A putative class action lawsuit against DePaul University was dismissed with prejudice on November 4, 2022 by the US District Court for the Northern District of Illinois on the grounds that the Illinois Biometric Privacy Act (BIPA) does not apply to DePaul.
DePaul moved to dismiss the complaint for failure to state a claim, asserting that it was exempt from BIPA as a financial institution subject to Title V of the Gramm-Leach-Bliley Act (GLBA). Title V requires that federal banking regulators and the US Federal Trade Commission issue rules covering the collection, use and protection of consumer financial information. GLBA covers “financial institutions,” and defines them as “businesses that are significantly engaged in financial activities.” Under GLBA, financial activities include credit counseling services, loan brokering and loan servicing, companies that offer consumers financial products or services like loans, financial or investment advice, or insurance.” Both the FTC and the US Department of Education have stated that they consider colleges and universities to be financial institutions for purposes of GLBA. The court took into consideration the agencies’ statements and the decisions of five state and federal courts in Illinois, reaching the conclusion that DePaul’s participation in the US Department of Education’s federal student aid program rendered it a financial institution under GLBA.
And since Section 28(c) of BIPA provides that “Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder,” the court found that DePaul is subject to federal privacy regulation and exempt from BIPA. Consequently, the complaint was dismissed with prejudice.