Powell v. DePaul Univ.

• Decision Date: 04 November 2022
• Docket Number: 21 C 3001
• Parties: CODY POWELL, individually and on behalf of all others similarly situated, Plaintiff, v. DEPAUL UNIVERSITY, Defendant.
• Court: U.S. District Court — Northern District of Illinois

CODY POWELL, individually and on behalf of all others similarly situated, Plaintiff,
v.
DEPAUL UNIVERSITY, Defendant.

No. 21 C 3001

United States District Court, N.D. Illinois, Eastern Division

November 4, 2022

MEMORANDUM OPINION AND ORDER

Robert W. Gettleman United States District Judge

Plaintiff Cody Powell, a student at DePaul University, on behalf of himself and all others similarly situated, brought a First Amended Putative Class Action Complaint (“complaint”) against defendant DePaul in the Circuit Court of Cook County, Illinois, alleging that defendant's use of Respondus Monitor, an online remote proctoring tool designed and administered by Respondus Inc., violates Illinois' Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et. seq., by capturing, using, and storing students' facial recognition and other biometric identifiers and biometric information. Defendant removed the case to this court and then moved to dismiss under Fed.R.Civ.P. 12(b)(6) for failure to state a claim, arguing that BIPA's express terms specify that it does not apply to financial institutions that are subject to Title V of the Gramm-Leach-Bliley Act (“GLBA”) and rules promulgated under that Act. Because defendant participates in the U.S. Department of Education's Federal Student Aid Program, it is considered a financial institution subject to Title V of the GLBA. As a result, BIPA does not apply and defendant's motion to dismiss is granted.

BACKGROUND ^[1]

1

According to the complaint, defendant is a private university located in Chicago, Illinois. It offers undergraduate and graduate programs to more than 21,000 students both in person and through online learning programs. In offering online courses, defendant requires that many student exams be conducted using the Respondus Monitor online proctoring tool. According to plaintiff, Respondus Monitor “captures, uses, and stores vast amounts of data, including facialrecognition data, facial detection data, recorded patterns of keystrokes, eye monitoring data, gaze monitoring data, and camera and microphone recordings to effectively surveil students taking online exams.” Plaintiff alleges that defendant does not disclose or obtain written consent before collecting, capturing, storing, or disseminating user's biometric data, and fails to disclose what it does with that biometric data after collection, in violation of BIPA's retention and destruction requirements.

DISCUSSION

Defendant has moved under Fed.R.Civ.P. 12(b)(6) to dismiss the complaint for failure to state a claim. Such a motion challenges the sufficiency of the complaint, not its merits. Fed.R.Civ.P. 12(b)(6); see Gibson v. City of Chi., 910 F.2d 1510, 1520 (7th Cir. 1990). To survive a Rule 12(b)(6) motion, the complaint must not only provide the defendant with fair notice of a claim's basis but must also be facially plausible. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); see also Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. “A motion

2

under Rule 12(b)(6) can be based only on the complaint itself, documents attached to the complaint, documents that are critical to the complaint and referred to in it, and information that is subject to proper judicial notice.” Geinosky v. City of Chicago, 675 F.3d 743, 745 n. 1 (7^thCir. 2012).

BIPA was enacted “to help regulate the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” Rosenbach v. Six Flags Ent. Corp., 129 N.E. 3d 1197, 1203 (Ill. 2019). It imposes numerous restrictions on how private entities collect, retain, disclose, and destroy such information. Id. at 1199. Section 25 (c) of the act provides, however, that “[n]othing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the Gramm-Leach-Bliley Act of 1999 and the rule promulgated thereunder.” 740 ILCS 14/25(c). “BIPA does not apply to financial institutions already subject to GLBA.” Staffer v. Innovative Heights Fairview Heights, LLC, 480 F.Supp.3d 888, 903 (S.D. Ill. 2020).

Defendant argues that, like all other colleges and universities with federally authorized financial aid programs, it is a financial institution that is subject to Title V of the GLBA and must comply with its implementing rules. Title V regulates how financial institutions treat nonpublic personal information about consumers. 15 U.S.C. §§ 6801-09. The GLBA defines a financial...