Online college exam proctoring company Respondus can’t ditch a class action lawsuit brought by college students who accuse the company of violating Illinois’ biometrics privacy law, in the way its test-taking program scanned the faces of students taking exams, to ensure they weren’t cheating.
On March 23, U.S. District Judge Rebecca Pallmeyer, of the Northern District of Illinois, rejected most of Respondus’ efforts to dismiss the consolidated class actions.
Respondus has been among several companies offering online exam monitoring products targeted by such class action lawsuits in Illinois courts since 2020.
Mary Turke
| Turke & Strauss
The complaints against Respondus mirrored the other suits, as well, all of which accuse the test proctoring services of improperly scanning the facial geometry of students before and during their online tests.
Respondus’ product, Respondus Monitor, and similar proctoring programs, typically work by first locking down a student’s computer, to allow them to only interact with the exam while they are taking the test. Then, the product uses the computer’s camera and microphone to confirm the student’s identity, in part by scanning the student’s face. The program then monitors the student’s face and eyes throughout the exam to ensure they are not receiving help from off camera.
However, the complaints assert these scans violated students’ rights under the Illinois Biometric Information Privacy Act, because Respondus allegedly didn’t first secure written consent from students, authorizing them to scan their facial geometry and didn’t provide students with notice concerning how Respondus would collect, store, share and ultimately destroy the biometric scans.
Further, the complaints accused Respondus of profiting from the collection of the students’ biometric identifiers, because without such scans, the company could not have secured the test proctoring contracts from the colleges and universities that serve as Respondus’ customers.
Similar BIPA class actions have also targeted some of Respondus’ institutional customers, including Lewis University in Romeoville, Northwestern University in Evanston, and DePaul University in Chicago.
Lewis University was also targeted in one of the class actions against Respondus.
Northwestern and DePaul have been sued in separate actions that do not name Respondus as a co-defendant.
In response to the lawsuits against it, Respondus advanced several arguments, seeking dismissal.
Respondus notably argued the lawsuits should be invalidated by the terms to which students agree before they take a test.
Respondus said those terms include a “choice of law” provision, which ostensibly require students to use law from the state of Washington to resolve legal disputes.
Judge Pallmeyer, however, said that provision carries little weight, because the students, who were attending school in Illinois, were all but forced to agree to the terms, or risk being locked out of tests they are required to take.
Further, the judge noted the choice of law provision is printed far down in the student terms, in a place students would be unlikely to see it.
Altogether, Pallmeyer said this means the choice of law provision would all but strip students of their rights under the Illinois BIPA law and serve to short-circuit Illinois’ “fundamental public policy of protecting individual privacy rights in biometric information,” particularly since Washington has no analogous state law.
“Enforcing the Washington choice-of-law provision would thus thwart Plaintiffs’ individual right to assert biometric-privacy claims,” Pallmeyer wrote.
The judge also assigned low grades to Respondus’ attempts to directly contest the students’ BIPA claims.
Respondus argued students’ acceptance of its “Student Terms” prior to taking tests should satisfy the need to secure written consent from students before scanning and storing their biometrics.
Pallmeyer disagreed, saying the Student Terms were not clear enough to definitely confirm students had consented, specifically, to biometric scans, because they do not specifically state Respondus would capture those biometric identifiers, and explain how the scans would be used.
Further, Pallmeyer said Respondus cannot rely on the Student Terms to fend off student claims accusing the company of improperly disclosing or sharing the data.
“Without receiving notice that their biometric data was being collected (or was otherwise in the possession of Respondus), Plaintiffs could not possibly have consented to the further disclosure of that data to third parties,” Pallmeyer wrote.
The judge was more sympathetic to Respondus’ claims that students lacked standing to press other elements of their BIPA claims in federal court.
She expressed skepticism over students’ claims that Respondus had profited directly from the collection of student facial scans, calling the argument a bit “convoluted.”
And she also agreed students could not claim a concrete injury from Respondus’ alleged failure to post data retention schedules and guidelines.
However, she agreed to remand those claims to Cook County Circuit Court, where the students had first filed their lawsuit.
In recent months, plaintiffs have sought to have their BIPA cases sent back to Cook County and other local Illinois state courts, where different rules of standing and evidence often give plaintiffs an easier path toward securing a favorable settlement.
A growing number of the companies targeted in the thousands of class actions filed in recent years under Illinois’ BIPA law have opted to settle, rather than try to fight the cases.
Under prior Illinois Supreme Court rulings, plaintiffs suing under the BIPA law do not need to demonstrate they suffered anything more than a technical violation of the law before pressing legal claims carrying potentially massive price tags. And courts, to date, have largely rejected defense strategies mounted by businesses to either toss the lawsuits, or at least reduce their exposure to massive financial damages.
The BIPA law allows plaintiffs to demand damages of $1,000-$5,000 per violation. And courts have interpreted the law to define individual violations as each time a company scans someone’s biometrics.
Hundreds of Illinois employers have been targeted under the law, for instance, usually over the use of so-called biometric timeclocks, which require workers to scan a fingerprint or other biometric identifier to verify their identity each time they punch in or out of a work shift.
Faced with potentially crippling judgments worth many millions or even billions of dollars, many employers and other companies have opted instead to settle, with most settlements ranging from hundreds of thousands of dollars to $25 million.
However, larger companies, like Facebook, have also settled BIPA claims. Facebook agreed to pay $650 million to settle a class action lawsuit over the social media platform’s photo tagging system, which scanned users’ faces to track their photos across Facebook.
Attorneys typically claim about a third of those settlements. In the Facebook case, lawyers were awarded $97.5 million.
Class members typically receive a few hundred dollars each from the settlements.
It is not known if Respondus and the student plaintiffs have yet engaged in settlement talks.
However, the lawsuits against Respondus will continue, following Pallmeyer’s ruling.
Also in her ruling, Pallmeyer rejected Lewis University’s attempt to extract itself from the class actions.
The judge refused Lewis’ argument that it should be treated as a government-regulated financial institution, which would exempt it from BIPA’s requirements.
And Pallmeyer noted terms provided by Respondus expressly indicate the recordings of the online exams proctored by Respondus would be “controlled by” the university, and could be “evaluated” by the university and its agents, for up to four years after the exam.
Pallmeyer similarly remanded claims against Lewis over its data retention guidelines, and concerning whether the university had profited from the facial scans.
The judge, however, dismissed claims concerning whether Lewis had improperly disclosed or shared the data. Pallmeyer said the students did not sufficiently claim Lewis ever did so.
Plaintiffs are represented by attorney Mary C. Turke, and others with the firms of Turke & Strauss, of Madison, Wisconsin; Murray Murphy Moul + Basil, of Columbus, Ohio; and Paronich Law, of Hingham, Massachusetts.
Respondus is represented by attorney Bonnie Keane DelGobbo, and others with the firm of Baker & Hostetler, of Chicago and Orlando.