BIPA choice-of-law dismissal provides key lessons

By David J. Oberly, Biometric Privacy & Data Privacy Attorney

Utilizing a successful choice-of-law challenge, ProctorU, Inc. was recently able to procure the dismissal of a biometric privacy class action lawsuit claiming the company’s online exam proctoring software had collected and used students’ facial geometry scans in violation of the Illinois Biometric Information Privacy Act (“BIPA”).

ProctorU develops, owns, and operates online proctoring software that provides remote proctoring services. Several college students filed suit against ProctorU for alleged violations of Illinois’ biometric privacy statute in connection with their use of the company’s software while taking online examinations. ProctorU’s Terms of Service (“Terms”), which governs access to and use of ProctorU’s software and other services, contained a forum selection clause mandating that all disputes be brought solely in Alabama courts, as well as a choice-of-law provision dictating that those disputes were to be governed by Alabama law.

Suit was initially filed in Illinois, alleging two claims for relief under BIPA. After the case was transferred to the U.S. District Court for the Northern District of Alabama, ProctorU argued that the contractual choice-of-law provision contained in its Terms barred the plaintiffs’ BIPA claims. The court agreed, finding that the BIPA claims fell within the scope of that choice-of-law provision. Further, because the choice-of-law provision was enforceable according to Alabama choice-of-law rules, Alabama substantive law applied and the plaintiffs were precluded from stating an Illinois state-law BIPA claim upon which relief could be granted as a matter of law. Consequently, the BIPA class action was dismissed in its entirety and with prejudice.

The case is Thakkar v. ProctorU, Inc., No. 21 CV 1565, 2022 U.S. Dist. LEXIS 211499 (N.D. Ala. Nov. 22, 2022).

Analysis: The enforceability of choice-of-law provisions in BIPA class action litigation

The Thakkar decision provides key insight into the feasibility of choice-of-law as a defense in BIPA class action litigation. Of note, prior to Thakkar, several district courts around the country had ruled on the enforceability of choice-of-law provisions in BIPA litigation on a case-by-case basis and—each time—had refused to enforce such a provision.

So what was the difference between Thakkar and those prior decisions that reached the opposite conclusion? At bottom, the determinative factor was the state-specific choice-of-law rules that governed the BIPA dispute at issue.

For example, in In re Facebook Biometric Info. Priv. Litig., 185 F. Supp. 3d 1155 (N.D. Cal. 2016), a California federal court applied California choice-of-law rules, which follow § 187 of the Restatement (Second) of Conflict of Laws and dictate that a choice-of-law provision will not apply if the chosen law is contrary to a fundamental policy of the state law alternative and the other state has a materially greater interest in the determination of the matter. The court found that BIPA is a fundamental policy of Illinois, and that Illinois also had a greater interest in the outcome of the dispute because the state would suffer a complete negation of its biometric privacy obligations for its residents if California law was to be applied. As such, the court declined to enforce the parties’ agreed-upon choice-of-law provision, and instead applied Illinois law in its place. The end result was a denial of the defendant’s motion seeking dismissal of the class action on choice-of-law grounds.

Similarly, in Patterson v. Respondus, Inc., 2022 U.S. Dist. LEXIS 51991 (N.D. Ill. Mar. 30, 2022), an Illinois federal court considered whether to apply Washington law to BIPA claims under a choice-of-law provision. In that case, the plaintiffs were subject to a contract with a choice-of-law provision specifying that Washington law would govern any disputes. The court applied Illinois’s choice-of-law rules, which (similar to California) provide that courts will enforce a contractual choice-of-law provision unless doing so would violate fundamental Illinois public policy and Illinois had a materially greater interest in the litigation than the other state. Under this analysis, the court declined to enforce the choice-of-law provision that would have applied Washington law to the plaintiffs’ BIPA claims, as doing so would have been contrary to Illinois’s fundamental public policy of protecting individual privacy rights in biometric data through BIPA.

In Thakkar, however, Alabama’s choice-of-law rules diverged significantly from those of California and Illinois. Alabama has long maintained a general rule recognizing the rights of parties to choose a particular state’s laws to govern an agreement. Further, this rule provides only a narrow exception that applies in instances where application of the other state’s laws would be contrary to Alabama policy. In other words, the rights of parties to a contract to choose the law governing their obligations is recognized by Alabama law so long as the consequences of that election are not contrary to Alabama public policy. Applied to the dispute at issue, the Thakkar court concluded that the choice of Alabama substantive law could not run contrary to Alabama public policy, so the state’s choice-of-law public policy exception was inapplicable and the choice-of-law provision in ProctorU’s Terms was enforceable.

Taken together, Thakkar illustrates how the potential enforceability of a choice-of-law provision in BIPA class action litigation will depend heavily on the forum state’s choice-of-law rules. Specifically, where a state maintains a general rule favoring the enforceability of choice-of-law provisions, the potential exists that choice-of-law language contained in a binding contract may necessitate the dismissal of a BIPA class lawsuit in its entirety. Conversely, where a state’s choice-of-law rules require the balancing of interests between Illinois law and the law of the state agreed upon by the parties to govern contractual disputes, it is more likely that a defendant will be unable to prevail in the pursuit of a choice-of-law defense, as Illinois’s strong public policy favoring enforcement of its biometric privacy statute will likely override any countervailing public policy or other material interests of the alternative state.

Putting it into practice: Designing and implementing choice-of-law provisions that can be leveraged to defend and defeat BIPA class actions

Challenging a BIPA class action on contractual choice-of-law grounds is a particularly powerful tool that can be utilized at the pleadings stage to procure an early dismissal from costly, bet-the-company biometric privacy litigation. Importantly, however, in order to leverage this defense, companies must be able to show that a plaintiff assented to a contractual agreement containing a choice-of-law provision and that the contractual provision is enforceable in the specific context of the BIPA claims asserted by the plaintiff.

As an initial matter, companies should ensure that their terms of use create binding, enforceable contractual agreements between the plaintiff and the company. To be enforceable, online terms must provide users or similar classes of individuals with reasonable notice that their use of the company’s services or the click of a button constitutes their assent to the agreement. To accomplish this task, companies should obtain affirmative consent to their terms and similar online contracts whenever feasible. In this respect, a clickwrap agreement—which involves obtaining affirmative assent from a user after the user is presented with the terms of use (e.g., clicking an “I AGREE” button)—is the preferred method for obtaining assent, and will maximize the likelihood that a choice-of-law provision will be upheld and enforced by a court in the event a dispute arises involving the company.

Importantly, the vast majority of BIPA suits are filed in Illinois courts. As noted above, Illinois choice-of-law rules are very unfavorable to defendants—and will likely hamstring efforts in succeeding on a choice-of-law defense due to the interest balancing that is required under Illinois’s applicable choice-of-law framework. Thus, companies should also ensure that their terms contain a valid, enforceable forum selection provision that can facilitate the transfer of a class action out of Illinois federal court and to the district court of another state.

Here, it is important to note that whether a clause is, in fact, a forum selection clause hinges on whether it contains mandatory or permissive language. Mandatory language indicates that the parties have selected a particular forum, while permissive language merely indicates a preference for a certain forum. In other words, where venue is specified with mandatory language, the clause will be enforced; where only jurisdiction is specified, the clause will generally not be enforced unless there is some further language indicating the parties’ intent to make venue exclusive. As such, companies should ensure that their forum selection provisions use mandatory language requiring disputes to be resolved in a particular forum outside of Illinois.

Finally, companies should also devote the necessary time and effort to review the choice-of-law provisions contained in their online terms to ensure that those provisions will prove enforceable and effective in the event they become necessary to utilize in BIPA litigation. In particular, choice-of-law provisions should incorporate the use of broad language to cast a wide net in terms of the scope of claims subject to the choice-of-law provision. At the same time, the state law identified in a choice-of-law provision and chosen to govern disputes arising over biometrics-related matters should provide for a defendant-friendly general rule or similar analytic framework, such as that of Alabama seen in Thakkar.

Conclusion

With biometric privacy litigation continuing to proliferate with no end in sight, the use of effective choice-of-law provisions in online terms of use and similar contractual agreements is an important tool that all companies should consider to manage and mitigate the increasing risks associated with the collection and use of biometric data. Companies should give careful consideration to their online contracts incorporating choice-of-law provisions to maximize the likelihood of being able to leverage this robust defense in BIPA class litigation and other biometric privacy disputes if the need ever arises, which can be accomplished by following the best practices described above.

About the author

David J. Oberly is an attorney in the Cincinnati office of Squire Patton Boggs LLP and a member of the firm’s global Data Privacy, Cybersecurity & Digital Assets practice. David’s practice focuses on counseling and advising clients on a wide range of biometric privacy, artificial intelligence, and data privacy/security compliance and risk management matters. He can be reached at david.oberly@squirepb.com.

DISCLAIMER: Biometric Update’s Industry Insights are submitted content. The views expressed in this post are that of the author, and don’t necessarily reflect the views of Biometric Update.

Article Topics

biometric data  |  biometrics  |  BIPA  |  data privacy  |  lawsuits