A federal judge has let DePaul University escape a class action complaint accusing it of breaking a state biometrics law when logging facial scans for students taking exams online.
The ruling, which U.S. District Judge Robert Gettleman issued Nov. 4, turned on the school’s argument it qualifies for a “financial institution” exemption under the Biometric Information Privacy Act. Gettleman's opinion stands at odds with conclusions reached in other federal BIPA litigation.
DePaul student Cody Powell initiated the class action in Cook County Circuit Court, alleging DePaul deployed online exam proctoring technology through a product known as Respondus Monitor allegedly without complying with the BIPA law's requirements regarding informed consent and data retention.
Mary Turke
| Turke & Strauss
The law generally requires any business that scans an Illinois resident's so-called biometric identifiers - such as fingerprints, retinas or face - to first obtain written consent to conduct the scans, and to provide the people being scanned with notices concerning how the data will be stored, used and ultimately destroyed.
DePaul removed the complaint to federal court, then moved to dismiss the case.
According to Powell’s complaint and similar lawsuits, Respondus and other online test technology, which gained popularity as schools shifted to online education at the outset of the Covid-19 pandemic, locks a computer to allow students to interact only with the exam while they are taking the test. Then, the product uses the computer’s camera and microphone to confirm the student’s identity, in part by scanning the student’s face. The program then monitors the student’s face and eyes throughout the exam to ensure they are not receiving help from off camera.
In arguing for dismissal, DePaul said it should qualify as a "financial institution" subject to Title V of the Gramm-Leach-Bliley Act, a class of businesses not required to follow the BIPA law's notice and consent requirements, based on its participation in the U.S. Department of Education’s Federal Student Aid Program.
Gettleman's ruling comes about two months after his colleague, U.S. District Judge Mary Rowland, refused to dismiss a nearly identical complaint against Resurrection University. Rowland agreed the BIPA exemption “applies to institutions of higher education that are significantly engaged in financial activities” and agreed schools like Resurrection can qualify as financial institutions under Title V. But she said the question was one of fact that should be determined later in proceedings. So she refused to allow Resurrection to dismiss the case.
Rowland's opinion had followed a July 15 decision issued by U.S. District Judge Andrea Wood, who said the Illinois Institute of Technology also had to prove its status as a Title V financial institution before she would dismiss a complaint regarding its use of Respondus Monitor.
Gettleman noted he took over the DePaul case from U.S. District Judge Robert Dow, who recently left the federal bench in Chicago for a post as counselor to U.S. Supreme Court Chief Justice John Roberts.
Judge Gettleman said he relied heavily on the Federal Trade Commission’s recognition of colleges and universities as Title V financial institutions.
Specifically, Gettleman said he found “the FTC’s position, issued at a time that it had both enforcement and rulemaking authority, particularly persuasive because it evidences longstanding, consistent and well-reasoned interpretation of the statute that it had been tasked to administer.”
Gettleman further said the 2010 Dodd-Frank Act transferred to the Consumer Financial Protection Authority the general authority to make Title V rulings, and the next year the new agency “adopted and republished the privacy rules originally promulgated by the FTC.” He said at least five other courts agreed the BIPA exemption applies in line with DePaul’s arguments, including Wood’s July opinion.
Although student loans aren’t DePaul’s primary business, Gettleman said, it constitutes a significant enough portion of the schools activities to trigger exemption. He further rejected Powell’s argument DePaul can’t raise the exemption as an affirmative defense, saying Powell didn’t challenge DePaul’s participation in the federal student aid program, which is the underlying fact used to establish his dismissal.
Colleges and other businesses targeted by class actions under the Illinois BIPA law could face potentially massive payouts, if such cases were to go to trial.
Under the BIPA law, plaintiffs can demand damages of $1,000-$5,000 per violation. The law has been interpreted to define individual violations as each time a biometric identifier as scanned. When multiplied across thousands of potential plaintiffs, the damages could quickly mount well into the many millions of dolllars.
For example, in the first BIPA class action lawsuit to go to trial, a jury recently ordered freight rail company BNSF to pay $228 million to a group of about 14,000 truck drivers who claimed the company violated the BIPA law in the way it required the drivers to scan their handprints to verify their identities when entering BNSF rail yards. BSNF failed to win dismissal of the case, even though it noted the handprint scans were part of anti-terrorism security measures required by the federal government.
Other businesses targeted by BIPA class actions have opted to settle to avoid such risk at trial. Facebook and Google, for instance, notably agreed to settle BIPA class actions against them related to face scans of photos uploaded to their platforms. Facebook paid $650 million and Google, $100 million, to end the lawsuits.
Most other settlements to date have ranged from hundreds of thousands of dollars to as much as $50 million.
Powell and the class of additional DePaul student plaintiffs have been represented in the case by attorneys Brian K. Murphy Jonathan P. Misny, of the firm of Murray Murphy Moul + Basil, of Columbus, Ohio; and Mary C. Turke ,Samuel J. Strauss and Raina C. Borrelli, of Turke & Strauss, of Madison, Wisconsin.
DePaul has been represented by attorneys Michael D. Hayes and Karen L. Courtheoux, of the firm of Husch Blackwell, of Chicago.
Jonathan Bilyk contributed to this report.