Opinion
Case No. 21 C 1579
2022-02-22
Jane DOE, individually and on behalf of a class of similarly situated individuals, Plaintiff, v. NORTHWESTERN UNIVERSITY, Defendant.
Brian Kevin Murphy, Jonathan Patrick Misny, Murray Murphy Moul Basil LLP, Columbus, OH, Mary C. Turke, Raina C. Borrelli, Samuel J. Strauss, Pro Hac Vice, Turke & Strauss LLP, Madison, WI, Anthony Paronich, Paronich Law, P.C., Hingham, MA, for Plaintiff. David Charles Layden, Reid J. Schar, Elena Marie Olivieri, Jenner & Block LLP, Chicago, IL, for Defendant.
Brian Kevin Murphy, Jonathan Patrick Misny, Murray Murphy Moul Basil LLP, Columbus, OH, Mary C. Turke, Raina C. Borrelli, Samuel J. Strauss, Pro Hac Vice, Turke & Strauss LLP, Madison, WI, Anthony Paronich, Paronich Law, P.C., Hingham, MA, for Plaintiff.
David Charles Layden, Reid J. Schar, Elena Marie Olivieri, Jenner & Block LLP, Chicago, IL, for Defendant.
ORDER
Joan H. Lefkow, United States District Judge
Defendant Northwestern University's motion to dismiss (dkt. 15) is granted. This case is terminated. See statement.
STATEMENT
Plaintiff Jane Doe attends Northwestern University. (Dkt. 1-1 ¶¶ 1, 34). Throughout the COVID-19 pandemic, Northwestern required her and other students to take exams outside of the classroom using third-party online remote proctoring tools. (Id. ¶ 2). These tools capture and store various user data, including "biometric" data. (Id. ¶¶ 3–4). Doe filed an action on behalf of herself and others similarly situated alleging that Northwestern's use of these third-party proctoring tools violated the Illinois Biometric Information Privacy Act (BIPA), 740 Ill. Stat. Comp. 14/1 et seq. (Id. ¶¶ 42-48, 50-61.)
Northwestern removed the action to federal court pursuant to the Class Action Fairness Act, 28 U.S.C. §§ 1332(d), 1453, on the basis of class size, minimal diversity, and an adequate amount in controversy. (Dkt. 1.) Venue is proper under 28 U.S.C. § 1446.
Northwestern moves to dismiss the action under Federal Rule of Civil Procedure 12(b)(6). A Rule 12(b)(6) motion challenges a complaint for failure to state a claim upon which relief may be granted. In ruling on such a motion, the court accepts as true all well-pleaded facts and draws all reasonable inferences from those facts in the plaintiff's favor. See Active Disposal, Inc. v. City of Darien , 635 F.3d 883, 886 (7th Cir. 2011). To survive a Rule 12(b)(6) motion, the complaint must establish that the requested relief is plausible on its face. See Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). The allegations in the complaint must be "enough to raise a right to relief above the speculative level." Bell Atl. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007).
In this diversity action, Illinois law controls. See In re: Emerald Casino, Inc. , 867 F.3d 743, 765 (7th Cir. 2013). Where, as here, there is no controlling decision by the Illinois Supreme Court on the relevant issue, see Zahn v. N. Am. Power & Gas, LLC , 815 F.3d 1082, 1087 (7th Cir. 2016), the court gives "proper regard" to lower Illinois court decisions, see Blood v. VH-1 Music First , 668 F.3d 543, 546 (7th Cir. 2012).
BIPA regulates the collection, usage, and general handling of biometric information by private entities. Section 25(c) of BIPA, however, exempts from coverage "a financial institution ... that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 [(GLBA)] and the rules promulgated thereunder." 740 Ill. Stat. Comp. 14/25(c). Northwestern argues that Doe's complaint must be dismissed because it is a financial institution subject to Title V of GLBA and therefore exempt under section 25(c).
Doe raises several arguments to avoid dismissal. First, Doe argues that the exemption does not apply because neither Northwestern nor any university is a "financial institution" under BIPA. BIPA does not separately define the term "financial institution," and Doe does not argue for adopting any particular definition. Instead, Doe argues that "financial institution" simply cannot include universities based on definitions from dictionaries and other statutes. But the only case addressing the applicability of the 25(c) exemption to a university, Jane Doe v. Elmhurst University , No. 20-1400 (Cir. Ct., 18th Judicial Cir., Du Page Cty., Ill.), ruled that the plain meaning of "financial institution" in BIPA is the same as in GLBA, which includes universities. (Dkt. 28-24–26.)
Relatedly, Doe argues that section 25(c) suggests a two part-test and the court must first determine that Northwestern is a "financial institution" before looking at whether it is subject to Title V of GLBA. Doe argues that this two-step inquiry supports its theory that BIPA's definition is different from that of GLBA. In support, Doe cites Stauffer v. Innovative Heights Fairview Heights, LLC , 480 F. Supp. 3d 888 (S.D. Ill. 2020), but this case did not set out a separate definition for "financial institution," as Doe suggests; it merely recognized that some financial industry defendants are not subject to Title V of GLBA and therefore are not exempt under section 25(c). Id. at 902.
Second, Doe argues that exempting Northwestern under section 25(c) would contradict BIPA's remedial purpose. Doe uses BIPA's legislative history to argue that section 25(c) was only meant to apply to "banks that are covered under federal law," not universities. Il. H.R. Tran. 2008 Reg. Sess. No. 276 at 249 (May 30, 2008). But there is no need to consult legislative history where section 25(c)’s plain language makes clear that it applies to any "financial institution," not just banks. See United States v. Melvin , 948 F.3d 848, 852 (7th Cir. 2020). Further, the exemption does not undermine BIPA's remedial purpose because the exempted financial institutions are still subject to GLBA's privacy scheme.
Next, Doe argues that Northwestern has not established that it is subject to Title V of GLBA and therefore exempt. Title V of GLBA governs the treatment of nonpublic personal information about consumers by financial institutions. 15 U.S.C. §§ 6801 – 09. Under GLBA, a financial institution is "any institution the business of which is engaging in financial activities." Id. § 6809(3)(A). The Federal Trade Commission (FTC), which promulgates rules pursuant to GLBA, considers colleges and universities to be financial institutions subject to Title V where "such institutions appear to be significantly engaged in lending funds to consumers." Fed. Trade Comm'n, Privacy of Consumer Financial Information, Final Rule, 65 Fed. Reg. 33,648 (May 24, 2000). Courts defer to an agency's construction of the statute it is charged with administering so long as the construction is reasonable. See Jeffers v. Comm'r of Internal Revenue , 992 F.3d 649, 654 (7th Cir. 2021). Given GLBA's broad definition, the FTC's interpretation that universities that lend funds to consumers are financial institutions under GLBA is reasonable. As to Northwestern's status as an institution of higher education that "significantly engage[s] in lending funds," publicly available government documents confirm it to be so, e.g. , Fed. Student Aid Office, U.S. Dept. of Educ., Protecting Student Information (July 29, 2015), and Doe cites nothing to the contrary.
Doe also argues that Northwestern is not subject to Title V of GLBA because it complies with FERPA. Doe points to N.Y. State Bar Ass'n v. Fed. Trade Comm'n , 276 F. Supp. 2d 110, 144 (D.D.C. 2003), which mentions that universities that comply with the Federal Educational Rights and Privacy Act (FERPA) are "exempt" from GLBA requirements. But universities that comply with FERPA are deemed in compliance with, not exempt from, GLBA, see 16 C.F.R. § 313.1(b) ; 12 C.F.R. § 1016.1(b)(2)(ii), and the court in N.Y. State Bar Ass'n was merely describing the regulations, not articulating any new exemptions. 276 F. Supp. 2d at 144. Doe asserts that Northwestern's compliance with FERPA does not justify its exemption from BIPA because FERPA does not contain equivalent privacy protections. Nevertheless, the plain language of section 25(c) exempts Northwestern as a financial institution subject to Title V of GLBA, and the court must apply it as such.
Last, Doe's argument that applying 25(c) to Northwestern could render BIPA unconstitutional "special legislation" is unavailing. Similar arguments have been rejected by other courts. See Bryant v. Compass Grp. USA, Inc. , 503 F. Supp. 3d 597, 601 (N.D. Ill. 2020) ; Stauffer , 480 F. Supp. 3d at 902. Doe offers no rationale warranting a contrary result here.
For these reasons, Northwestern is exempt from BIPA under section 25(c). The motion to dismiss is granted and the complaint dismissed with prejudice.