9. Because the Supreme Court of Illinois began its

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 13 of 24 PageID #:4281
14

Krishna analysis with the title of the exclusion, see 2021 WL 2005464, at *10, 

Plaintiffs contend that Krishna should have no bearing on the interpretation of the 

exclusion here. 

At the outset, this Court is not convinced that the difference in the titles makes 

these exclusions substantively different. See, e.g., First Mercury Ins. Co. v. Triple 

Location LLC, 536 F. Supp. 3d 326, 331–32 (N.D. Ill. 2021) (referring to the exclusion 

at issue in Krishna as “materially identical” to one with the title “Distribution of 

Material in Violation of Statutes,” and otherwise identical substance). But even if 

the change in title were material, the Supreme Court of Illinois’s analysis in Krishna

would remain the appropriate starting point for this Court’s understanding of the

Statutory Violation exclusion here. 

The Krishna court, in interpreting the list of statutory violations that would be 

excluded, explained:

[T]o the extent that the “other than” language . . . may be viewed as 

ambiguous, it must be construed in favor of finding coverage for the 

insured. . . . Therefore, under the doctrine of ejusdem generis and our 

rules of insurance contract construction, we construe the violation of 

statutes exclusion to apply only to statutes like the TCPA and the CANSPAM Act.

2021 WL 2005464, at *10. Here, too, because the general words “other than” follow 

a list of specific statutes in the exclusion, ejusdem generis can inform the Court’s 

understanding of the exclusion.4 See id. at *9 (“[W]here general words follow an 

4 Plaintiffs insist that ejusdem generis is not appropriate here because the “other than” 

language in their exclusions is not ambiguous at all, and it “plainly applies” to BIPA claims. 

Pls.’ Mem. at 9. But the Krishna court found the “other than” language to be ambiguous 

enough to require the application of ejusdem generis. 2021 WL 2005464, at *10. And in 

Krishna, the Supreme Court of Illinois was interpreting identical language in an identical 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 14 of 24 PageID #:4282
15

enumeration of persons or things, by words of a particular and specific meaning, such 

general words are to be held as applying only to persons or things of the same general 

kind or class as those specifically mentioned.” (quoting BLACK’S LAW DICTIONARY 517 

(6th ed. 1990))). 

Notwithstanding the different titles, the application of ejusdem generis in this 

instance yields the same result as in Krishna: only violations of statutes, ordinances, 

or regulations “like the TCPA and the CAN-SPAM Act” are excluded from coverage. 

Thus, the Court must determine whether BIPA is “like the TCPA and the CAN-SPAM 

Act.” 

Plaintiffs contend that this is so, because BIPA protects an individual’s privacy 

rights just as the TCPA and the CAN-SPAM Act do. But, even so, BIPA is materially 

different from the other two. The TCPA and the CAN-SPAM Act protect privacy by 

regulating communications in order to give private citizens control over the 

information that they receive. See generally 47 U.S.C. § 227 and 15 U.S.C. § 7701.

By contrast, BIPA protects privacy by regulating the information that private citizens

give away. See generally 740 Ill. Comp. Stat. 14/15 (regulating, among other things, 

how private entities must handle “a person[‘s]” biometric information that they 

“collect, capture, purchase, receive through trade, or otherwise obtain”).

5 As such, 

list of excluded statutory claims. Thus, the Court finds that the application of ejusdem 

generis is appropriate here. 

5 This distinction tracks closely with the commonly understood definitions of “privacy,” 

a term that can mean both “freedom from unauthorized intrusion,” and “secrecy” or “a private 

matter.” Privacy, MERRIAM-WEBSTER.COM, https://www.merriam-webster.com/dictionary

/privacy (last visited Nov. 22, 2021). 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 15 of 24 PageID #:4283
16

the Court concludes that BIPA is not like the TCPA and the CAN-SPAM Act, because 

BIPA protects a different kind of privacy and uses a different method to do so. See

Evanston Ins. Co. v. Gene by Gene, Ltd., 155 F. Supp. 3d 706, 713 (S.D. Tex. 2016)

(interpreting an identical insurance provision and finding that the TCPA and CANSPAM Act were not like a statute regulating disclosure of genetic information 

because, unlike the enumerated statutes in the exclusion, the genetic information 

statute “d[id] not concern unsolicited communication to consumers.”) At a minimum, 

coverage for Karikari’s claims is not unambiguously excluded by the Statutory 

Violation exclusion. 

For these reasons, the Court holds that the underlying claims under BIPA are 

at least potentially covered by Carnagio’s policies. Additionally, because American 

Family raised only the ERP exclusion and Statutory Violation exclusion, neither of 

which unambiguously exclude coverage in this case, Plaintiffs’ motion for summary 

judgment is denied as to American Family, and Karikari’s cross-motion for summary 

judgment as to American Family is granted with respect to these exclusions.

C. Access/Disclosure Exclusion

Austin Mutual argues that a third exclusion in its policy, the Access/Disclosure

exclusion, precludes coverage in this case. As noted above, the exclusion, entitled 

“Access Or Disclosure Of Confidential Or Personal Information and Data-related 

Liability,” states: 

This insurance does not apply to . . . “Personal and 

advertising injury” arising out of any access to or disclosure 

of any person’s or organization’s confidential or personal 

information, including patents, trade secrets, processing 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 16 of 24 PageID #:4284
17

methods, customer lists, financial information, credit card 

information, health information or any other type of 

nonpublic information.

 

PSOF ¶ 24. 

The first clause in this provision is unequivocal. “This insurance does not apply 

to . . . “personal and advertising injury” arising out of . . . any access to or disclosure 

of any person’s . . . personal information[.]” PSOF ¶¶ 24 (emphasis added). And the 

word “any” has a broad meaning. See, e.g., United States v. Gonzales, 520 U.S. 1, 5 

(1997) (“Read naturally, the word ‘any’ has an expansive meaning, that is, ‘one or 

some indiscriminately of whatever kind.’” (quoting WEBSTER’S THIRD NEW 

INTERNATIONAL DICTIONARY 97 (1976))). Because this language is clear and 

unambiguous, the Court ascribes to it its plain and ordinary meaning. See Sanders 

v. Ill. Union Ins. Co., 157 N.E.3d 463, 467 (Ill. 2019). 

Carnagio attempts to circumscribe the phrase “any access to or disclosure of 

any person’s . . . confidential or personal information” by pointing to the words that 

follow the word “including” and invoking the interpretative canon of ejusdem generis 

(“of the same kind”).6 As explained above, under this doctrine, “general words are 

construed to embrace only objects similar in nature to those . . . specific words.” 2A 

N. SINGER & S. SINGER, SUTHERLAND STATUTES AND STATUTORY CONSTRUCTION

§ 47:17 (7th ed. 2021). But this argument is unpersuasive for several reasons. 

First, ejusdem generis does not apply when the language at issue is 

unambiguous. See Tourdot v. Rockford Health Plans, Inc., 439 F.3d 351, 353 (7th Cir. 

6 Defendant Karikari does not oppose summary judgment on these grounds. See Def. 

Karikari Resp. Opp’n Pls.’ Mot. Summ. J. at 1 n. 1. 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 17 of 24 PageID #:4285
18

2006) (“Ejusdem generis provides guidance on how to interpret language where the 

meaning is not plain.”). Here, nothing is ambiguous about the phrase “any access to 

or disclosure of any person’s . . . personal information.”

Second, when items are introduced by the word “including,” the list that follows 

is not exclusive. See In re Schwartz, 799 F.3d 760, 763 (7th Cir. 2015) (“If you tell 

your maid to iron your clothes, including your Bond Street tuxedo and its 

cummerbund, there is no implication that she is not to iron your other clothes.”). In 

other words, the term “‘[i]nclude’ is a word of illustration, not limitation.” Richardson 

v. Nat’l City Bank of Evansville, 141 F.3d 1228, 1232 (7th Cir. 1998). Therefore, the 

words in the Access/Disclosure exclusion that appear after “including” cannot limit 

the scope of the preceding clause “any access to or disclosure of any person’s . . . 

personal information.”7

Third, “the interpretive canon of ejusdem generis . . . attribute[s] to the last 

item . . . the same characteristic of discreteness shared by all the preceding items.” 

Norton v. S. Utah Wilderness All., 542 U.S. 55, 63 (2004). But the canon does not 

apply when the items “are not sufficiently similar to belong to one identifiable class.” 

Hugh v. Amalgamated Tr. & Sav. Bank, 602 N.E.2d 33, 38 (Ill. App. Ct. 1992). 

Here, the items that are listed have no readily identifiable common thread (at 

least, not in the way that Carnagio ascribes). For example, the first items in the list, 

7 “Authorities have traditionally agreed that . . . [ejusdem generis] does not apply to a 

general-specific sequence.” Antonin Scalia & Bryan A. Garner, Reading Law: The 

Interpretation of Legal Texts 203 (2012). “In all contexts other than the pattern of specificto-general, the proper rule to invoke is the broad associated-words canon, not the narrow 

ejusdem generis canon.” Id. at 205.

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 18 of 24 PageID #:4286
19

“patents,” are publicly available information. 37 C.F.R. § 1.11 (2021) (“The 

specification, drawings, and all papers relating to the file of . . .[a] published 

application; a patent; or a statutory invention registration are open to inspection by 

the public . . . .”). By contrast, “credit card information” is not. See, e.g., 815 Ill. Comp. 

Stat. 530/5(1)(C) (defining “nonpublic personal information” as including a person’s 

credit card number). Indeed, despite its insistence that ejusdem generis applies in 

this case, Carnagio fails to point to any characteristic that is common to all items 

listed in the exclusion. See Carnagio Resp. at 9. Similarly, the Court finds that the 

items on the list are not sufficiently similar to belong to one identifiable class, thereby 

rendering ejusdem generis inapplicable. See CSX Transp., Inc. v. Ala. Dep’t of 

Revenue, 562 U.S. 277, 295 (2011) (“A canon meaning literally ‘of the same kind’ has 

no application to provisions directed toward dissimilar subject matter.”). 

Nevertheless, say that the Court were to apply the interpretive canon of 

noscitur a sociis, a broader variation of ejusdem generis, which “means literally ‘it is 

known from its associates,’ and means practically that a word may be defined by an 

accompanying word, and that, ordinarily, the coupling of words denotes an intention 

that they should be understood in the same general sense.” 2A SINGER & SINGER, 

supra, § 47.16; see also United States v. Williams, 553 U.S. 285, 294 (2008) (describing 

noscitur a sociis as “a commonsense canon . . . which counsels that a word is given 

more precise content by the neighboring words”); Beecham v. United States, 511 U.S. 

368, 371 (1994) (“That several items in a list share an attribute counsels in favor of 

interpreting the other items as possessing that attribute as well.”). The only readily 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 19 of 24 PageID #:4287
20

discernible resemblance is that several of the items, such as trade secrets, processing 

methods, customer lists, financial information, credit card information, and health 

information, denote certain categories of information which individuals and 

companies have a heightened interest in keeping from third-parties or the public at 

large, whether for financial reasons or otherwise. The biometric data that BIPA 

protects certainly falls within this category.8 And the Access/Disclosure exclusion not 

only applies to “confidential” information, but to an individual’s “personal” 

information as well, and Carnagio does not explain why biometric information would 

not constitute “personal” information as that term appears in the exclusion. 

The Court next turns to the allegations in the underlying litigation to 

determine whether they clearly fall within the Access/Disclosure exclusion. In the 

state-court case, Karikari alleges a wide range of BIPA violations. BIPA provides an 

action for damages against a private entity if it “disclose[s], redisclose[s], or otherwise 

disseminate[s] a person’s . . . biometric identifier or biometric information” without 

the person’s consent. 740 Ill. Comp. Stat. 14/15(d)(1); id. 14/20. BIPA’s definition of 

8 Other courts in this district have applied ejusdem generis or noscitur a sociis to an 

identical or similar provision and have arrived at the opposite conclusion. See, e.g., Am. Fam. 

Mut. Ins. Co. v. Caremel, Inc., No. 20 C 637, 2022 WL 79868, at *3 (N.D. Ill. Jan. 7, 2022); 

Citizens Ins. Co. of Am. v. Thermoflex Waukegan, LLC, No. 20-CV-05980, 2022 WL 602534, 

at *6–7 (N.D. Ill. Mar. 1, 2022). The Caramel court, applying ejusdem generis, held that 

biometric data is unlike “health information” or “financial information,” but it did little to 

assess whether the enumerated items share a common attribute. 2022 WL 79868, at *3. In 

Citizens, the court applied noscitur a sociis, relying on its interpretation of the BIPA to find 

that the exclusion did not unambiguously exclude coverage. 2022 WL 602534, at *7. For the 

reasons discussed herein, the Court respectfully disagrees. 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 20 of 24 PageID #:4288
21

“biometric identifier” includes fingerprint scans. Id. 14/10.9 The legislative findings 

state that such data requires protection because: 

[b]iometrics . . . are biologically unique to the individual; 

therefore, once compromised, the individual has no 

recourse, is at heightened risk for identity theft, and is 

likely to withdraw from biometric-facilitated transactions.

Id. 14/5(c). The stated purpose of BIPA is to regulate the collection, use, 

safeguarding, handling, storage, retention, and destruction of biometric identifiers 

and information in order to protect public welfare, security, and safety. Id. 14/5(g).

Karikari alleges, among other things, that Carnagio owes damages for 

disclosing Karikari’s fingerprint-scan information to a third-party vendor without 

Karikari’s consent. PSOF Ex. 7, ¶¶ 62–82, ECF No. 71-8. Indeed, the Seventh Circuit 

has described the invasion of privacy as “personal and real,” where, as here, a plaintiff 

alleges the full panoply of BIPA violations. Fox v. Dakkota Integrated Sys., LLC, 980 

F.3d 1146, 1149 (7th Cir. 2020); see id. at 1155 (stating that biometric identifiers “are 

immutable, and once compromised, are compromised forever”). Simply put, the statecourt litigation seeks damages arising out of a third-party’s access to or Carnagio’s 

disclosure of Karikari’s personal information, placing it clearly within the scope of 

the exclusion. 

Carnagio also argues that any construction that excludes coverage for damages 

based on the access to or disclosure of biometric information would consume the 

9 Additionally, BIPA’s definition of “biometric information” means “any information, 

regardless of how it is captured, converted, stored, or shared, based on an individual’s 

biometric identifier used to identify an individual.” 740 Ill. Comp. Stat. 14/10.

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 21 of 24 PageID #:4289
22

coverage grant for “personal and advertising injury.” Carnagio Resp. at 9–10; see

PSOF ¶ 24. But this is an overstatement. A “policy need not provide coverage against 

all possible liabilities; if it provides coverage against some, the policy is not illusory.” 

Nicor, Inc. v. Associated Elec. & Gas Ins. Servs. Ltd., 841 N.E.2d 78, 86 (Ill. App. Ct. 

2005), aff’d, 860 N.E.2d 280 (Ill. 2006); see Liberty Mut. Fire Ins. Co. v. Statewide Ins. 

Co., 352 F.3d 1098, 1101 (7th Cir. 2003) (rejecting the argument that the limitations 

were so broad that the policy provided no tangible coverage and holding that, under 

Illinois law, merely because coverage is limited does not make it illusory). Here, the 

policy defines “personal and advertising injury” to cover a broad range of claims that 

do not fall within the scope of the exclusion. See PSOF ¶ 14 (listing, among other 

things, false arrest, detention, imprisonment, malicious prosecution, and copyright 

and trade dress infringement). As a result, the exclusion at issue does not render 

coverage for “personal and advertising injury” meaningless. 

Along these same lines, Carnagio argues that the Court’s construction of the 

Access/Disclosure exclusion would swallow completely any coverage the policy

provides for lawsuits alleging “[p]ersonal and advertising injury . . . arising out of . . . 

[o]ral or written publication, in any manner, of material that violates a person’s right 

of privacy.” But this too is incorrect. 

Under Illinois law, the right to privacy encompasses more than a person’s right 

to maintain the confidentiality of their personal information. Take, for example, a 

person’s right not to be placed in a false light. Illinois law recognizes this as a privacy 

right: 

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 22 of 24 PageID #:4290
23

One who gives publicity to a matter concerning another 

that places the other before the public in a false light is 

subject to liability to the other for invasion of his privacy, 

if (a) the false light in which the other was placed would be 

highly offensive to a reasonable person, and (b) the actor 

had knowledge of or acted in reckless disregard as to the 

falsity of the publicized matter and the false light in which 

the other would be placed.

Lovgren v. Citizens First Nat’l Bank of Princeton, 534 N.E.2d 987, 989 (Ill. 1989) 

(quoting RESTATEMENT (SECOND) OF TORTS § 652E) (cleaned up). 

Claims for false light invasion of privacy seek damages arising out of a 

publication of material that violates a person’s right of privacy, and, therefore, would 

satisfy the definition of “personal and advertising injury” in the policy. Yet, such 

claims would not fall under the Access/Disclosure exclusion because they would not 

seek damages arising out of any access to or disclosure of any person’s confidential or 

personal information. Therefore, contrary to Carnagio’s contention, the Court’s 

construction of the Access/Disclosure exclusion would not render coverage under the 

policy illusory. For all of these reasons, the Court holds that the policy’s

Access/Disclosure provision precludes coverage of the Karikari lawsuit.10 

10 Because coverage is excluded outright under Austin Mutual’s policy, the issue of 

notice is moot as to this policy.

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 23 of 24 PageID #:4291
24

IV. Conclusion

For the foregoing reasons, the cross-motions for summary judgment are each

granted in part and denied in part as follows: The Court hereby issues a declaratory 

judgment that the Karikari lawsuit does not implicate the Austin Mutual policy 

issued to Carnagio and Austin Mutual has no obligation to defend or indemnify 

Carnagio in connection with the Karikari lawsuit. Furthermore, Karikari's suit is 

not excluded under the policy issued to Carnagio by American Family. 

IT IS SO ORDERED. ENTERED: 3/30/22

__________________________________

John Z. Lee

United States District Judge

Case: 1:20-cv-03665 Document #: 97 Filed: 03/30/22 Page 24 of 24 PageID #:4292