In the case of Thornley v. Citizens Insurance Company of America, No. 1:24-CV-05525 (N.D. Ill. Mar. 28, 2026), the U.S. District Court for the Northern District of Illinois addressed an insurance coverage dispute arising from an underlying class action lawsuit alleging violations of the Illinois Biometric Information Privacy Act (BIPA). While the decision solidifies the unambiguous applicability of the Access or Disclosure Exclusions to BIPA claims, it also illustrates the potential for the mend-the-hold and waiver doctrines to prevent an insurer from invoking a policy exclusion it failed to timely assert. 

Background
Thornley v. Citizens Insurance Company of America stems from an underlying class action against Wynndalco Enterprises, LLC (Wynndalco), a company that allegedly purchased and sold a facial recognition database and software technology created by Clearview AI, Inc. (Clearview). 

The plaintiffs in the underlying suit brought claims against Wynndalco for violations of Section 15(c) of BIPA, invasion of privacy, and unjust enrichment on behalf of current Illinois citizens whose biometric information was included in the Clearview product purchased and sold by Wynndalco. At the time, Wynndalco was insured by Citizens Insurance Company of America (Citizens) under a commercial general liability policy. Wynndalco tendered the defense and indemnification to Citizens, which denied coverage. 

Citizens filed a declaratory judgment action in the Northern District of Illinois, seeking a ruling that it owed no duty to defend or indemnify Wynndalco. Citizens Ins. Co. of Am. v. Wynndalco Enters., LLC, 2021 WL 269842 (N.D. Ill., Jan. 27, 2021). In that suit, Citizens relied solely on its Statutory Violations Exclusion. The district court ruled in favor of Wynndalco and the plaintiffs, finding the exclusion ambiguous and holding that Citizens had a duty to defend. The Seventh Circuit affirmed. Citizens Insurance Company of America v. Wynndalco Enterprises, LLC, 70 F.4th 987, 991 (7th Cir. 2023).

Meanwhile, the underlying class action settled for US $20million. Under the settlement, Wynndalco paid $50,000 and assigned its rights to payment under the Citizens insurance policy to the plaintiffs and the settlement class. The plaintiffs, now as assignees, brought suit against Citizens for breach of contract, alleging that Citizens was obligated to indemnify Wynndalco and pay the settlement. Citizens moved for judgment on the pleadings, this time on the basis that its Access or Disclosure Exclusion applies to exclude coverage for the underlying class action settlement. The plaintiffs opposed the motion, cross-moved for judgment on the pleadings, and moved for partial summary judgment on the issue of claim preclusion. 

The Access or Disclosure Exclusion Applies to BIPA Claims
As a preliminary matter, the court addressed whether the Access or Disclosure Exclusion in the Citizens policy precluded coverage for the underlying suit. The exclusion bars coverage for damages arising out of any access to or disclosure of any person’s or organization’s confidential or personal information, including a broad enumeration of information types. The court found this issue squarely decided by the Seventh Circuit’s decision in Thermoflex Waukegan, LLC v. Mitsui Sumitomo Insurance USA, Inc., 102 F.4th 438 (7th Cir. 2024), which held that a virtually identical exclusion applied to BIPA claims because biometric identifiers fall within the ordinary understanding of “confidential or personal information.” The court also cited Citizens Insurance Co. of America v. Mullins Food Products, Inc., 135 F.4th 1082 (7th Cir. 2025), which reaffirmed this holding. 

Although the assignee/plaintiffs attempted to distinguish the case on the ground that the underlying suit alleged a violation of Section 15(c) of BIPA, which rather than addressing access or disclosure prohibits profiting from biometric information, the court found this distinction unpersuasive. The court reasoned that Wynndalco’s profit from the biometric information entailed accessing and disclosing it. The court similarly rejected the plaintiffs’ proximate-causation argument, holding that Wynndalco’s profit could not be reaped without its access and disclosure, meaning the exclusion was triggered. The court, therefore, concluded that the Access or Disclosure Exclusion applied to exclude coverage for the underlying class action.

Mend-the-Hold and Waiver Doctrines Preclude Judgment on the Pleadings
Although the court held that the Access and Disclosure Exclusion applied to preclude coverage, it nonetheless denied Citizens’ motion for judgment on the pleadings. The court found that there was a genuine issue of material fact as to whether the mend-the-hold and waiver doctrines applied, barring Citizens from relying on the Access and Disclosure Exclusion. 

Under the mend-the-hold doctrine, an insurer is precluded from “denying a claim on one basis and then changing the basis for denial during litigation if there is evidence of unfair surprise or arbitrariness.” Title Indus. Assurance Co., R.R.G. v. First Am. Title Ins. Co., 853 F.3d 876, 885 (7th Cir. 2017). In this case, the court found that the plaintiffs raised multiple factual disputes material to the application of the doctrine. First, Citizens changed the basis for its denial of coverage between the declaratory judgment suit it filed and the case filed by the assigns/plaintiffs. Specifically, Citizens initially relied solely on the Statutory Violations Exclusion and did not mention the Access or Disclosure Exclusion in its coverage letters and, more importantly, in the prior litigation. Only after both the district court and the Seventh Circuit rejected the Statutory Violations Exclusion, and Wynndalco settled with the plaintiffs, did Citizens assert the Access or Disclosure Exclusion. 

Moreover, internal analysis from Citizens’ own agents, prepared before it filed its declaratory judgment suit, discussed how the Access or Disclosure Exclusion likely precluded coverage. This evidence suggested that Citizens was aware all along that the exclusion could apply but chose not to raise it until its original coverage defense failed. The court also noted that new legal authority, such as the Mitsui decision, did not provide a good-faith reason for an insurer’s change in strategy under Illinois law. 

The plaintiffs also presented evidence of prejudice, arguing that Citizens’ piecemeal assertion of policy exclusions caused delays, additional expenses (Wynndalco allegedly spent over $135,000 litigating the declaratory judgment suit), and disruption to the assumptions underlying the settlement. 

On waiver, the court found an additional dispute of fact: over four years passed from when Citizens first denied coverage in July 2020 to when it first asserted the Access or Disclosure Exclusion in this suit in August 2024. The court noted that Citizens’ bare reservation of rights to assert other coverage defenses in its initial coverage letters may be insufficient to defeat waiver, particularly given evidence that Citizens believed the exclusion applied but chose not to assert it. 

The case now proceeds to discovery on the mend-the-hold and waiver issues, with the parties ordered to file a joint status report proposing a discovery schedule. Whether Citizens can ultimately invoke the Access or Disclosure Exclusion to avoid indemnification will depend on the resolution of these fact issues.

Implications for Coverage Disputes
The Thornley decision carries several important implications for insurers and policyholders navigating not only BIPA-related disputes but also coverage disputes generally.

First, the decision reinforces the growing body of Seventh Circuit authority holding that Access or Disclosure Exclusions apply to BIPA claims. Insurers can take comfort in the ordinary meaning of “confidential or personal information” encompasses biometric identifiers, and that claims premised on profiting from biometric data will not escape the exclusion simply because they are framed under Section 15(c) of BIPA rather than the access or disclosure-specific provisions. 

Second, and perhaps most significantly for claims-handling practices, the decision sounds a cautionary note about the piecemeal assertion of policy exclusions, particularly in litigation. The court’s analysis of the mend-the-hold doctrine makes clear that an insurer’s failure to assert an applicable exclusion at the outset of coverage litigation may very well preclude the insurer’s ability to rely on such a defense. Moreover, when internal analysis suggests an exclusion applies, it should be expressed. Otherwise, it may operate as a waiver of that defense. A general reservation of rights is also likely insufficient to preserve an exclusion that the insurer is aware of and yet fails to specifically identify for years. Insurers should identify and assert all known potentially applicable exclusions in their initial coverage position letters, or in supplemental coverage positions letters, and then in any coverage litigation at the outset, rather than holding defenses in reserve.