BIPA, Remote Exams and Student Privacy (Powell v. DePaul University)

On November 4, 2022, the U.S. District Court for the Northeastern District of Illinois determined a privacy issue affecting universities and their students. Remote exam proctoring was on the rise before Covid-19, but many universities have continued utilizing the technology even where in-person classes are available.  Some students consider remote exam proctoring to be a violation of privacy rights, because the technology conducts its proctoring by video monitoring students, and tracking their keystrokes, amongst other things.

The plaintiff in this case was a DePaul University student who joined his classmates in a suit against DePaul for a violation of Illinois’ Biometric Information Privacy Act (BIPA). BIPA was enacted in 2008 to guard against the unlawful collection and use of biometric information. The student argued that DePaul violated BIPA by not disclosing its collection of biometric data through its remote exam technology and failing to obtain written consent from exam takers before collection, storing, and potentially dissemination of that student data.

BIPA overlaps with Federal privacy regulations in many areas. One of those areas is the privacy responsibilities of financial institutions. BIPA excludes financial institutions subject to Title V of the Gramm-Leach-Bliley Act (GLBA) from BIPA regulation. Title V of GLBA requires the Federal Trade Commission to issue regulations protecting consumer financial information held by financial institutions. Under GLBA, an organization is considered a financial institution if it is “significantly engaged in financial activities.” See 12 CFR §1016.3(1)(3)(i).

DePaul University moved to dismiss the case for failure to state a claim, arguing that it is excluded from BIPA regulations, and is instead a financial institution governed by Title V of GLBA. The District Court agreed. The District Court cited similar Illinois cases, involving Bradley University and Northwestern University, in its decision.  It concluded that while DePaul’s primary endeavor may be higher education; it is significantly engaged in financial activities. The District Court reasoned that through its participation in the federal student loan program, DePaul provides direct loans to consumers, and is exempt from BIPA. Instead, DePaul and other Illinois universities participating in the federal student loan program, are governed by Title V of GLBA. Ultimately, the District Court held that the plaintiff class failed to state a claim because it did not challenge DePaul’s participation in the federal student aid program.