Over the last several years, class action lawsuits filed under the Illinois Biometric Information Privacy Act (BIPA) have proliferated. These lawsuits have tended to come in waves: from claims involving consumer-facing devices and technology companies using facial recognition, to lawsuits related to employers using so-called biometric timeclocks for employee timekeeping purposes, to clusters of cases targeting different industries. Recently, we have seen the beginnings of a new wave: BIPA class action cases brought against universities and other educational institutions concerning remote exam-proctoring software that allegedly uses facial recognition software. Entities in this space should take note of this new wave of BIPA class action litigation.
Background
Class action lawsuits brought under BIPA have been flooding court dockets. These cases typically allege violations of various procedural requirements associated with the collection, use, retention or disclosure of “biometric identifiers” or “biometric information.” These procedures include providing written notice, obtaining written consent, and maintaining a publicly available retention policy.
The types of biometrics expressly covered under BIPA are a “retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” BIPA also applies to information based on those biometrics used to identify an individual.
Because the Illinois Supreme Court has held that an individual may be “aggrieved” under BIPA, and thereby entitled to bring a cause of action, even without a showing of actual harm, BIPA class action lawsuits have become a prolific area for the plaintiffs’ bar — with hundreds of such lawsuits winding their way through the courts. Companies that have employees, or do business, in Illinois have been targeted with BIPA class actions in a variety of contexts. Because the law in this area is relatively undeveloped and because the potential recovery can be substantial, there are strong incentives to bring even doubtful cases with the expectation of settlement. A recently approved $650 million dollar settlement against Facebook could only encourage such filings.
Latest Potential Trend — Exam-Proctoring Software
Over the last several weeks, there have been multiple BIPA class action lawsuits brought against universities and other similar entities. These lawsuits have been brought on behalf of students who, while in Illinois, have used online, remote exam-proctoring software that allegedly captures their facial geometry and other data. Plaintiffs allege defendants have collected and used their alleged biometrics without complying with BIPA’s procedural protections. Plaintiffs also have alleged that defendants have violated BIPA’s prohibition against profiting from an individual’s biometrics.
These exam-proctoring software lawsuits are only beginning to be filed. Whether this new theory takes root remains to be seen. But given the avalanche of BIPA lawsuits involving alleged biometric timeclocks, these cases may signal a new wave of BIPA class action litigation.
Next Steps
Universities and other education-related entities should determine whether they are using remote exam-proctoring software for students in Illinois. If so, they should evaluate whether these programs implicate biometrics that may be covered under BIPA and consider implementing BIPA-compliant procedures on a going-forward basis.
Additionally, entities using these programs should consult their licensing or vendor agreements to determine how, if at all, they address these issues. And BIPA exposure should be evaluated as such agreements are negotiated going forward.
