Microsoft can’t squeak out of BIPA case but could a university?

With most personal injury lawsuits, the central questions are what did a party know and what should a party have known. Here are a couple new entrants to that list.

Both involve alleged violations of the Biometric Information Protection Act, landmark legislation in the U.S. state of Illinois. Microsoft is entangled in one and an automated proctoring services is struggling in the other.

First, Microsoft.

Asserting that it indeed does have jurisdiction, a U.S. state of Illinois federal court, has allowed the BIPA case against Microsoft to proceed.

Microsoft had tried to have dismissed a proposed class action (case 1:21-cv-03229) filed by two Uber drivers in Illinois.

The pair say that the ride sharing company requires that they verify their identity at the beginning of every shift by taking a selfie. That photo is sent by Uber along with an employment onboarding photo to Microsoft for comparison.

The transaction and verification check happen via the Face API, which Uber licenses from Microsoft, according to reporting by trade publication Law Street Media.

The plaintiffs say Microsoft has violated BIPA by capturing and storing the images without their express consent.

Microsoft wanted a dismissal because its systems get the photos from outside Illinois and because the company has no control over where Uber drivers use Face.

In answer to Microsoft’s motion, the U.S. District Court for the Northern District of Illinois Eastern Division judge decided that the company knew the API would be used in Illinois. In fact, the judge wrote, the API had been changed slightly for use in Illinois, something noted in Uber’s contract with Microsoft.

The second, two-year-old case involves students at Lewis University, a private Illinois school, who say they used proctoring software from Respondus without realizing biometric data would be collected.

As it happens, Lewis administrators say they also did not know after presentations of the Monitor service by Respondus that biometric identifiers would be recorded, Law360 reports. Like Respondus, Lewis is accused in case 1:20-cv-07692 in the U.S. District Court for the Northern District of Illinois of not getting informed consent.

This week, school officials pressed on its defense that Respondus was not forthcoming with practices that could violate BIPA. Attorneys for Lewis say in a motion filed this week that any compensation and fines should be addressed solely by Respondus.

Article Topics

biometric identifiers  |  Biometric Information Privacy Act (BIPA)  |  biometrics  |  data protection  |  identity verification  |  lawsuits  |  Microsoft  |  remote proctoring  |  Respondus Monitor  |  Uber