InfoBytes Blog

District Court says university is a financial institution exempt from state privacy law

On November 4, the U.S. District Court for the Northern District of Illinois granted a defendant university’s motion to dismiss Illinois’ Biometric Information Privacy Act claims (BIPA), ruling that because the defendant participates in the Department of Education’s Federal Student Aid Program, it is a “financial institution” subject to Title V of the Gramm-Leach-Bliley Act (GLBA) and therefore exempt from BIPA. Plaintiff sued the defendant claiming the university used technology to collect biometric identifiers to surveil students taking online exams. According to the plaintiff, the defendant’s use of this technology violated students’ biometric privacy rights because the defendant did not obtain students’ written consent to collect and use that data, failed to disclose what happens with the data after collection, and failed to adhere to BIPA’s retention and destruction requirements.

The court disagreed and dismissed the putative class action. The court explained that the defendant’s direct student lending and participation in the Federal Student Aid Program allows it to qualify as a “financial institution,” defined by the GLBA as “any institution the business of which is engaging in financial activities.” As such, it is expressly exempt from BIPA. The court rejected plaintiff’s argument that the defendant did not fit within this definition because it is in the business of higher education rather than financial activities because at least five other courts that have also concluded that “institutions of higher education that are significantly engaged in financial activities such as making or administering student loans” qualify for exemption. The court also referred to a 2000 FTC rule issued when the Commission had both enforcement and rulemaking authority under the GLBA. The rule considered colleges and universities to be financial institutions if they “appear to be significantly engaged in lending funds to consumers,” which the court found to be “particularly persuasive because it evidences longstanding, consistent, and well-reasoned interpretation of the statute that it had been tasked to administer.”

Courts State Issues Illinois Class Action BIPA GLBA Department of Education FTC Student Lending Privacy, Cyber Risk & Data Security