A putative class action lawsuit against DePaul University was dismissed with prejudice on November 4, 2022 by the US District Court for the Northern District of Illinois on the grounds that the Illinois Biometric Privacy Act (BIPA) does not apply to DePaul.
The complaint, filed by a DePaul student on behalf of himself and others similarly situated, alleged that the university’s engagement of a company, Respondus, Inc., to provide online content and exam monitoring during and prior to the COVID-19 pandemic, and the university’s use of Respondus’ software, “Respondus Monitor,” violated BIPA. The plaintiff claimed that Respondus Monitor incorporated facial recognition technology, and that prior to January 21, 2021, the terms of use that had to be accepted by students in order to take exams online did not disclose the collection, analysis, storage or dissemination of biometric identifiers, and did not entail the students’ consent.
DePaul moved to dismiss the complaint for failure to state a claim, asserting that it was exempt from BIPA as a financial institution subject to Title V of the Gramm-Leach-Bliley Act (GLBA). Title V requires that federal banking regulators and the US Federal Trade Commission issue rules covering the collection, use and protection of consumer financial information. GLBA covers “financial institutions,” and defines them as “businesses that are significantly engaged in financial activities.” Under GLBA, financial activities include credit counseling services, loan brokering and loan servicing, companies that offer consumers financial products or services like loans, financial or investment advice, or insurance.” Both the FTC and the US Department of Education have stated that they consider colleges and universities to be financial institutions for purposes of GLBA. The court took into consideration the agencies’ statements and the decisions of five state and federal courts in Illinois, reaching the conclusion that DePaul’s participation in the US Department of Education’s federal student aid program rendered it a financial institution under GLBA.
And since Section 28(c) of BIPA provides that “Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder,” the court found that DePaul is subject to federal privacy regulation and exempt from BIPA. Consequently, the complaint was dismissed with prejudice.