fbpx

DePaul University Online Exams and Biometrics BIPA Class Action

DePaul University has some 21,000 undergraduate and graduate students, on its Chicago campus and in online learning programs. For some of the courses offered, DePaul requires that students take exams via a remoted proctoring tool, Respondus Monitor. The complaint for this class action alleges that Respondus collects biometric information from students, without their full awareness and without meeting the requirements of the Illinois Biometric Information Privacy Act (BIPA).

The class for this action is all persons who took an assessment using Respondus Monitor, as a student of DePaul University in Illinois, between May 7, 2016 and January 20, 2021.

Illinois recognizes the unique nature of biometrics. If information on a person’s biometrics is stolen, that person cannot replace or change the information, by, for example, getting another set of fingerprints. The state has made a start at protecting individual privacy by passing BIPA and establishing basic requirements for private parties who want to collect, store, use, or share such information.

For proctoring purposes, the complaint says, Respondus “captures, uses, and stores vast amounts of data, including facial-recognition data, facial detection data, recorded patterns of keystrokes, eye monitoring data, gaze monitoring data, and camera and microphone recording to effectively surveil students taking online exams.

For example, Respondus uses facial recognition so that it can tell whether the person who began taking the exam changes to another person. Students are recorded while they take exams, via both audio and video. DePaul owns, has access to, and possesses this data.”

The complaint alleges that students are not aware of “the vast amount of information their university collects through the Respondus Monitor tool.” The university does not inform the students about the collection of their data and does not get their written consent. These are things BIPA requires private entities to do before collecting, storing, using, or sharing biometric data.

To use Respondus, students must agree to the company’s Student Monitor Terms. While the terms do disclose that students are records audibly and visually while they take exams, the complaint alleges that before January 21, 2021, students were not told that Respondus would use facial recognition technology to collect their facial biometrics. The Terms mentioned only “other data” that may be recorded and “additional data” that may be evaluated by their educational institution.

BIPA also requires that private entities who collect biometrics maintain, publish, and follow a retention policy, detailing how long biometrics are kept on file and requiring the organization eventually to permanently destroy them once the purpose for collecting them has been satisfied. Respondus, the complaint claims, does not do this either.

The Monitor Student Terms state that Respondus will retain recordings for one year, and that institutions can retain it for four years. However, prior to January 21, 2021, the complaint alleges that the Terms did not disclose that the data the institutions could retain for that period included biometrics.

Article Type: Lawsuit
Topic: Privacy

Most Recent Case Event

DePaul University Online Exams and Biometrics BIPA First Amended Complaint

June 4, 2021

DePaul University has some 21,000 undergraduate and graduate students, on its Chicago campus and in online learning programs. For some of the courses offered, DePaul requires that students take exams via a remoted proctoring tool, Respondus Monitor. The complaint for this class action alleges that Respondus collects biometric information from students, without their full awareness and without meeting the requirements of the Illinois Biometric Information Privacy Act (BIPA).

DePaul University Online Exams and Biometrics BIPA First Amended Complaint

Case Event History

DePaul University Online Exams and Biometrics BIPA First Amended Complaint

June 4, 2021

DePaul University has some 21,000 undergraduate and graduate students, on its Chicago campus and in online learning programs. For some of the courses offered, DePaul requires that students take exams via a remoted proctoring tool, Respondus Monitor. The complaint for this class action alleges that Respondus collects biometric information from students, without their full awareness and without meeting the requirements of the Illinois Biometric Information Privacy Act (BIPA).

DePaul University Online Exams and Biometrics BIPA First Amended Complaint
Tags: BIPA, Taking/Storing/Using Biometric Data, Your Privacy