Financial Institution Exemption Dooms Student’s BIPA Class Action

By David J. Oberly, Biometric Privacy and Data Privacy Advocate

For nearly four years now, Illinois’ Biometric Information Privacy Act (BIPA) has maintained the position of the nation’s hottest class action lawsuit. Meanwhile, many defendants have struggled to find a way to get these corporate disputes dismissed. One particular defence, however, has developed into a robust tool to defend – and defeat – BIPA class action lawsuits: the exemption from the “financial institution” law. Recently, the courts have issued a series of favorable rulings in ruling on motions to dismiss asserting this defense, which requires the outright dismissal of BIPA’s claims, if any.

On November 4, 2022, the court of Powell vs. DePaul Univ., No. 21 CV 3001, 2022 US Dist. LEXIS 201296 (ND Ill. November 7, 2022), held that a higher education institution properly qualified as a financial institution for the purposes of the exemption and, as such, was specifically exempted from complying with BIPA – entailing the dismissal of the action in its entirety.

The Powell The decision continues the trend of favorable treatment of the financial institution exemption and demonstrates the broad scope of the exemption in the context of BIPA class disputes. At the same time, the opinion further illustrates the ability of defendants to finally dispose of BIPA lawsuits at an early stage through the assertion of this strong defense.

The Powell decision

In Powella student has filed a lawsuit against DePaul University, alleging he violated BIPA by using an online remote monitoring tool to capture, store, and disseminate his and other students’ facial geometry data without notice , obtain their consent or disclose the duration of their data. preserved before being definitively destroyed.

After the remand in federal court, the university moved to dismiss the action for failure to file a claim under federal civil rule 12(b)(6), arguing that it fell within the the financial institution’s exemption from BIPA and was therefore exempt from complying with the law. This exemption, contained in Section 25(c) of the Act, provides that BIPA’s compliance obligations do not “apply in any way to a financial institution or a subsidiary of a financial institution that is subject to V of the federal Gramm-Leach-Bliley Act of 1999 [(“GLBA”)] and the rules promulgated thereunder.

In seeking the dismissal of the lawsuit, the university argued that, like all other colleges and universities with federally authorized financial aid programs, it is a GLBA Title V financial institution and must comply with its implementing rules. The GLBA defines a financial institution as “any institution whose business is engaged in financial activities”.

In support of the dismissal, the university noted that the Federal Trade Commission (FTC) and the Department of Education (DOE) have both acknowledged that institutions of higher learning, like itself, are considered financial institutions under the GLBA and must comply with the law. and the rules enacted thereunder. In particular, the DOE issued public guidance in 2020 reiterating that the GLBA requires financial institutions to have privacy protections. Similarly, the FTC has also issued guidelines stating that it considers colleges and universities to be financial institutions when those institutions are significantly engaged in lending funds to consumers.

The court agreed with the university, finding this reasoning convincing. In particular, the court noted that it found the position of the FTC, which was issued at a time when it had both enforcement and regulatory authority under the GLBA, particularly compelling because that it testified to a long-standing, consistent and well-reasoned interpretation of the law which it had been entrusted to administer. The court also pointed to the fact that the Consumer Financial Protection Bureau (CFPB), which assumed regulatory authority over the GLBA in 2010, had adopted and republished the privacy rules originally promulgated by the FTC, providing further support for the conclusion that higher education institutions are financial institutions for purposes of the GLBA.

The court then turned its attention to the evidence submitted by the parties regarding the university’s motion to dismiss, including the university’s participation agreement with the DOE, which confirmed that the university “undertook[d] in student aid and loan funds. The court held that this evidence established the university’s participation in federal student aid programs and its provision of direct loans to consumers, making it a financial institution subject to Title V of the GLBA and exempt from BIPA. .

Finally, the court also pointed to the fact that a number of other decisions had come to the exact same conclusion that the exemption provided by section 25(c) of the BIPA applies to higher education institutions. who are significantly engaged in financial activities, such as making or administering student loans. See Duerr v. Bradley Univ., No. 21 CV 1096, 2022 US Dist. LEXIS 86640 (CD Ill. March 10, 2022); Doe c. Northwestern Univ., No. 21 CV 1579, 2022 US Dist. LEXIS 85750 (ND Ill. 22 Feb. 2022); Doe c. Elmhurst Univ. No. 2020 L 1400 (Ill. Cir. Ct. DuPage Cnty. November 18, 2021); Fees c. Ill. Inst. of Tech., No. 21 CV 2512, 2022 US Dist. LEXIS 125581 (ND Ill. July 15, 2022).

Ultimately, because documents presented to the court showing the university’s participation in federal student aid programs demonstrated that the s. 25(c) exemption applied, the court granted the motion. of the university in rejection with prejudice.

Analysis and takeaways

BIPA’s separation of financial institutions extends far beyond traditional banks and other financial institutions

At first glance, section 25(c) may appear to apply only to financial institutions. Powell, however, demonstrates that the exemption extends far beyond traditional banking entities. Specifically, any entity subject to GLBA’s confidentiality requirements – commonly referred to as the Financial Privacy Rule – falls within the scope of Section 25(c) and can use the exemption as a full defense in BIPA class actions. .

This is a significant issue for defendants who face increasing exposure to liability from BIPA, as the definition of a financial institution under the GLBA is extremely broad, encompassing any institution whose business is engages in financial activities. Among others, these activities include lending, exchanging, transferring, investing for others or safeguarding money or securities; provision of financial, investment or economic advisory services; and underwriting, trading or keeping a market in securities.

Ensure that motions seeking dismissal under Section 25(c) are supported by sufficient defendant-specific evidence

That said, the named defendants in the BIPA lawsuits will not be able to obtain dismissal of a class action simply because they are GLBA-regulated entities. Instead, they must be able to clearly establish the applicability of the GLBA to their operations and, therefore, their right to invoke the Section 25(c) exemption. This task is particularly critical in the context of the prosecution of first motions to dismiss, where the scope of evidence that can be considered by a judge in his decision is limited.

For example, in Patterson v. Responded, Inc., No. 20 CV 7692, 2022 US Dist. LEXIS 51991 (ND Ill. Mar. 23, 2022), the court denied the defendant’s motion to dismiss pursued on the basis of the financial institution’s exemption because the defendant relied solely on general statements made by the FTC that universities are financial institutions where they are significantly engaged in lending funds to consumers. Importantly, the patterson Defendant’s entire argument simply assumed that these FTC statements governed whether it fell within the Section 25(c) exemption. However, the defendant has presented no evidence to show that the the university itself engaged in lending funds to consumers. Therefore, the court held that it could not dismiss BIPA’s action on the “questionable” basis presented by the defendant, resulting in the dismissal of its motion to dismiss.

Conversely, in Powell, the university supported its motion to dismiss by attaching judicially discernible documentation indicating its participation in federal student aid programs requiring GLBA compliance. The court found that this evidence established the university’s status as a financial institution under the GLBA, which in turn necessitated the dismissal of the lawsuits brought against it by BIPA.

As such, defendants seeking the dismissal of a BIPA dispute under their status as a financial institution under the Section 25(c) exemption should ensure that their claims are properly supported by sufficient evidence to allow the court to conclude that BIPA’s financial institution exemption applies to the specific activities undertaken by the defendant in order to maximize the likelihood of a successful outcome to a motion to permanently terminate the litigation .

About the Author

David J. Oberly is an associate in the Cincinnati office of Squire Patton Boggs LLP and a member of the firm’s Global Data Privacy, Cybersecurity and Digital Assets Practice. David’s practice focuses on advising and advising clients on a wide range of biometric privacy, artificial intelligence, data privacy/security and risk management issues. He can be reached at [email protected]

DISCLAIMER: Biometric Update industry overviews are submitted content. The opinions expressed in this article are those of the author and do not necessarily reflect the opinions of Biometric Update.

Article topics

biometric data | biometrics | BIPA | data protection | trial | remote monitoring | schools