Federal Court Dismisses BIPA Lawsuit Against Private Universities and Colleges Participating in Federal Student Aid Program
Nov 14, 2022
A federal court has dismissed a lawsuit against DePaul University for allegedly violating the Illinois Biometric Information Privacy Act (“BIPA”) through the use of an online proctoring tool, Respondus Monitor. Although BIPA does not apply to public colleges and universities, the case generated interest across the postsecondary sector in light of broader privacy concerns regarding the use of such tools in higher education.
The lawsuit, Powell v. DePaul University, originated as a class action lawsuit filed in Illinois state court. In the state lawsuit, a student acting as a class representative alleged that DePaul University collected biometric identifiers and information through the use of Respondus Monitor, which recorded students’ facial geometry and other biometric identifiers that were then made accessible to the university, research institutions, and biometric experts. According to the allegations contained in the lawsuit, students were unaware of the collection, retention, use, and dissemination of biometric identifiers and information in violation of BIPA, which affords various consumer protections against such practices by private entities. Specifically, students alleged that the university violated the law by failing to provide adequate disclosures, establish appropriate policies, or secure written releases from students regarding the use of biometric identifiers and information protected by BIPA.
On June 4, 2021, the university succeeded in having the lawsuit removed to the United States District Court for the Northern District of Illinois. After removal to federal court, the university moved to dismiss the case, arguing that an exemption in BIPA for “financial institutions” should be applied to the university. On November 4, 2022, the federal court granted the university’s motion, finding that the university qualified as a financial institution under BIPA because of its participation in the U.S. Department of Education’s Federal Student Aid Program. The court specifically noted that BIPA does not apply to financial institutions subject to the Gramm-Leach-Bliley Act, consistent with at least five other court decisions involving higher education institutions in Illinois.
For more information on BIPA or data privacy requirements for colleges and universities, please contact your Robbins Schwartz attorney.