Financial institution exemption dooms student’s BIPA class action suit

By David J. Oberly, Biometric Privacy & Data Privacy Attorney

For almost four years now, the Illinois Biometric Information Privacy Act (BIPA) has retained the position as the nation’s hottest class action trend. During this time, many defendants have struggled to find a way to procure dismissal from these bet-the-company disputes. One particular defense, however, has developed into a robust tool for defending — and defeating — BIPA class suits: the law’s “financial institution” exemption. Recently, courts have issued a string of favorable decisions in ruling on motions to dismiss asserting this defense, which requires outright dismissal of BIPA claims where applicable.

On November 4, 2022, the court in Powell v. DePaul Univ., No. 21 CV 3001, 2022 U.S. Dist. LEXIS 201296 (N.D. Ill. Nov. 7, 2022), held that an institution of higher learning was properly characterized as a financial institution for purposes of the exemption and, as such, was specifically exempt from complying with BIPA — resulting in the dismissal of the action in its entirety.

The Powell decision continues the trend of favorable treatment of the financial institution exemption and demonstrates the expansive scope of the exemption in the context of BIPA class disputes. At the same time, the opinion further illustrates the ability of defendants to definitively dispose of BIPA suits at an early juncture through the assertion of this robust defense.

The Powell decision

In Powell, a student filed suit against DePaul University, alleging that it violated BIPA by using an online remote proctoring tool to capture, store, and disseminate his and other students’ facial geometry data without providing notice, obtaining consent, or disclosing how long their data was retained before it was permanently destroyed.

Following removal to federal court, the university moved to dismiss the action for failure to state a claim under Federal Civil Rule 12(b)(6), arguing that it fell under the scope of BIPA’s financial institution exemption and thus was excused from complying with the law. That exemption, contained in Section 25(c) of the statute, provides that BIPA’s compliance obligations do not “apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 [(“GLBA”)] and the rules promulgated thereunder.”

In moving to have the suit dismissed, the university argued that, like all other colleges and universities with federally authorized financial aid programs, it is a financial institution subject to GLBA Title V and must comply with its implementing rules. The GLBA defines a financial institution as “any institution the business of which is engaging in financial activities.”

In support of dismissal, the university noted that the Federal Trade Commission (FTC) and the Department of Education (DOE) have both recognized that institutions of higher education, such as itself, are considered financial institutions under the GLBA and must comply with the law and rules enacted thereunder. In particular, the DOE issued public guidance in 2020 reiterating that the GLBA required financial institutions to have privacy protections. Likewise, the FTC also issued guidance indicating that it considered colleges and universities to be financial institutions where such institutions are significantly engaged in lending funds to consumers.

The court agreed with the university, finding this line of reasoning compelling. In particular, the court noted that it found the FTC’s position, which was issued at a time that it had both enforcement and rulemaking authority under the GLBA, particularly persuasive because it evidenced longstanding, consistent, and well-reasoned interpretation of the statute that it had been tasked to administer. The court also highlighted the fact that the Consumer Financial Protection Bureau (CFPB), which assumed rulemaking authority over the GLBA in 2010, had adopted and republished the privacy rules originally promulgated by the FTC, providing additional support for the conclusion that institutions of higher education are financial institutions for purposes of the GLBA.

The court then turned its attention to the evidence submitted by the parties on the university’s motion to dismiss, including the university’s Participation Agreement with the DOE, which confirmed that the university “engage[d] in student aid and lending funds.” The court reasoned that this evidence established the university’s participation in federal student aid programs and its provision of direct loans to consumers — making it a financial institution subject to Title V of the GLBA and exempt from BIPA.

Lastly, the court also highlighted the fact that a number of other decisions had reached the same exact conclusion that the exemption set forth by BIPA Section 25(c) applies to institutions of higher education that are significantly engaged in financial activities, such as making or administering student loans. See Duerr v. Bradley Univ., No. 21 CV 1096, 2022 U.S. Dist. LEXIS 86640 (C.D. Ill. Mar. 10, 2022); Doe v. Northwestern Univ., No. 21 CV 1579, 2022 U.S. Dist. LEXIS 85750 (N.D. Ill. Feb. 22, 2022); Doe v. Elmhurst Univ. No. 2020 L 1400 (Ill. Cir. Ct. DuPage Cnty. Nov. 18, 2021); Fee v. Ill. Inst. of Tech., No. 21 CV 2512, 2022 U.S. Dist. LEXIS 125581 (N.D. Ill. July 15, 2022).

Ultimately, because the materials presented to the court showing the university’s participation in federal student aid programs demonstrated that the exemption in Section 25(c) applied, the court granted the university’s motion to dismiss with prejudice.

Analysis and takeaways

BIPA’s Financial Institution Carve-Out Extends Broadly Beyond Traditional Banks and Other Financial Institutions

At first blush, Section 25(c) may appear as applicable only to financial institutions. Powell, however, demonstrates that the exemption extends well beyond traditional banking entities. Specifically, any entity that is subject to the GLBA’s privacy requirements—commonly known as the Financial Privacy Rule — falls under the scope of Section 25(c) and can utilize the exemption as a complete defense in BIPA class litigation.

This is a significant issue for defendants that face increasing BIPA liability exposure, as the definition of financial institution under the GLBA is extremely broad, encompassing any institution the business of which is engaging in financial activities. Among others, those activities include lending, exchanging, transferring, investing for others, or safeguarding money or securities; providing financial, investment, or economic advisory services; and underwriting, dealing in, or making a market in securities.

Ensure Motions Seeking Dismissal Under Section 25(c) Are Supported by Sufficient Defendant-Specific Evidence

With that said, defendants named in BIPA lawsuits will not be able to procure dismissal from class litigation simply by virtue of the fact that they are GLBA-regulated entities. Instead, they must be able to clearly establish the applicability of the GLBA to their operations and, in turn, their entitlement to invoke the Section 25(c) exemption. This task is especially critical in connection with the pursuit of early motions to dismiss, where the scope of evidence that can be considered by a judge in its ruling is curtailed.

For example, in Patterson v. Respondus, Inc., No. 20 CV 7692, 2022 U.S. Dist. LEXIS 51991 (N.D. Ill. Mar. 23, 2022), the court denied a defendant’s motion to dismiss pursued on the basis of the financial institution exemption because the defendant relied solely on general statements made by the FTC that universities are financial institutions where they are significantly engaged in lending funds to consumers. Importantly, the Patterson defendant’s entire argument merely assumed those FTC statements governed the question of whether it fell under the ambit of the Section 25(c) exemption. The defendant, however, failed to put forth any evidence to demonstrate that the university itself engaged in lending funds to consumers. Consequently, the court held that it could not dismiss the BIPA action on the “dubious” basis presented by the defendant, resulting in the denial of its motion to dismiss.

Conversely, in Powell, the university supported its motion to dismiss by attaching judicially noticeable documents indicating its participation in federal student aid programs requiring GLBA compliance. The court found this evidence established the university’s status as a financial institution within the meaning of the GLBA, which in turn necessitated dismissal of the BIPA claims brought against it.

As such, defendants that seek dismissal from BIPA litigation pursuant to their status as a financial institution under the Section 25(c) exemption must ensure that their motions are properly supported with sufficient evidence to allow the court to conclude that BIPA’s financial institution exemption applies to the specific activities engaged in by the defendant in order to maximize the likelihood of a favorable outcome on a motion seeking to definitively end the litigation.

About the author

David J. Oberly is an attorney in the Cincinnati office of Squire Patton Boggs LLP and a member of the firm’s global Data Privacy, Cybersecurity & Digital Assets practice. David’s practice focuses on counseling and advising clients on a wide range of biometric privacy, artificial intelligence, and data privacy/security compliance and risk management matters. He can be reached at david.oberly@squirepb.com.

DISCLAIMER: Biometric Update’s Industry Insights are submitted content. The views expressed in this post are that of the author, and don’t necessarily reflect the views of Biometric Update.

Article Topics

biometric data  |  Biometric Information Privacy Act (BIPA)  |  biometrics  |  data protection  |  David Oberly  |  lawsuits  |  remote proctoring  |  schools