fbpx

ProctorU Collection of Biometrics in Violation of BIPA Illinois Class Action

ProctorU, Inc. owns an online proctoring company that collects biometric information. The complaint for this class action alleges the company has collected, stored, and used biometric information from persons in Illinois without fulfilling the requirements of the Illinois Biometric Information Privacy Act (BIPA).

A class and four subclasses have been defined for this action:

  • The Class is all Illinois residents who used ProctorU to take an exam online and whose facial geometry was collected or stored by ProctorU.
  • The four subclasses—the TOEFL Subclass, the UIC Subclass, The GRE Subclass, and the LSAT Subclass—are made up of Illinois residents who took the respective tests online, from March 2020 through the present, whose facial geometry was collected or stored by ProctorU.

Biometrics are unique among types of identifying information in that they cannot be replaced if they are compromised. If someone steals your credit card number, you can cancel that card and get a new one with a new number. But if someone steals your fingerprints, you cannot get another set of fingers.

Proctor U collects biometrics from students, such as eye movements and facial expressions, during their use of its software. Its Privacy Policy says, “We require you to share your photo ID on camera and we use that ID in conjunction with biometric facial recognition software to authenticate your identity. We also require you to perform a biometric keystroke measurement for some exams.”

ProctorU uses this kind of information to check for “suspicious behavior[,]” such as students looking from their computer screens down into their laps, as if looking something up on their cells phones.

Because it does not specify how long it will keep such information, the complaint says that “the only reasonable conclusion is that [ProctorU] has not, and will not, destroy biometric data” after its initial use has passed.

BIPA requires that businesses that wish to collect or store biometrics meet certain requirements.

First, they must tell subjects in writing “of the specific purpose and length of time for which a biometric identifier or biometric information is being collected, stored, and used.”

It must then protect the biometrics “using the reasonable standard of care” within the business’s industry and “in a manner that is the same or more protective than the manner in which [the business] stores, transmits, and protects other confidential and sensitive information.”

It must also “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.”

The complaint contends that ProctorU has not fulfilled these requirements for students who live in Illinois.

The concern may be warranted. The complaint reports that in July 2020, ProctorU suffered a data breach that exposed the information of nearly 500,000 students.

Article Type: Lawsuit
Topic: Privacy

Most Recent Case Event

ProctorU Collection of Biometrics in Violation of BIPA Illinois Complaint

March 12, 2021

ProctorU, Inc. owns an online proctoring company that collects biometric information. The complaint for this class action alleges the company has collected, stored, and used biometric information from persons in Illinois without fulfilling the requirements of the Illinois Biometric Information Privacy Act (BIPA).

ProctorU Collection of Biometrics in Violation of BIPA Illinois Complaint

Case Event History

ProctorU Collection of Biometrics in Violation of BIPA Illinois Complaint

March 12, 2021

ProctorU, Inc. owns an online proctoring company that collects biometric information. The complaint for this class action alleges the company has collected, stored, and used biometric information from persons in Illinois without fulfilling the requirements of the Illinois Biometric Information Privacy Act (BIPA).

ProctorU Collection of Biometrics in Violation of BIPA Illinois Complaint
Tags: BIPA, Biometric Data, Education, Taking/Storing/Using Biometric Data, Your Privacy