CHICAGO — An online college test proctoring company says a federal judge shouldn't allow lawyers to hammer it with class action lawsuits under Illinois' biometrics privacy law, because the proctoring company is actually protected from those lawsuits by a federal banking law.
On Oct. 1, Examity asked U.S. District Judge Franklin Valderrama to dismiss a complaint from plaintiffs Christine Rodriguez and Amber Mich, who sued Examity under the Illinois Biometric Information Protection Act.
Rodriguez and Mich were added as plaintiffs in the lawsuit to replace former named plaintiff Paul Clarke. After Examity had challenged Clarke's suit, he had voluntarily dropped his claims. His lawyers then replaced him with Rodriguez and Mich.
The new attempt to sue Examity “fares no better than the first,” according to Examity’s attorneys, including Melissa Siebert, from the Chicago firm of Shook, Hardy & Bacon.
Mich, an NU student, used Examity during two tests in late 2020 and March 2021. The lawsuit accused Examity of improperly collecting biometric identifiers from students using their service when taking exams at Northwestern University and Olivet Nazarene University, without first securing written authorization from students, or by providing users with certain notices, as allegedly required by the BIPA law.
According to Examity, its college clients, including Olivet Nazarene and Northwestern, qualify as “financial institutions” under BIPA’s definitions.
Examity said the Federal Trade Commission has deemed schools to be financial institutions because of their involvement in student loans.
So such entities are also protected by Title V of the Gramm-Leach-Bliely Act, which has its own mandates for “significant privacy disclosures and protections," Examity argued, and should similarly block lawsuits under BIPA against the test proctoring services used by those colleges.
Examity noted Northwestern is facing a different BIPA lawsuit related to online proctoring. In moving to dismiss that lawsuit, Northwestern invoked the financial institution protections before U.S. District Judge Joan Lefkow. Examity said Lefkow’s eventual opinion will be “persuasive, if not controlling” in the Rodriguez and Mich action.
Examity also said although it offers four types of proctoring services, its Live Premium option involves a human proctoring a remote exam telling students to keep their eyes on a screen. Examity said its Live Premium option doesn’t trigger BIPA protections because the live human monitoring isn't the same as a computerized collection of personal identifiers.
Although the company collects photos of students who take exams, “physical descriptions are excluded from BIPA, as are photographs. Facial expressions and body movements, eye gaze and motion are no more than ‘physical descriptions’ under BIPA, as are all of the other items plaintiffs contend that Examity collects.”
The complaint, Examity said, “is an exercise in creative, if not misleading, screen shots” from its website. It noted the amended complaint purposefully omits references to Live Premium and said the students “cannot maintain BIPA claims based on technology their universities did not use. They should not be permitted to mislead the Court by selective and incomplete citations to Examity’s website.”
According to the motion to dismiss, “It is true that Examity’s live proctor compares a test-taker’s ‘real-time webcam feed’ and ID brought to the test, with the test-taker’s ‘ID on file.’ ” But the “assertion ‘on information and belief’ that the ID check also involves the use of artificial intelligence is both unwarranted and unsupported — Examity’s website makes clear that ID checks are performed by humans, without exception. Moreover, AI is not a term used in BIPA at all, nor is the term ‘facial recognition,’ another term used — on information and belief — throughout plaintiffs’ complaint.”
The FTC also noted colleges and universities are subject to stringent privacy rules under the Family Educational Rights and Privacy Act.
Furthermore, Examity argued, as an outsourced proctor it is considered a “school official” subject to FERPA compliance “with respect to any student data it collects, uses or stores,” including regulations on biometric data. It said the amended complaint doesn’t include Examity’s website references to compliance with international privacy laws.
Examity also said allegations it didn’t have a data retention schedule “are contradicted by the same public webpage that plaintiffs depict only a portion of” in the amended complaint, noting the site says it typically deletes exam videos after 60 days, or up to a year if a school has concerns. Furthermore, BIPA allows private entities up to three years to delete data, and the oldest test referenced in the complaint is from January 2020.
Plaintiffs are represented in the case by attorneys Carl V. Malmstrom, of the firm of Wolf Haldenstein Adler Freeman & Herz, of Chicago; Alec M. Leslie, Max S. Roberts and Christopher R. Reilly, of the firm of Bursor & Fisher, of New York and Miami; Benjamin H. Richman, Ari J. Scharg, J. Eli Wade-Scott and Schuyler Ufkes, of the firm of Edelson P.C., of Chicago; and Randall K. Pulliam and David F. Slade, of Carney Bates and Pulliam, of Little Rock, Arkansas.