Northwestern University has become one of the latest Illinois institutions targeted under the state’s biometrics privacy law, as a new class action accuses the university of using facial recognition and other tools used in its online testing and instruction programs to improperly capture and store students’ biometric data.
The lawsuit was filed Jan. 27 in Cook County Circuit Court by attorneys Brian K. Murphy, Mary Turke, and others with the firms of Murray Murphy Moul + Basil LLP, of Columbus, Ohio; Turke & Strauss LLP, of Madison, Wis.; and Paronich Law P.C., of Hingham, Mass.
The lawsuit was filed on behalf of a woman, identified only as Jane Doe, a junior at Northwestern.
The complaint seeks to expand the action to include any Northwestern students who in the past five years took a test or other assessment that required them to use Northwestern’s so-called online proctoring tools.
Such online proctoring systems are designed to prevent cheating on tests conducted remotely. They work by using the student’s device to verify their identity and monitor their physical and digital movements.
However, the complaint asserts Northwestern’s use of its online proctoring system has violated the Illinois Biometric Information Privacy Act (BIPA.)
Enacted in 2008, the law was intended to protect Illinois residents against data breaches that may occur when companies that collect their so-called biometric identifiers – fingerprints, facial geometry, retinal scans and other unique physical characteristics – might go out of business. The law came in the wake of a bankruptcy involving a company that specialized in online payments, and had captured a trove of its users fingerprints, which had been used to verify their identities when making transactions.
The law gave plaintiffs the ability to sue, and seek damages of $1,000-$5,000 for each violation of the law’s provisions, which can be defined as each time a user’s biometric identifier is scanned.
The BIPA law included a number of technical notice and consent provisions, including those requiring companies to secure authorization from users before scanning and storing their biometrics, and those requiring notices be given to users concerning how their information would be stored, used, shared and ultimately destroyed.
The law has been used since 2015 by plaintiffs’ lawyers to target a range of companies and institutions, from tech giants, like Facebook, to employers of all sizes, and even charities, like the Salvation Army, in thousands of class action lawsuits.
In their complaint against Northwestern, the plaintiffs assert Northwestern allegedly failed to comply with those provisions before requiring students to use the online proctoring system when taking remote tests and assessments.
They assert, for instance, that students like Jane Doe were not aware of the collection and retention of their biometric data by the online proctoring system.
“The context in which Plaintiff Jane Doe was asked to accept an online proctoring service to take her exam – as a requirement to successfully complete a college course – did not give her a meaningful choice,” the complaint said.
The complaint identified two online proctoring services used by Northwestern, Respondus and Examity.
The complaint noted that dozens of Illinois colleges and universities use online proctoring services, and the use of such services has increased as colleges and universities shut down many in-person classes in response to the COVID-19 pandemic.
The complaint, however, said “petitions have sprung up” at colleges and universities across the country from faculty and students seeking to ban the use of such services, concerned they would be used to surveil students.
“Using these tools, Northwestern is able to collect and aggregate information on all aspects of a student’s life,” the complaint said. “… All the while students are left in the dark about the vast amount of information their university collects through remote proctoring tools.”
Northwestern has yet to reply to the new lawsuit.