{"id":170,"date":"2022-11-07T19:44:11","date_gmt":"2022-11-07T23:44:11","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=170"},"modified":"2022-11-07T19:44:11","modified_gmt":"2022-11-07T23:44:11","slug":"illinois-federal-court-holds-private-university-is-exempt-from-bipa-regulations","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2022\/11\/07\/illinois-federal-court-holds-private-university-is-exempt-from-bipa-regulations\/","title":{"rendered":"Illinois Federal Court Holds Private University Is Exempt From BIPA Regulations"},"content":{"rendered":"

\"\"<\/a>By Gerald L. Maatman, Jr., Jennifer A. Riley, and Alex W. Karasik<\/strong><\/p>\n

\u00a0<\/strong>Duane Morris Takeaway<\/em><\/strong>: \u00a0<\/strong>In an important ruling for higher education entities, Judge Robert Gettleman of the U.S. District Court for the Northern District of Illinois recently dismissed<\/a>\u00a0a student\u2019s proposed class action alleging that Defendant\u2019s remote test-proctoring software violated the Illinois Biometric Information Privacy Act (\u201cBIPA\u201d). The Court determined that Defendant DePaul University qualified as a financial institution exempt from the statute. Powell v. DePaul University<\/em>, No. 21-C-3001, 2022 U.S. Dist. LEXIS 201296 (N.D. Ill. Nov. 4, 2022). Employers in the higher education space who are confronted with biometric privacy class actions can tuck this ruling away for potential use at the pleading stage.<\/p>\n

Case Background <\/strong><\/p>\n

Plaintiff alleged that Defendant\u2019s use of the Respondus Monitor, an online remote proctoring tool, violated the BIPA by capturing, using, and storing students’ facial recognition and other biometric identifiers and biometric information. Plaintiff specifically asserted that Defendant did not \u201cdisclose or obtain written consent before collecting, capturing, storing, or disseminating user’s biometric data, and failed to disclose what it does with that biometric data after collection, in violation of BIPA’s retention and destruction requirements. Id<\/em>. at *2.<\/p>\n

Defendant moved to dismiss the action pursuant to Rule 12(b)(6) for failure to state a claim. It argued that the BIPA’s express terms specify that it does not apply to financial institutions that are subject to Title V of the Gramm-Leach-Bliley Act (\u201cGLBA\u201d). Id<\/em>. Defendant contended that since it was a participant in the U.S. Department of Education’s Federal Student Aid Program, it is considered a financial institution subject to Title V of the GLBA. \u00a0Defendant contended that both the Federal Trade Commission (\u201cFTC\u201d) and the Department of Education (\u201cDOE\u201d) have recognized that universities are considered financial institutions under the GLBA. Defendant also asserted that Title V rulemaking authority lies with the Consumer Financial Protection Bureau (\u201cCFPB\u201d), which adopted and republished the privacy rules originally promulgated by the FTC.\u00a0 The FTC rules state that any institution \u201csignificantly engaged in financial activities\u201d is a financial institution. Id<\/em>. at *5.<\/p>\n

Plaintiff argued that Defendant was not a financial institution, but rather was in the business of higher education. Thus, Plaintiff contended that Defendant was not subject to Title V, and therefore subject to the BIPA.<\/p>\n

The Court\u2019s Decision<\/strong><\/p>\n

The Court granted Defendant\u2019s motion to dismiss.\u00a0 First, the Court noted that at least five other district courts have ruled on the same issue and rejected Plaintiff\u2019s argument, and have determined that the BIPA\u2019s section 25(c) exemption for financial institutions applies to institutions of higher education. Id.<\/em><\/p>\n

In support of its conclusion, the Court found that the guidance provided by the CFPB included examples demonstrating the word \u201csignificantly” means something less than \u201cprimary.\u201d Id<\/em>. at *8. Accordingly, the Court rejected Plaintiff\u2019s argument that the exemption should not apply was because Defendant was not primarily in the financial business. Id<\/em>.<\/p>\n

The Court further explained that the DOE provided issued public guidance in 2020 reiterating that the GLBA required financial institutions to have information privacy protections, and that the FTC \u201chas enforcement authority for the requirements and has determined that institutions of higher education (institutions) are financial institutions under GLBA.\u201d Id<\/em>. at *4-5.<\/p>\n

Additionally, the Court opined that the FTC\u2019s rule, made in 2000 when it had enforcement and rulemaking authority under the GLBA, also considered universities to be financial institutions if they \u201cappear to be significantly engaged in lending funds to consumers.\u201d Id<\/em>. at *6.\u00a0The Court reasoned that the consistent interpretation of the statute by multiple entities was particularly persuasive in finding that the claims should be dismissed. For these reasons, the Court granted Defendant\u2019s motion to dismiss Plaintiff\u2019s claims with prejudice.<\/p>\n

Implications For Employers<\/strong><\/p>\n

In the BIPA class action landscape, federal and state courts in Illinois have rejected many potential affirmative defenses that employers have used to try and stave off these massive cases. However, even though the exemption is somewhat narrow, higher education institutions now have a blueprint to attack BIPA class actions at the pleading stage.\u00a0 Finally, to the extent states beyond Illinois enact similar privacy statutes, this ruling may be of use to higher education institutions in those states that are confronted with class actions.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Alex W. Karasik \u00a0Duane Morris Takeaway: \u00a0In an important ruling for higher education entities, Judge Robert Gettleman of the U.S. District Court for the Northern District of Illinois recently dismissed\u00a0a student\u2019s proposed class action alleging that Defendant\u2019s remote test-proctoring software violated the Illinois Biometric Information Privacy … <\/p>\n

Continue reading “Illinois Federal Court Holds Private University Is Exempt From BIPA Regulations”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,9,22],"class_list":["post-170","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":9,"user_id":576,"is_guest":0,"slug":"jariley","display_name":"Jennifer A. Riley","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2023\/08\/rileyjennifer-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":22,"user_id":582,"is_guest":0,"slug":"awkarasik","display_name":"Alex W. Karasik","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2023\/08\/karasikalex-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/170","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=170"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/170\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=170"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=170"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=170"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=170"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}