Nos. 23-1521 & 23-1578 THERMOFLEX WAUKEGAN, LLC, Plaintiff-Appellant, Cross-Appellee,

v. MITSUI SUMITOMO INSURANCE USA, INC., Defendant-Appellee, Cross-Appellant. ____________________

Appeals from the United States District Court for the Northern District of Illinois, Eastern Division. No. 21 C 788 — John Z. Lee and Thomas M. Durkin, Judges. ____________________

ARGUED JANUARY 17, 2024 — DECIDED MAY 17, 2024 ____________________

Before FLAUM, EASTERBROOK, and PRYOR, Circuit Judges. EASTERBROOK, Circuit Judge. Thermoflex Waukegan re- quired hourly workers to use handprints to clock in and out. This led to a claim that doing so without workers’ wriXen con- sent, and using a third party to process the data, violated the Biometric Information Privacy Act, 740 ILCS 14/1 to 14/20 (BIPA or the Act). Thermoflex had multiple insurance policies in force during the years in question, including three from Mitsui Sumitomo Insurance. We call these the Basic, Excess, 2 Nos. 23-1521 & 23-1578 and Umbrella policies. Mitsui declined to defend or indem- nify Thermoflex, leading to this suit under the diversity juris- diction. (The litigation between Thermoflex and its workers is in state court.) Before his appointment to this court, Judge Lee concluded that an exclusion in the Basic policy renders it inapplicable to any claim based on the Act. 595 F. Supp. 3d 677 (N.D. Ill. 2022). The exclusion provides that the insurance does not apply to [claims] arising out of any access to or disclosure of any person’s or organization’s confidential or personal infor- mation, including patents, trade secrets, processing methods, cus- tomer lists, financial information, credit card information, health information or any other type of nonpublic information. Judge Lee thought its application straightforward: the Act identifies biometric information as confidential (“nonpub- lic”), see 740 ILCS 14/10, 14/15(e)—and, although the effect of the exclusion depends on the meaning of the policy rather than the meaning of the Act, the ordinary understanding of “confidential or personal information” includes handprints and other biometric identifiers usable for identity theft. Illinois enforces unambiguous language in insurance pol- icies. See, e.g., Sanders v. Illinois Union Insurance Co., 2019 IL 124565 ¶23. Thermoflex maintains that this policy is ambigu- ous because the exclusion mentions patents, which are public. True, the list contains mismatched items. But how does this create ambiguity about either the opening phrase (“any per- son’s or organization’s confidential or personal information”) or the catchall (“any other type of nonpublic information”)? Sticking one blue item into a list that begins “all red items in- cluding …” and closes “plus anything pink” does not nullify the language’s application to ruby-colored things. See, e.g., Nos. 23-1521 & 23-1578 3 CSX Transportation, Inc. v. Alabama Department of Revenue, 562 U.S. 277, 295 (2011) (explaining that the ejusdem generis canon does not limit general language just because items in a list are dissimilar). Thermoflex also relies on Citizens Insurance Co. v. Wynndalco, 70 F.4th 987 (7th Cir. 2023), which holds that, un- der Illinois law, an exclusion for coverage of claims based on “laws, statutes, ordinances, or regulations, that address, pro- hibit or limit the printing, dissemination, disposal, collecting, recording, sending, transmiXing, communicating or distribu- tion of material or information” does not apply to a claim un- der BIPA. Wynndalco concluded that a broad reading of this exclusion would nullify coverages expressly provided else- where in the policy. It did not take long for a state appellate court to hold that Wynndalco misun