Harvey v. Resurrection University

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION BRITTNEY HARVEY, individually and on behalf of all others similarly situated, Case No. 21-cv-3203 Plaintiff, Judge Mary M. Rowland v. RESURRECTION UNIVERSITY, Defendant. MEMORANDUM OPINION AND ORDER Plaintiff Brittney Harvey brings this putative class action against Defendant Resurrection University alleging violations of the Illinois Biometric Information Privacy Act (BIPA), 740 Ill. Comp. Stat. § 14/1–99. Resurrection University moves to dismiss the complaint under Federal Rule of Civil Procedure Rule 12(b)(6). For the reasons stated herein, Defendant’s Motion to Dismiss [15] is denied. I. Background The following factual allegations are taken from the First Amended Class Action Complaint (“Complaint”) (Dkt. 1-1) and are accepted as true for the purposes of the motion to dismiss. See Lax v. Mayorkas, 20 F.4th 1178 , 1181 (7th Cir. 2021). Harvey is a student at Resurrection University (Resurrection), a private university with its main campus in Chicago, Illinois. Dkt. 1-1 at ¶ 1. During the COVID-19 pandemic, Resurrection, like many colleges around the country, offered coursework that required students to take quizzes and exams online. Id. at ¶ 23. These exams are conducted using an online remote proctoring tool called Respondus Monitor1 (Respondus). Id. at ¶ 2. Since March 2020, Harvey enrolled in numerous courses at Resurrection that require the use of Respondus. Id. at ¶ 93. While agreeing to use Respondus for her exams, Harvey did not know it would collect and analyze her biometric identifiers before and during the exams. Id. at ¶ 96. Through Respondus, and without students’ consent, Resurrection collects, captures and stores student information including students’ facial features and voice when students take exams online in a non-proctored environment. Id. at ¶¶ 2, 3, 30. Before January 21, 2021, the Respondus “Monitor Terms of Use for Students,” which students had to accept to take an exam, did not disclose that Respondus Monitor would use facial recognition technology to collect and disseminate students’ biometric information. Id. at ¶ 43. The terms also do not disclose that Respondus shares biometric identifiers and information with Amazon Web Services. Id. at ¶ 50. Harvey brings four claims alleging BIPA violations: first, that Resurrection does not have a written publicly-available policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers (Count I). Id. at ¶ 116. Count II alleges that Resurrection collects, captures, and obtains biometric identifiers or information without informing students in writing that information is being collected or stored. Id. at ¶ 127. Harvey also alleges that Resurrection profits from requiring students to use Respondus (Count III). Id. at ¶ 137. Count IV alleges that Resurrection, through Respondus, discloses or disseminates students’ biometric 1 Respondus Monitor is not a named defendant in this suit. identifiers or biometric information to Amazon Web Services and university instructors and other agents without students’ consent. Id. at ¶¶ 143–44. Resurrection removed this case from state court in June 2021, and now moves to dismiss arguing that it is exempt under BIPA’s financial-institution exemption. II. Standard “To survive a motion to dismiss under Rule 12(b)(6), the complaint must provide enough factual information to state a claim to relief that is plausible on its face and raise a right to relief above the speculative level.” Haywood v. Massage Envy Franchising, LLC, 887 F.3d 329, 333 (7th Cir. 2018) (quotations and citation omitted). See also Fed. R. Civ. P. 8(a)(2) (requiring a complaint to contain a “short and plain statement of the claim showing that the pleader is entitled to relief”). A court deciding a Rule 12(b)(6) motion “construe[s] the complaint in the light most favorable to the plaintiff, accept[s] all well-pleaded facts as true, and draw[s] all reasonable inferences in the plaintiff’s favor.” Lax, 20 F.4th at 1181. However the court need not accept as true “statements of law or unsupported conclusory factual allegations.” Id. (citation and internal quotation marks omitted). “While detailed factual allegations are not necessary to survive a motion to dismiss, [the standard] does require more than mere labels and conclusions or a formulaic recitation of the elements of a cause of action to be considered adequate.” Sevugan v. Direct Energy Servs., LLC, 931 F.3d 610, 614 (7th Cir. 2019) (cleaned up). Dismissal for failure to state a claim is proper “when the allegations in a complaint, however true, could not raise a claim of entitlement to relief.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 558 (2007). Deciding the plausibility of the claim is “‘a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.’” McCauley v. City of Chicago, 671 F.3d 611, 616 (7th Cir. 2011) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009)). III. Standing Although neither party has raised standing, “[w]hen a requirement goes to subject-matter jurisdiction,” courts must consider the issue sua sponte. Gonzalez v. Thaler, 565 U.S. 134 , 141 (2012); see also Freedom From Religion Found., Inc. v. Nicholson, 536 F.3d 730, 737 (7th Cir. 2008). “At the pleading stage, [Article III] standing requires allegations of a concrete and particularized injury in fact that is traceable to the defendant’s conduct and redressable by judicial relief.” Cothron v. White Castle Sys., Inc., 20 F.4th 1156 , 1160 (7th Cir. 2021) (citations omitted).2 Standing must be demonstrated for each claim. Johnson v. U.S. Off. of Pers. Mgmt., 783 F.3d 655, 661 (7th Cir. 2015). Harvey brings claims under Sections 15(a), 15(b), 15(c), and 15(d) of BIPA. The Court has reviewed the allegations and finds that Harvey’s standing is secure for two of her claims, but that she lacks standing to pursue her Sections 15(a) and 15(c) claims (Counts I and III). For her Section 15(b) claim, Harvey’s allegations satisfy the injury requirement. See Dkt. 1-1, ¶¶ 96–99, 122–131. Under Seventh Circuit law, “a failure to follow section 15(b) of the law leads to an invasion of personal rights that is both concrete 2 “[S]tanding requirements in Illinois courts are more lenient than those imposed by Article III.” Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 , 622 (7th Cir. 2020), as amended on denial of reh'g and reh'g en banc (June 30, 2020). and particularized.” Bryant v. Compass Group, Inc., 958 F.3d 617 , 626 (7th Cir. 2020). Similarly, under Section 15(d), a plaintiff may allege a concrete informational injury. See Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604 (N.D. Ill. 2020). Harvey’s allegations (Dkt. 1-1, ¶¶ 96–97, 143–46) meet this standard. As in Cothron, “the relevant information…is personal and substantive and would have provided [Harvey] an opportunity to object to the way her data was being handled or to opt out of the system entirely.” 467 F. Supp. 3d at 613. Sections 15(a) and 15(c), however, “impose duties owed only to the public generally,” so alleging a regulatory violation alone is insufficient. See Cothron, 20 F.4th at 1161; see also Thornley v. Clearview AI, Inc., 984 F.3d 1241 (7th Cir. 2021). For Section 15(a), both a failure to comply with a data-retention schedule and unlawful retention of biometric data constitutes an injury. See Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146 , 1149 (7th Cir. 2020); see also Cothron, 20 F.4th at 1161 (“the unlawful retention of biometric data, just like its unlawful collection, works a concrete and particularized Article III injury.”). Harvey’s allegations are not sufficient to confer standing for her 15(a) claim. See Patterson v. Respondus, Inc., No. 20 C 7692, 2022 WL 860946 , at *25 (N.D. Ill. Mar. 23, 2022) (finding lack of standing for section 15(a) claim where plaintiff’s “allegations about retention and destruction are entirely conclusory … [and did] not meaningfully allege that [defendant] violated ‘fully panoply’ of section 15(a)’s requirements.”). She alleges that Resurrection does not comply with the requirements to have a retention schedule or destruction guideline and the school is “in possession of biometric identifiers or biometric information” belonging to students. Dkt. 1-1, ¶¶ 115–16. As in Patterson, Harvey “merely parrots the statutory language without making any specific factual allegations about retention.” No. 20 C 7692, 2022 WL 860946 , at *25. Section 15(c) prohibits an entity from “profit[ing] from a person’s or a customer’s biometric identifier or biometric information.” 740 ILCS 14/15(c). However allegations of a general, regulatory violation alone are insufficient when not accompanied by a particularized injury to the plaintiff. Thornley, 984 F.3d at 1246 (holding that a regulatory violation of 15(c) is not considered particularized and concrete). Harvey alleges that Resurrection negligently and recklessly profits from gathering students’ data and this unlawful conduct caused injury to her and the proposed class. She alleges that “Resurrection offer[s] online coursework and [] receive[s] tuition dollars from students” and saves money by not needing to pay proctors to monitor students during exams. Dkt. 1-1 at ¶¶ 136–39. Without allegations about how Harvey was personally affected by Resurrections’ alleged profiting, she has failed to establish standing for a section 15(c) claim in federal court. See Carpenter v. McDonald’s Corp., No. 21-cv-02906, 2021 WL 6752295 , at *4–5 (N.D. Ill. Nov. 1, 2021) (finding that a plaintiff lacked standing where he did not allege a personal, individual harm that Thornley required and his allegations were little more than “a recitation of the general regulatory violation proscribed by Section 15(c)”); see also Patterson, No. 20 C 7692, 2022 WL 860946 , at *26 (finding that plaintiffs lacked standing for their section 15(c) claim against school); Duerr v. Bradley Univ., No. 121CV01096SLDJEH, 2022 WL 1487747 , at *3 (C.D. Ill. Mar. 10, 2022) (allegations about defendant’s alleged unlawful profit “d[id] not speak to the nature of Plaintiffs’ resultant injury.”). Accordingly, Harvey has Article III standing for her claims under Sections 15(b) and (d) but lacks Article III standing for her section 15(a) and 15(c) claims. These claims are severed and remanded to state court. See Duerr, No. 121CV01096SLDJEH, 2022 WL 1487747 , at *4; Patterson, No. 20 C 7692, 2022 WL 860946 , at *27. The Court turns next to the dismissal motion. IV. Motion to Dismiss Resurrection seeks dismissal on the grounds that it is exempt from BIPA because it is a financial institution subject to Title V of the Gramm-Leach-Bliley Act of 1999 (GLBA). Harvey responds that the plain meaning of “financial institution” does not include universities, that Resurrection is not a financial institution subject to the GLBA, and that BIPA’s legislative intent supports her position. Finally, she contends that accepting Resurrection’s position would render BIPA invalid. A. Section 25(c) of BIPA BIPA was designed to safeguard the public against the collection and retention of biometric identifiers. 740 ILCS 14/5(g). To do so, the legislation “imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers.” Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1199 (Ill. 2019). Those restrictions, however, do not apply to certain entities. Section 25(c) of BIPA provides: “Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder.” 740 ILCS 14/25(c) (hereafter, “Section 25(c)”). Matters of statutory interpretation are questions of law. See Gaffney v. Riverboat Servs. of Ind., Inc., 451 F.3d 424, 458 (7th Cir. 2006). BIPA is an Illinois state law, so the Court applies Illinois’ statutory interpretation rules. See Pastors Protecting Youth v. Madigan, 237 F. Supp. 3d 746, 749 (N.D. Ill. 2017). In Illinois “[t]he plain language of a statute is the best indication of the legislature’s intent.” Maksym v. Bd. of Election Comm’rs of City of Chi., 950 N.E.2d 1051, 1060 (Ill. 2011). “Where . . . a statutory term is not defined, [the courts] assume the legislature intended for it to have its popularly understood meaning. Likewise, if a term has a settled legal meaning, the courts will normally infer that the legislature intended to incorporate that established meaning into the law.” Rosenbach, 129 N.E.3d at 1205 (construing BIPA). B. Section 25(c) and Higher Education Institutions Resurrection argues that because it is subject to Title V of the GLBA as a “financial institution,” it is exempt from BIPA under Section 25(c). Dkt. 16 at 3. Under the GLBA, Resurrection argues, colleges and universities are financial institutions because they are an “institution … engaging in financial activities as described in section 1843(k) of Title 12.” 15 U.S.C. § 6809 (3)(A). Id. at 6. Section 1843(k) describes financial activities as “[l]ending, exchanging, transferring, investing for others, or safeguarding money or securities.” 12 U.S.C. § 1843 (k)(4)(A). Section 25(c) exempts those institutions. Harvey responds that Resurrection is not subject to the GLBA because Resurrection is not a financial institution under the plain meaning of BIPA and there is no proof of Resurrection “engaging in financial activities”. BIPA does not define the term “financial institution.” However, courts defer to an agency’s construction of a statute to give meaning as long as the construction is reasonable. See Jeffers v. Comm’r of Internal Revenue, 992 F.3d 649 , 564 (7th Cir. 2021). The Federal Trade Commission (“FTC”), which promulgates rules pursuant to GLBA, considers colleges and universities to be financial institutions subject to Title V where “such institutions appear to be significantly engaged in lending funds to consumers.” Fed. Trade Comm’n, Privacy of Consumer Financial Information, Final Rule, 65 Fed. Reg. 33,648 (May 24, 2000). A number of district court cases have recently addressed the issue presented here. Most recently, in Fee v. Illinois Inst. of Tech., No. 21-CV-02512, 2022 WL 2791818 , at *1 (N.D. Ill. July 15, 2022) (Wood, J), the Court found that there is “little doubt that an institution of higher education like IIT can be considered a financial institution subject to Title V of the GLBA where it regularly extends and administers student loans.” Id. at *3. The Court accordingly concluded that BIPA’s Section 25(c) “applies to institutions of higher education that are significantly engaged in financial activities, such as making or administering student loans.” Id. at *6. However the Court denied IIT’s motion to dismiss because “whether IIT qualifies for BIPA's exemption presents a question of fact better addressed at a later stage in the proceedings.” Id. Other courts have similarly concluded that Section 25(c) extends beyond just banks. Doe v. Northwestern Univ., No. 21 C 1579, 2022 WL 1485905 (N.D. Ill. Feb. 22, 2022); see also Duerr, No. 121CV01096SLDJEH, 2022 WL 1487747 , at *6 (concluding “that Section 25(c) exempts ‘financial institution[s]’ subject to the GLBA from BIPA” and finding university defendant exempt because it demonstrated it is a financial institution within the meaning of the GLBA by virtue of its significant engagement lending funds to consumers); Jane Doe v. Elmhurst University, No. 201400 (Cir. Ct., 18th Judicial Cir., Du Page Cty., Ill.) (same). These courts have dismissed plaintiff’s complaint on that basis. In Patterson, by contrast, the court declined to find at the motion to dismiss stage that the university defendant was exempt from BIPA under Section 25(c), without foreclosing that possibility. See Patterson No. 20 C 7692, 2022 WL 860946 , at *22 (explaining that “the court cannot dismiss the case on the dubious basis that Lewis has presented, and it is unwilling to untangle this web of agency authority without the benefit of further briefing.”); see also Powell v. DePaul Univ., No. 21-cv-3001 (N.D. Ill. Mar. 28, 2022) (stating that “the issue of whether DePaul University qualifies as an institution subject to the GLBA is not adequately briefed” and deferring ruling on motion to dismiss). This Court agrees with the reasoning in Fee v. Illinois Inst. of Tech. and similarly concludes that BIPA’s Section 25(c) applies to institutions of higher education that are significantly engaged in financial activities. Resurrection has alleged enough at this pleading stage. Its motion contains publicly available information from the FTC and U.S. Department of Education (DOE) about its status as a financial institution and compliance with the GLBA. Resurrection argues that it is a financial institution subject to Title V of the GLBA because it participates in the DOE Federal Student Aid program and is required to comply with the GLBA and its implementing rules, the DOE and FTC have issued statements showing that they consider higher education institutions to be financial institutions under the GLBA, and due to the “significant role colleges and universities play with respect to student financial aid” (Dkt. 16 at 2–6). Resurrection cites to: the school’s website describing its significant financial aid program, its listing on DOE’s website as a participant in the Federal Student Aid Program, the DOE’s Federal Student Aid Handbook stating that participating institutions in the Federal Student Aid Program must comply with the GLBA (and evidence that Resurrection has in fact entered into this Program Participation Agreement with the DOE). (Id. at 7–8). The Court takes judicial notice of the publicly available information.3 But as in Fee, whether Resurrection actually qualifies for the exemption is a factual question best left for a later stage in the case. See Fee, No. 21-CV-02512, 2022 WL 2791818 , at *5 (to find the school is actually exempt, “the Court must also conclude that IIT regularly extends and administers student loans”). In response, Harvey makes several arguments that have been rejected by other courts. Harvey suggests that this Court consider legislative history, arguing that 3 See Ennenga v. Starns, 677 F.3d 766 , 773–74 (7th Cir. 2012) (“Taking judicial notice of matters of public record need not convert a motion to dismiss into a motion for summary judgment.”). “financial institution” was meant to only apply to banks under BIPA. Dkt. 22 at 6. However, like other courts addressing this issue, this Court finds that the plain language is clear, so it need not consult the legislative history.4 Harvey also relies on N.Y. State Bar Ass’n v. Fed. Trade Comm’n, 276 F. Supp. 2d 110 (D.D.C. 2003), to assert that universities in compliance with the Federal Educational Rights and Privacy Act (FERPA) are exempt from the GLBA. Dkt. 22 at 11. As the Doe court explained, that case was “merely describing the regulations, not articulating any new exemptions.” No. 21 C 1579, 2022 WL 1485905 , at *2. See also 12 C.F.R. § 1016.1 (b)(2)(ii) (discussing compliance with the GLBA). The Fee court explained that plaintiff’s reliance on FERPA was not persuasive because the argument was based on “an earlier version of the FTC’s rule—which has since been republished by the [Consumer Financial Protection Bureau (‘CFPB’)].” No. 21-CV02512, 2022 WL 2791818 , at *5. Further, an institution of higher education subject to the GLBA “must still comply with other Title V regulations such as those governing financial institutions’ standards for implementing and maintaining safeguards to protect the security of customer information.” Id. (citing 16 C.F.R. §§ 314 .1–314.6) 4 See Duerr, No. 121CV01096SLDJEH, 2022 WL 1487747 , at *6 (finding “no ambiguity in the statutory language”); Fee, No. 21-CV-02512, 2022 WL 2791818 , at *4 (“Had the legislature intended for the term ‘financial institution’ to have a different meaning than Title V of the GLBA's definition of that same term, it would have spoken more clearly.”); Doe, No. 21 C 1579, 2022 WL 1485905 , at *2 (declining to consult legislative history where section 25(c)’s plain language was clear). As the Seventh Circuit has explained, “[i]f the statutory language’s plain meaning is unambiguous, our inquiry ends there.” United States v. Melvin, 948 F.3d 848 , 852 (7th Cir. 2020); see also Harris v. Manor Healthcare Corp., 489 N.E.2d 1374, 1380 (Ill. 1986). Harvey also argues that collecting student biometric information during test taking is not a financial transaction. However, Section 25(c)’s plain language is clear: “Nothing in this Act shall be deemed to apply in any manner to a financial institution.” 740 Ill. Comp. Stat. 14/25(c) (emphasis added). Finally, Harvey contends that “excluding much of the private sector (particularly larger entities) from BIPA based on Resurrection’s interpretation is irrational, improper, and would eliminate BIPA protection for customers and employees of such entities.” Dkt. 22 at 12. This argument is not convincing. A similar argument was rejected in Doe, 2022 WL 1485905 , at *2: “[T]he exemption does not undermine BIPA’s remedial purpose because the exempted financial institutions are still subject to GLBA’s privacy scheme.” See also Fee, 2022 WL 2791818 at *4 (rejecting the same argument); see also Stauffer v. Innovative Heights Fairview Heights, LLC, 480 F. Supp. 3d 888 , 901–03 (“The financial institution distinction made by BIPA cannot be found to be ‘artificially narrow’ in its focus since both exempt and non-exempt financial institutions are subject to data reporting laws, with neither group receiving a benefit the other does not.”); Bryant v. Compass Grp. USA, Inc., 503 F. Supp. 3d 597 , 601 (N.D. Ill. 2020) (“The General Assembly likely excluded financial institutions because they are already subject to a comprehensive privacy protection regime under federal law..…[Financial] institutions already had privacy safeguards in place, so imposing additional obligations on them would have been minimally efficacious.”). In sum, the Court finds that Section 25(c) of BIPA applies to institutions of higher education that are significantly engaged in financial activities, but declines to find at this stage that Resurrection does in fact qualify for this exemption. V. Conclusion For these reasons, Defendant’s Motion to Dismiss [15] is denied. The Section 15(a) and 15(c) claims (Counts I and are severed and remanded to state court. Counts II and IV may proceed in this court. ENTER: Dated: August 29, 2022 Marg Vf bo L/ MARY M. ROWLAND United States District Judge