COURTNIE PATTERSON, individually and on behalf of all others similarly situated v. RESPONDUS, INC. and LEWIS UNIVERSITY; CHENG WU, individually and on behalf of all others similarly situated v. RESPONDUS, INC.; LUCIUS VEIGA, MICHAEL STERCHELE, and ALEX PARKER ZIMMERMAN, on behalf of themselves and all others similarly situated v. RESPONDUS, INC.
No. 20 C 7692
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
03/23/22
Rebecca R. Pallmeyer
Case: 1:20-cv-07692 Document #: 79 Filed: 03/23/22 Page 1 of 50 PageID #:1141; No. 21 C 1785; No. 21 C 2620
This opinion concerns three putative class actions brought under the Illinois Biometric Information Privacy Act (BIPA),
All three sets of plaintiffs have sued the company that makes Respondus Monitor (Respondus, Inc., a Washington-based company), and one plaintiff has also sued her school (Lewis University, a private university in Illinois). All plaintiffs allege that the defendants violated BIPA by failing to obtain their informed, written consent to the collection of their biometric data,
Respondus and Lewis have moved to dismiss the plaintiffs’ BIPA claims on several grounds. The motions have generated a host of subsidiary disputes, including questions of civil procedure and contract law. After resolving these threshold issues, the court reaches the BIPA claims, addressing standing in addition to the issues briefed by the parties. As explained here, the court finds that the plaintiffs have successfully stated claims for violations of some BIPA provisions but that they lack Article III standing with respect to other provisions.
PROCEDURAL HISTORY
This opinion resolves four motions to dismiss filed by two separate defendants in three different cases. The court attempts to provide clarity below.
Patterson v. Respondus Inc. & Lewis University (No. 20 C 7692). On November 16, 2020, Jerrie Hinds filed a putative class-action complaint against Respondus in the Circuit Court of Cook County, Illinois. On December 23, 2020, Respondus removed the case to this district under the Class Action Fairness Act of 2005 (CAFA).1 (See Notice of Removal, Patterson v.
Respondus Monitor Class: All persons who took an exam using Respondus Monitor in the state of Illinois at any time during the five years prior to the filing of this Complaint through trial.
Lewis University Class: All persons who took an exam using Respondus Monitor as a student of Lewis in the state of Illinois at any time during the five years prior to the filing of this Complaint through trial.
(Compl. (Patterson) ¶ 107.)
Wu v. Respondus, Inc. (No. 21 C 1785). On April 2, 2021, Phillip Bridges and Cheng Wu filed a putative class-action complaint against Respondus in this district, premising federal jurisdiction on the CAFA. The case was initially assigned to Judge Sara Ellis, but it was reassigned to this court as related to Patterson. Bridges voluntarily dismissed his claims, leaving Wu as the sole remaining named plaintiff. The same attorneys represent Plaintiffs Patterson and Wu, and apart from the fact that the Wu complaint does not name Lewis University as a defendant, it is essentially identical to the Patterson complaint. Like Patterson, Wu sues on behalf of himself and others similarly situated and claims that Respondus violated BIPA sections 15(a), 15(b), 15(c), and 15(d). (See Class Action Compl., Wu v. Respondus, Inc., No. 21 C 1785 [1] (hereinafter “Compl. (Wu)“).) Wu proposed the following class definition (with exclusions not relevant here):
All persons who took an assessment using Respondus Monitor in Illinois at any time during the five years prior to the filing of this Complaint through January 20, 2021.
(Compl. (Wu) ¶ 106.)
Veiga et al. v. Respondus, Inc. (No. 21 C 2620). On March 31, 2021, Lucius Veiga, Michael Sterchele, and Alex Parker Zimmerman filed a putative class-action complaint against Respondus in the Circuit Court of Cook County, Illinois. Respondus removed the case to this district under the CAFA. (See Notice of Removal, Veiga v. Respondus, Inc., No. 21 C 2620 [1] (hereinafter “Notice of Removal (Veiga)“).) The case was initially assigned to Judge John Lee, but, like Wu, it was reassigned to this court as related to Patterson. Plaintiffs Veiga, Sterchele, and Zimmerman are represented by different attorneys than Plaintiffs Patterson and Wu, and the allegations in their complaint are slightly different. The Veiga Plaintiffs claim that Respondus violated BIPA sections 15(a) and 15(b). (See Class Action Compl., Ex. 1 to Notice of Removal, Veiga v. Respondus, Inc., No. 21 C 2620 [1] (hereinafter “Compl. (Veiga)“).) Like the Patterson and Wu Plaintiffs, the Veiga Plaintiffs seek to represent a class. They have proposed the following class definition (again, with exclusions not relevant here):
All Illinois citizens, who used Respondus Monitor‘s software for a remotely proctored exam from 2016 through 2020, and whose biometric information or identifiers were collected, captured, purchased, received through trade, or otherwise obtained by Respondus in Illinois in violation of the Illinois Biometric Information Privacy Act,
740 ILCS 14/5 et seq .
(Compl. (Veiga) ¶ 37.)
Respondus‘s three motions to dismiss. On June 4, 2021, Respondus filed motions to dismiss in Patterson (No. 20 C 7692 [48]), Wu (No. 21 C 1785 [21]), and Veiga (No. 21 C 2620 [15]).2 Respondus‘s supporting memoranda of law were largely the same in each case. The
Lewis‘s motion to dismiss. On June 4, 2021, Lewis filed a motion to dismiss in Patterson (No. 20 C 7692 [50]), the only case in which it is a defendant. That motion, too, is fully briefed.4
Because Lewis‘s motion raises different legal issues than Respondus‘s motions, the court addresses it separately.
FACTUAL BACKGROUND
Plaintiffs are all Illinois citizens who took exams using Respondus Monitor at least once while attending school in Illinois. (Compl. (Patterson) ¶¶ 27, 98–100; Compl. (Wu) ¶¶ 24, 95–98; Compl. (Veiga) ¶¶ 9–10, 31–32.) Each named plaintiff attended a different school at the time they used Respondus Monitor. (See Compl. (Patterson) ¶ 98; Compl. (Wu) ¶ 95; Compl. (Veiga) ¶¶ 9–10.) Plaintiff Courtnie Patterson, who attended Lewis University (see Compl. (Patterson) ¶ 98), has also named Lewis as a defendant in her case.
Defendant Respondus, Inc. is a Washington-based software company that “offers several cloud-based software and service applications to assist educational institutions in providing online content and exams to students.” (Compl. (Patterson) ¶¶ 28, 34; Compl. (Wu) ¶¶ 25, 29; see also Compl. (Veiga) ¶¶ 11, 18.) The software at the center of this case, Respondus Monitor, is an automated proctoring tool that schools use to administer online exams. (Compl. (Patterson) ¶¶ 41–42; Compl. (Wu) ¶¶ 36–37; Compl. (Veiga) ¶¶ 4, 24–25.) One of the main purposes of Respondus Monitor is to prevent students from cheating. (Compl. (Patterson) ¶ 1; Compl. (Wu) ¶ 1; Compl. (Veiga) ¶ 19.) In 2021 alone, Respondus projected that more than 20 million exams would be taken through Respondus Monitor, making it the most widely used proctoring software in higher education. (Compl. (Patterson) ¶ 42; Compl. (Wu) ¶ 37; see also Compl. (Veiga) ¶ 4.)
Before a student begins an exam using Respondus Monitor, the program confirms that the student‘s webcam and microphone are working properly, and it verifies the student‘s identity. (Compl. (Patterson) ¶¶ 82–84; Compl. (Wu) ¶¶ 81–83; Compl. (Veiga) ¶¶ 26–27.) This process, which includes a “facial detection check,” requires the student to center their face in the camera frame and speak into the microphone. (Compl. (Patterson) ¶¶ 82–83, 86; Compl. (Wu) ¶¶ 81–82, 85; Compl. (Veiga) ¶¶ 26–27.) Respondus Monitor also uses the student‘s
While a student takes an exam, Respondus Monitor uses, according to Respondus‘s website, “facial detection, motion, and lighting to analyze the student and [their] examination environment.” (Compl. (Patterson) ¶ 44; Compl. (Wu) ¶ 39; Compl. (Veiga) ¶¶ 29–30.) If, for example, the test taker should attempt to substitute another person to take the test, the software would recognize this. (Compl. (Patterson) ¶ 45; Compl. (Wu) ¶ 40; Compl. (Veiga) ¶ 28.) And the software records patterns of keystrokes, eye-monitoring data, gaze-monitoring data, and other information about a student‘s exam. (Compl. (Patterson) ¶ 3; Compl. (Wu) ¶ 3; Compl. (Veiga) ¶¶ 20, 29.) After an exam has been completed, the data that has been collected and analyzed by Respondus Monitor flows into a separate portal, called the “Review Priority” system, through which the school‘s instructors can review the proctoring results. (Compl. (Patterson) ¶¶ 46–47; Compl. (Wu) ¶¶ 41–42; Compl. (Veiga) ¶¶ 20, 28.)
All Plaintiffs allege that aspects of this process were not properly disclosed to them before using Respondus Monitor, but they articulate that general point in different ways. The Veiga Plaintiffs simply allege that before they used Respondus Monitor, they were not provided with written disclosures explaining that their biometric data would be collected or handled. (See, e.g., Compl. (Veiga) ¶¶ 33–36.) Plaintiffs Patterson and Wu provide significantly more detailed
According to Plaintiffs Patterson and Wu, Respondus Monitor integrates with a school‘s existing “learning management system.” (Compl. (Patterson) ¶¶ 35, 37; Compl. (Wu) ¶¶ 30–31.) To take an exam, a student logs into their school‘s learning management system and opens the “LockDown Browser,” which “locks down a testing environment” by limiting a computer‘s functionality. (Compl. (Patterson) ¶¶ 38, 49; Compl. (Wu) ¶¶ 33, 45.) Then, the student is presented with Respondus Monitor‘s terms of use (the “Student Terms“), which the student must accept as a condition of proceeding with the exam. (Compl. (Patterson) ¶¶ 40, 50, 52, 78; Compl. (Wu) ¶¶ 35, 46, 48, 77.) Plaintiffs Patterson and Wu assented to these terms by clicking “I accept,” but because their acceptance was a condition of proceeding with each exam, they allege that they lacked a “meaningful choice” under the circumstances. (Compl. (Patterson) ¶¶ 50, 105; Compl. (Wu) ¶¶ 46, 104.) Moreover, according to Plaintiffs Patterson and Wu, the Student Terms do ”not disclose that Respondus Monitor will use facial recognition technology to collect, capture, analyze, and disseminate a student‘s biometric identifiers or biometric information.” (Compl. (Patterson) ¶ 54; Compl. (Wu) ¶ 50.) The Student Terms contain an abbreviated privacy policy and incorporate by reference a longer privacy policy available on Respondus‘s website. (See Compl. (Patterson) ¶ 69; Compl. (Wu) ¶ 66.) Neither of these two policies explain that Respondus collects students’ biometric data through Respondus Monitor, nor do the policies disclose the fact that schools using Respondus Monitor (or those schools’ agents) are given access to students’ biometric data. (See Compl. (Patterson) ¶¶ 70–73, 75–76; Compl. (Wu) ¶¶ 67–70, 73–74.) Furthermore, neither of the policies establish guidelines for the retention and destruction of biometric data by Respondus. (See Compl. (Patterson) ¶¶ 74, 77; Compl. (Wu) ¶¶ 72, 76.)
Defendant Lewis is a private university located in Romeoville, Illinois. (Compl. (Patterson) ¶¶ 6, 30.) Plaintiff Patterson attended Lewis between 2015 and 2019, paying tuition
LEGAL STANDARD
As detailed below, all three sets of Plaintiffs allege various violations of BIPA. Before addressing the merits of those claims, the court considers its subject-matter jurisdiction—specifically, whether Plaintiffs have standing to pursue their claims in federal court.
I. Standing
Even where parties do not raise the issue, a court has an “independent duty” to ensure that it has subject-matter jurisdiction. Dexia Credit Loc. v. Rogan, 602 F.3d 879, 883 (7th Cir. 2010). In federal court, a key component of jurisdiction is Article III standing. Bazile v. Fin. Sys. of Green Bay, Inc., 983 F.3d 274, 278 (7th Cir. 2020). To establish standing, “a plaintiff must demonstrate (1) that he or she suffered an injury in fact that is concrete, particularized, and
When a case is filed in state court and removed to federal court, the party seeking removal “bears the burden of establishing federal jurisdiction,” including standing. Tri-State Water Treatment, Inc. v. Bauer, 845 F.3d 350, 352 (7th Cir. 2017). “If at any time before final judgment it appears that the district court lacks subject matter jurisdiction, the case shall be remanded” to the state court.
II. Rule 12(b)(6)
A complaint must include a “short and plain statement of the claim showing that the pleader is entitled to relief.”
DISCUSSION
As its name suggests, the Illinois Biometric Information Privacy Act (BIPA) protects an individual‘s privacy interest in her biometric data.5
To address these and other privacy concerns, BIPA regulates how private entities may collect and handle biometric data,
Section 15(a). Section 15(a) of BIPA requires a private entity in possession of biometric data to develop, publicly disclose, and comply with a retention schedule and guidelines for destroying the data within specified time limits.
Section 15(b). Section 15(b) of BIPA requires a private entity that collects or otherwise obtains an individual‘s biometric data to first obtain the individual‘s informed, written consent.
Section 15(c). Section 15(c) of BIPA prohibits a private entity in possession of biometric data from selling, leasing, trading, or otherwise profiting from that data.
Section 15(d). Section 15(d) of BIPA prohibits a private entity in possession of biometric data from disclosing or disseminating that data except in certain circumstances, such as obtaining a subject‘s consent.
I. Respondus‘s Motions to Dismiss
The Patterson, Wu, and Veiga Plaintiffs all allege that Respondus violated sections 15(a) and 15(b) of BIPA. The Patterson and Wu Plaintiffs also allege that Respondus violated sections 15(c) and 15(d). Respondus contends that Plaintiffs have failed to state a claim.
Before addressing the parties’ arguments on this score, the court pauses to identify the documents (other than the complaints themselves) that are properly considered on these Rule 12 motions, and to resolve choice-of-law issues.
A. Incorporation-by-Reference Doctrine
In general, a court deciding a Rule 12(b)(6) motion may consider only the plaintiff‘s complaint. Rosenblum v. Travelbyus.com Ltd., 299 F.3d 657, 661 (7th Cir. 2002). There are, of course, major exceptions to this rule. First, a “written instrument” attached to a complaint is considered a part of the pleading “for all purposes.”
When a defendant attaches documents to its Rule 12(b)(6) motion, as Respondus has done here, the court must make a threshold determination. If the attachments are “central to the complaint and . . . referred to in it,” the court may consider them in deciding the motion under Rule 12. See id. But if the connection between the attachments and the complaint is more attenuated, the court must “either convert the 12(b)(6) motion into a motion for summary judgment under Rule 56, or exclude the documents attached to the motion to dismiss and continue under Rule 12.” Macias v. Bakersfield Rest., LLC, 54 F. Supp. 3d 922, 926–27 (N.D. Ill. 2014) (citing
As against Respondus, the Patterson and Wu Plaintiffs each attached the same two exhibits to their respective complaints, while the Veiga Plaintiffs attached no documents to their complaint.6 Respondus seeks to expand the record in all three cases—attaching two additional documents to its motions to dismiss in Patterson and Wu and four documents to its motion to dismiss in Veiga. The upshot is that the four attachments at issue in Patterson and Wu (two via Plaintiffs; two via Respondus) are essentially the same four attachments that are at issue in Veiga (all four via Respondus). But because the two sets of Plaintiffs pleaded their claims differently, the court must approach the incorporation question separately for each set.
1. Patterson and Wu
The Patterson and Wu Plaintiffs each attached the same two documents to their respective complaints against Respondus: (1) a copy, dated November 2, 2020, of a Respondus webpage containing the “Respondus Monitor—Student Terms of Use” (“Student Terms“), and (2) a copy, also dated November 2, 2020, of a Respondus webpage containing the “Respondus Privacy Policy” (“Privacy Policy“). Respondus then attached two additional documents to its motions to dismiss: (3) a copy, dated June 2, 2021, of a Respondus webpage entitled “Privacy Center Overview” (“Privacy Center“), and (4) a copy, also dated June 2, 2021,
The court declines to consider Respondus‘s two additional documents at this stage. To be considered incorporated by reference, a document must be “central to the complaint and . . . referred to in it.” See Williamson, 714 F.3d at 436. Respondus seems to believe that because Plaintiffs’ BIPA claims relate broadly to “Respondus’ written policies,” and Plaintiffs “attached only some of the relevant policies” to their complaints, Respondus has license to supplement the pleadings at its discretion. (Respondus Reply (Patterson) at 11; Respondus Reply (Wu) at 11.) That is incorrect. To be incorporated by reference, the documents themselves—not just their general category or theme—must be central to the complaint and referred to in it. Respondus does not attempt to argue that either of its two documents (the Privacy Center or the Additional Information page) is itself central to the complaints, nor could it reasonably make that argument. In setting out their claims, Plaintiffs relied on, referred to, and introduced some documents but not others, just as they, the authors of the complaint, were entitled to do.7 Although the broader contents of Respondus‘s website, including the Privacy Center and the Additional Information page, may be relevant at a later stage of this litigation, “allowing [Respondus] to cherry pick portions of [the] website to introduce via a motion to dismiss simply because the complaint implicates [that website] would convert an examination of the complaint into full-blown summary judgment analysis.” See Facebook, Inc. v. Teachbook.com LLC, 819 F. Supp. 2d 764, 773 (N.D. Ill. 2011).
In deciding Respondus‘s motions to dismiss the Patterson and Wu complaints under Rule 12, the court will consider only the two documents attached to Plaintiffs’ complaints: the Student Terms and the Privacy Policy. (See “Respondus Monitor—Student Terms of Use,” Ex. A to Compl. (Patterson), No. 20 C 7692 [12-1] (hereinafter “Student Terms“); “Respondus Monitor—Student Terms of Use,” Ex. A to Compl. (Wu), No. 21 C 1785 [1-1] (same); “Respondus Privacy Policy,” Ex. B to Compl. (Patterson), No. 20 C 7692 [12-2] (hereinafter “Privacy Policy“); “Respondus Privacy Policy,” Ex. B to Compl. (Wu), No. 21 C 1785 [1-2] (same).)
2. Veiga
The Veiga Plaintiffs attached no documents to their complaint, but Respondus attached the following documents to its motion to dismiss: (1) an archived copy, dated January 16, 2021,
Respondus contends that the Veiga complaint incorporates the Student Terms by reference because it “explicitly references” the Student Terms, “quotes selected portions” of the Student Terms, and “cites the web address” where the Student Terms are available. (Respondus Mot. (Veiga) at 4.) The court disagrees that these citations amount to incorporation by reference. Although the Veiga complaint does briefly refer to the Student Terms, it does so mainly to support an allegation that Respondus recently removed uses of the word “biometric” on its website. (Compl. (Veiga) ¶¶ 23-24 & nn.9–10; see also Pl. Resp. (Veiga) at 1 n.1.) That issue is far from “central” to Plaintiff‘s complaint. See Williamson, 714 F.3d at 436. Because Plaintiffs’ BIPA claims do not rely significantly on the Student Terms—much less a particular version of it—it would be inappropriate to consider that document on this motion. And because Respondus‘s sole argument in favor of considering the Privacy Policy is that it is incorporated by reference into the Student Terms, the court likewise declines to consider the Privacy Policy.
B. Choice of Law
Another preliminary issue is which state‘s substantive laws apply to Plaintiffs’ claims against Respondus. A federal court exercising diversity jurisdiction applies the choice-of-law rules of the state in which it sits—here, Illinois. See Heiman v. Bimbo Foods Bakeries Distrib. Co., 902 F.3d 715, 718 (7th Cir. 2018) (citing Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496 (1941)). Under Illinois choice-of-law rules, this state‘s laws presumptively apply to a dispute unless there is an actual conflict with another state‘s laws or the parties agree that forum-state law does not apply. See Sosa v. Onfido, Inc., 8 F.4th 631, 637 (7th Cir. 2021). Respondus contends that the parties have entered such an agreement. It points to a choice-of-
As explained above, the court has determined that it will consider the Student Terms in deciding the Patterson and Wu motions but not the Veiga motion. That difference affects how the court analyzes Respondus‘s choice-of-law argument in each case.
1. Veiga
Because Respondus‘s choice-of-law argument relies on a document that the court will not consider in deciding this motion, the court rejects the argument. It will apply Illinois law in the Veiga case.
In any event, the court finds Respondus‘s choice-of-law argument meritless. To prevail on the argument, Respondus would first have to show that the Veiga Plaintiffs assented to the Student Terms as a matter of contract law.12 But the Veiga complaint (unlike the Patterson and Wu complaints) contains no factual allegations from which to reasonably conclude that Plaintiffs knew of, much less assented to, the Student Terms. To the contrary, the Veiga Plaintiffs allege that they “were never provided with any disclosures regarding the collection of their biometric information.” (Pl. Resp. (Veiga) at 11 (citing Compl. (Veiga) ¶¶ 33–36).)
A copy of the Respondus Monitor Terms of Use for Students is shown below for reference. Please note, terms may vary by region. Certain institutions may also use customized versions of these terms. Students should review the terms that appear each time they start an exam as those are the exact terms they must agree to at their institution in order to use Respondus Monitor.
(Ex. A to Respondus Mot. (Veiga) [16] at 1.) In other words, this document is not a contract at all, much less one for which there is any evidence of Plaintiffs” agreement.
The court will apply Illinois law to the Veiga case.
2. Patterson and Wu
Because the Patterson and Wu Plaintiffs attached a version of the Student Terms to their pleadings, the court will consider this document in deciding Respondus“s motions to dismiss these complaints and, specifically, in resolving the choice-of-law issue.
Illinois courts typically enforce a contractual choice-of-law provision unless (1) doing so would violate fundamental Illinois public policy, and (2) Illinois has a materially greater interest in the litigation than the other state. Smurfit Newsprint Corp. v. Se. Paper Mfg., 368 F.3d 944, 949 (7th Cir. 2004) (citing English Co. v. Nw. Envirocon, Inc., 278 Ill. App. 3d 406, 411, 663 N.E.2d 448, 452 (2nd Dist. 1996)). That framing of the rule, however, presupposes a valid, enforceable contract. A court may also decline to enforce a contractual choice-of-law provision “if the contract“s legality is fairly in doubt, for example, if the contract is unconscionable, or if there is
a. Unconscionability
The Patterson and Wu Plaintiffs argue that the Student Terms, including the choice-of-law provision, are unenforceable because they are unconscionable.14 (See Pl. Resp. to Respondus (Patterson) at 3-5; Pl. Resp. (Wu) at 3-5.) Both parties cite Illinois cases on the issue of unconscionability, and Respondus asserts that the differences between Washington and Illinois law are immaterial. (Respondus Reply (Patterson) at 1 n.1; Respondus Reply (Wu) at 1 n.1.) The court will therefore apply Illinois law. Thornton v. M7 Aerospace LP, 796 F.3d 757, 770 n.6 (7th Cir. 2015) (“Where the parties have not identified a conflict between the two bodies of state law that might apply to their dispute, we apply the law of the forum state . . . .“); see also Wood v. Mid-Valley Inc., 942 F.2d 425, 427 (7th Cir. 1991) (“Courts do not worry about conflict of laws unless the parties disagree on which state“s law applies. We are busy enough without creating issues that are unlikely to affect the outcome of the case . . . .“).
Substantive unconscionability “concerns the actual terms of the contract and examines the relative fairness of the obligations assumed.” Kinkel v. Cingular Wireless LLC, 223 Ill. 2d 1, 28, 857 N.E.2d 250, 267 (2006) (quoting Maxwell v. Fid. Fin. Servs., Inc., 184 Ariz. 82, 89, 907 P.2d 51, 58 (1995)). The factors considered include “contract terms so one-sided as to oppress or unfairly surprise an innocent party, an overall imbalance in the obligations and rights imposed by the bargain, and significant cost-price disparity.” Id. (quoting Maxwell, 184 Ariz. at 89, 907 P.2d at 58). Here, Plaintiffs” sole argument that the Student Terms are substantively unconscionable is that enforcing the Washington choice-of-law provision would doom their BIPA claims or any analogous private right of action. (See Pl. Resp. to Respondus (Patterson) at 5; Pl. Resp. (Wu) at 5.) As Respondus points out, this is merely a variation on Plaintiffs” argument that the choice-of-law provision should not be enforced because it would violate Illinois public policy. (Respondus Reply (Patterson) at 5-6; Respondus Reply (Wu) at 5-6 (same).) The court discusses that narrower argument below. Plaintiffs have not made a case for their broader contention that the foreclosing of their BIPA claims by itself renders the Student Terms themselves so inordinately one-sided or oppressive as to be unconscionable. The court rejects the substantive-unconscionability argument.
Plaintiffs” charge of procedural unconscionability is far more compelling. “Procedural unconscionability refers to a situation where a term is so difficult to find, read, or understand that the plaintiff cannot fairly be said to have been aware he was agreeing to it, and also takes into account a lack of bargaining power.” Razor, 222 Ill. 2d at 100, 854 N.E.2d at 622. Procedural
The Patterson and Wu Plaintiffs note correctly that the Student Terms appear to be a quintessential contact of adhesion: “a contract submitted by one party to another on a take-it-or-leave-it basis, without any opportunity to negotiate its terms.” Ironbeam, Inc. v. Evert, 417 F. Supp. 3d 1031, 1037 (N.D. Ill. 2019) (internal quotation marks omitted). Respondus also notes correctly, however, that contracts of adhesion are not per se unconscionable. See Kinkel, 223 Ill. 2d at 26, 857 N.E.2d at 266. As the Illinois Supreme Court has recognized, contracts of adhesion are a “fact of modern life,” which “[c]onsumers routinely sign . . . to obtain credit cards, rental cars, land and cellular telephone service, home furnishings and appliances, loans, and other products and services.” Id. “It cannot reasonably be said that all such contracts are so procedurally unconscionable as to be unenforceable.” Id.
In determining whether a contract of adhesion is procedurally unconscionable, Illinois law counsels a holistic view of the circumstances under which the contract was entered. See Phoenix, 242 Ill. 2d at 60, 949 N.E.2d at 647. The court finds, on this record, that the context in which Plaintiffs agreed to the Student Terms did not allow for a “meaningful choice” about entering the contract. See Kinkel, 223 Ill. 2d at 23, 857 N.E.2d at 264 (quoting Frank“s Maint., 86 Ill. App. 3d at 989, 408 N.E.2d at 410). Unlike with a routine consumer contract, in which a consumer might select a vendor from among several options, Plaintiffs here had “no choice but to use Respondus Monitor if their educational institutions selected Respondus Monitor as the automatic proctoring solution for courses in which they are enrolled.” (Compl. (Patterson) ¶ 4;
The court also finds that Plaintiffs” “opportunity to understand” the Student Terms was significantly reduced by the circumstances in which the contract was presented to them. See Phoenix, 242 Ill. 2d at 60, 949 N.E.2d at 647. The complaints allege that to take an exam, a student logged into their school“s learning management system and “open[ed] the LockDown Browser,” a program that “locks down a testing environment” by limiting a computer“s functionality. (Compl. (Patterson) ¶¶ 38, 49-50; Compl. (Wu) ¶¶ 33, 45-46.) Only after doing so was a student presented with the Student Terms and required to accept the contract as a “condition of proceeding with the exam.” (Compl. (Patterson) ¶ 50; Compl. (Wu) ¶ 46.) The Student Terms contain well over 40 paragraphs of text, many of them quite long. (See Student Terms.) The provision that Respondus now seeks to enforce—which is the second of two choice-of-law provisions in the contract—sits more than 30 paragraphs into the document under
b. Illinois Public Policy
The court also finds, separately, that enforcing the choice-of-law provision would violate Illinois public policy.
“When exercising diversity jurisdiction, a federal court must follow the choice of law rules adopted by the State in which it sits, including rules about whether stipulations as to choice of law are binding.” Flextronics Int“l USA, Inc. v. Sparkling Drink Sys. Innovation Ctr. Ltd, 186 F. Supp. 3d 852, 861 (N.D. Ill. 2016). Even where parties have entered an enforceable contract, Illinois courts do not enforce choice-of-law provisions if (1) doing so would violate fundamental Illinois public policy, and (2) Illinois has a materially greater interest in the litigation than the other state. Smurfit Newsprint, 368 F.3d at 949 (citing English Co., 278 Ill. App. 3d at 411, 663 N.E.2d at 452). The state“s public policy may be gleaned from its constitution, statutes, and case law. Morris B. Chapman & Assocs., Ltd. v. Kitzman, 193 Ill. 2d 560, 569, 739 N.E.2d 1263, 1270 (2000). When comparing two state“s laws, “the public policy considerations must be strong and of a fundamental nature to justify overriding the chosen law of the parties.” Potomac Leasing Co. v. Chuck“s Pub, Inc., 156 Ill. App. 3d 755, 759, 509 N.E.2d 751, 754 (2nd Dist. 1987); Demitropoulos v. Bank One Milwaukee, N.A., 915 F. Supp. 1399, 1413 (N.D. Ill. 1996) (noting that the “mere fact that state laws may differ” is not sufficient).
In enacting BIPA in 2008, the Illinois General Assembly codified the principle that “individuals possess a right to privacy in and control over their biometric identifiers and biometric information.” Rosenbach, 2019 IL 123186, ¶ 33, 129 N.E.3d at 1206. Recognizing the risks that arise from biologically unique identifying information, see, e.g.,
Plaintiffs contend that applying Washington law would contravene this fundamental Illinois public policy because Washington law provides no cause of action comparable to BIPA. Although Washington does have a biometric-privacy statute, see
In WTM, Inc. v. Henneck, for example, the plaintiffs, who filed suit in Illinois, sought to apply Minnesota law despite an Illinois choice-of-law provision contained in their contract with the defendants. 125 F. Supp. 2d 864, 867-68 (N.D. Ill. 2000). Applying Illinois choice-of-law rules, the court concluded that enforcing “the choice-of-law provision, [and] choosing Illinois law, is not contrary to the public policy of Illinois.” Id. That situation is the factual inverse of this one. Here, enforcing the choice-of-law provision would preclude, rather than require, the application of Illinois law, which is a much different outcome for the purpose of assessing this state“s public-
In the last case that Respondus cites, Potomac Leasing, an Illinois court enforced a Michigan choice-of-law provision even though doing so would deprive the defendants of an affirmative defense that they sought to plead under an Illinois statute. See 156 Ill. App. 3d at 759, 509 N.E.2d at 754. That decision provides minimal guidance here. For one thing, the statute in question concerned a narrow, technical matter that did not appear to implicate any fundamental Illinois public policy. See id. at 756-57, 509 N.E.2d at 753. In fact, because the parties were business entities that had dealt with each other at arms” length, the court determined that the “freedom to contract” was the key public policy at issue. See id. at 759, 509 N.E.2d at 754. Finally, the decision to apply Michigan law merely foreclosed a single affirmative defense; it did not frustrate the defendant“s remaining argument that it had not actually defaulted on the lease agreement in dispute. See id. at 756-57, 509 N.E.2d at 753.
Because applying Washington law would leave Plaintiffs without recourse under BIPA or any analogous right of action, it would undermine the fundamental Illinois public policy of protecting individual privacy rights over biometric data. See In re Facebook, 185 F. Supp. 3d at
Relatedly, the court also recognizes that Illinois has a materially greater interest in this litigation than Washington does. Respondus argues that although Washington law offers no counterpart to BIPA, it “has a countervailing interest since Respondus is a Washington corporation and maintains its principal place of business in Washington.” (Respondus Mot. (Patterson) at 9; Respondus Mot. (Wu) at 10.) Taken alone, the mere fact of corporate domicile is not compelling. See English Co., 278 Ill. App. 3d at 411, 663 N.E.2d at 452 (holding that Illinois had a materially greater interest in litigation where the “[t]he interests of the State of Washington rest solely on [defendant“s] status as a Washington corporation“). Because Illinois has enacted BIPA, and Washington is connected to this dispute only by virtue of the Defendant“s domicile, Illinois has a materially greater interest in the litigation. The court therefore declines to enforce the choice-of-law provision. See Smurfit Newsprint, 368 F.3d at 949.
C. Failure to State a Claim Under BIPA
Having determined which documents are properly considered on Respondus“s Rule 12 motions and concluded that Illinois law applies in all three cases, the court turns to Respondus“s arguments that Plaintiffs have failed to state a claim under BIPA. Again, however, the court is
1. Section 15(a) and Standing
The Patterson, Wu, and Veiga Plaintiffs all claim that Respondus violated
In briefing these motions, the parties did not discuss standing, but Respondus touched on the topic in its removal papers for the Patterson and Veiga cases. (See Notice of Removal
The court disagrees. Considering each complaint as a whole, the court finds that none of the Plaintiffs alleges that Respondus failed to comply with a retention-and-destruction policy or that Respondus otherwise retained their biometric data beyond the time limits set by
Without allegations of a more concrete and particularized harm, such as the unlawful retention of their biometric data beyond the time limits set by
2. Section 15(b)
The Patterson, Wu, and Veiga Plaintiffs all claim that Respondus violated
According to Respondus, the Student Terms adequately “explain the data that Respondus Monitor captures and how that data is used.” (Respondus Reply (Patterson) at 15; Respondus Reply (Wu) at 15.) The court agrees with Plaintiffs, however, that the language Respondus cites is not clear enough, by itself, to satisfy
3. Section 15(c) and Standing
The Patterson and Wu Plaintiffs (but not the Veiga Plaintiffs) claim that Respondus violated
Whatever the merits of these competing statutory interpretations, the court must address the issue of standing once again. Plaintiffs allege no concrete or particularized harm resulting from a violation of
The Patterson and Wu Plaintiffs (but not the Veiga Plaintiffs) claim that Respondus violated
As the court has already discussed, the Additional Information page is not properly considered on this motion. And as the court explained with respect to the Patterson and Wu Plaintiffs”
5. Deriving Biometric Data Through Photographic Means
Finally, Respondus makes a halfhearted argument that Plaintiffs” allegations do not concern “biometric identifiers” or “biometric information” within the meaning of BIPA. Specifically, Respondus suggests that any information derived through photographic means, such as a video recording, is categorically excluded from BIPA“s definitions of “biometric” data. (Respondus Mot. (Patterson) at 19; Respondus Mot. (Wu) at 19; Respondus Mot. (Veiga) at 15.) The apparent
BIPA defines a “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” and it defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual“s biometric identifier.” See
Plaintiff Courtnie Patterson alleges that Lewis University (“Lewis“) violated sections 15(a), 15(b), 15(c), and 15(d) of BIPA. In this motion, Lewis asks the court to dismiss Patterson“s claims because (1) Lewis is exempt from BIPA, (2) Patterson“s claims are time barred, and (3) Patterson has failed to state a claim.
A. BIPA“s Exemption for “Financial Institutions”
By way of background, Title V of the Gramm-Leach-Bliley Act (“GLBA“),
The parties disagree, first, about a threshold question of statutory interpretation. Lewis urges that BIPA“s
Only a few courts have squarely considered BIPA“s financial-institution exemption. Last year, in Doe v. Elmhurst University, an Illinois circuit court adopted the incorporation theory that Lewis now advocates: “The term “financial institution” in Section 14/25(c) of [BIPA] means an entity that is subject to Title V of the [GLBA] and the rules promulgated thereunder . . . .” Doe v. Elmhurst Univ., No. 2020 L 1400, slip op. at 1 (Cir. Ct. DuPage Cnty. June 9, 2021). (See No. 20 C 7692 [61-1].) After determining that Elmhurst did qualify as a “financial institution” under the GLBA, the court dismissed the case. Doe v. Elmhurst Univ., No. 2020 L 1400, slip op. at 1 (Cir. Ct. DuPage Cnty. Nov. 19, 2021). (See No. 20 C 7692 [76-2].) More recently, in Doe v. Northwestern University, a judge in this district approvingly cited Elmhurst“s holding that “the plain meaning of “financial institution” in BIPA is the same as in GLBA.” Doe v. Northwestern Univ., No. 21 C 1579, slip op. at 2 (N.D. Ill. Feb. 22, 2022) (Lefkow, J.). (See No. 20 C 7692 [76-1].)
Given the brevity of these decisions, the proper construction of
In arguing that it is engaged in such activities, Lewis relies on statements made by the Federal Trade Commission, which, Lewis asserts, “is vested with the regulatory authority for the GLBA.” (Lewis Mot. at 4 (citing
A complaint is not required to “anticipate affirmative defenses to survive a motion to dismiss.” United States v. Lewis, 411 F.3d 838, 842 (7th Cir. 2005). On a Rule 12 motion like this one, ordinarily it is inappropriate to dismiss a claim based on an affirmative defense unless “the allegations of the complaint itself set forth everything necessary to satisfy” it. Id. Even if Lewis“s argument rested on firmer legal ground, it does not appear that Patterson“s complaint, by itself, would provide the facts necessary for Lewis to persuade the court on its GLBA argument. Lewis“s brief relies heavily on non-record facts, suggesting that
This confusion over the breadth of FTC authority undermines much of Lewis“s argument. Lewis“s chief piece of evidence that it is subject to GLBA (and therefore exempt from BIPA) is a statement that the FTC issued in 2000, when it published a final rule implementing a portion of Title V: “The Commission disagrees with those commenters who suggested that colleges and universities are not financial institutions. Many, if not all, such institutions appear to be significantly engaged in lending funds to consumers.” See FTC, Privacy of Consumer Financial Information, 65 Fed. Reg. 33,646, 33,648 (May 24, 2000) (promulgating 16 C.F.R. pt. 313).19
The court recognizes the complexity of the administrative landscape created by the GLBA, especially as amended by the Dodd-Frank Act. See
B. Statute of Limitations
The parties agree that BIPA itself contains no statute of limitations. See
Although the Illinois Supreme Court has not resolved this question, the First District recently provided an answer in Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563,
This court will follow the persuasive reasoning of Tims. See Blood v. VH-1 Music First, 668 F.3d 543, 546 (7th Cir. 2012) (explaining that where the Illinois Supreme Court has not spoken directly on an issue, a federal court applying Illinois law may give “may give ‘proper regard‘” to a lower state court‘s decision (quoting Comm‘r v. Estate of Bosch, 387 U.S. 456, 465 (1967))). Patterson‘s claims under sections 15(a) and 15(b) are governed by a five-year statute of limitations, see
Lewis does not argue that any of Patterson‘s claims would be barred by the five-year statute of limitations, so Patterson‘s claims under sections 15(a) and 15(b) survive this timeliness challenge. The remaining question is whether Patterson‘s section 15(c) and 15(d) claims were filed within the one-year time frame that applies to them. Patterson alleges that she “was a student at Lewis between 2015 and 2019” (Compl. (Patterson) ¶ 98), but she did not file her claims against Lewis until January 22, 2021 (see id. at 26). According to Lewis, that filing date was “more than a year after [Patterson] could have last possibly used the software,” which renders her claims untimely. (Lewis Mot. at 11.) In response, Patterson points out that
Lewis‘s argument presupposes that any BIPA claim necessarily accrued when Patterson “used” Respondus Monitor. But that is untrue at least for Patterson‘s section 15(d) claim. Patterson alleges that Lewis unlawfully disclosed her biometric data to instructors or other agents without her consent. (Compl. (Patterson) ¶ 160.) While it is true that Lewis initially obtained Patterson‘s biometric data around the time she used Respondus Monitor, Patterson alleges that Lewis may retain such data for a substantial period of time. (See, e.g., id. 63-64.) Lewis therefore could have made an unlawful disclosure of Patterson‘s biometric data long after she stopped being a student in 2019.
Patterson‘s section 15(c) claim is trickier because the theory of harm is more convoluted. The complaint alleges that Respondus violated section 15(c) because it (1) charged its students tuition and other fees for online coursework, (2) required the use of Respondus Monitor for the completion of that coursework, and (3) obtained students’ biometric data through their use of Respondus Monitor. (See Compl. (Patterson) ¶¶ 149-51.) Even if Patterson stated a claim for a violation of section 15(c) by Lewis, it is not clear when the violation occurred. The court is mindful, however, that a “plaintiff is not required to plead elements in his or her complaint that overcome affirmative defenses, such as statute-of-limitations defenses.” NewSpin Sports, LLC v. Arrow Elecs., Inc., 910 F.3d 293, 299 (7th Cir. 2018). “The right question is whether it is possible to imagine proof of the critical facts consistent with the allegations actually in the complaint.” U.S. Gypsum Co. v. Ind. Gas Co., 350 F.3d 623, 628 (7th Cir. 2003). For now, the court declines to dismiss any of Patterson‘s claims for untimeliness, as it is not clear from the
C. Failure to State a Claim Under BIPA
Having rejected, for now, the argument that Lewis is exempt from BIPA under section 25(c), as well as Lewis‘s timeliness challenge, the court turns to the merits of Patterson‘s BIPA claims against Lewis. As explained below, Lewis moves to dismiss the complaint for various reasons. In evaluating Patterson‘s claims, the court again recognizes its “independent duty to ensure” that this case is properly in federal court. Dexia Crédit Loc., 602 F.3d at 883.
1. “Possession” of Biometric Data
Lewis argues that all of Patterson‘s claims fail because she has not alleged that Lewis was “in possession of” her biometric data. By their terms, sections 15(a), 15(c), and 15(d) of BIPA apply to private entities “in possession of” biometric data.20
Lewis cites two main cases, but neither clearly supports its position. In Heard, this court granted a Rule 12(b)(6) motion on some of the plaintiff‘s BIPA claims because “most of [the plaintiff‘s] allegations concerning possession merely parrot the statutory language” of BIPA. Heard, 440 F. Supp. 3d at 968. The complaint, which alleged in conclusory terms that the defendant “stored” biometric data, failed to explain how the defendant exercised any control over that data, how it held the data at its disposal, whether it could freely access the data, or even how it had received the data in the first place. Id. The complaint in Kloss v. Acuant, Inc., 462 F. Supp. 3d 873, 877 (N.D. Ill. 2020), was possibly even more barebones, and the court reasonably found that its allegations were “so sketchy that the complaint does not provide the type of notice of the claim to which the defendant is entitled under Rule 8.‘” Id. at 876 (quoting Brooks v. Ross, 578 F.3d 574, 581 (7th Cir. 2009)).
Patterson alleges far more detailed facts about the circumstances of Lewis‘s “possession” of her biometric data. According to the complaint, Lewis purchases a license to use the Respondus Monitor tool for remote proctoring. (Compl. (Patterson) ¶¶ 36.) When a student takes an exam using Respondus Monitor, the program captures various forms of biometric data, including scans of the student‘s facial geometry. (See, e.g., id. ¶¶ 82-87.) The exam-related data captured by Respondus Monitor flows into a review system that is integrated with Lewis‘s learning management system, providing Lewis‘s instructors with the ability to view and analyze the data. (Id. ¶¶ 36, 46-47, 70-71.) The Student Terms and the Institution Terms, both of which Patterson attached to her complaint, provide further details about how Lewis has “control” of students’ biometric data or holds such data at its “disposal.” See Ward, 215 Ill. 2d at 325, 830 N.E.2d at 560. For example, the Student Terms provide that exam recordings (and, allegedly, related biometric data) will be “controlled by your institution” and may be “evaluated”
These allegations do not suffer from the lack of details identified in Heard or Kloss. Patterson has adequately sketched out how Respondus Monitor obtains or generates biometric data, how Lewis or its agents may freely access that data, and even how Lewis may dictate how or when that biometric data is shared or disposed of. She has therefore sufficiently pleaded that Lewis was “in possession of” her biometric data.
2. Section 15(a) and Standing
Patterson claims that Lewis violated section 15(a) because it (1) “does not have a written policy made available to the public establishing a retention schedule and guidelines for permanently destroying” biometric data, and (2) “does not comply with any established retention schedule or destruction guideline.” (Compl. (Patterson) ¶¶ 126-27.) In its motion to dismiss, Lewis makes no argument that applies specifically to this claim, but the court must again consider the issue of standing.
As an initial matter, the court recognizes that Patterson‘s two-part section 15(a) claim against Lewis appears to differ from her section 15(a) claim against Respondus, which the court discussed above. As against Lewis, Patterson does not invoke only the publication theory; she also claims that Lewis has not complied with a proper retention-and-destruction policy. That additional theory might well support a finding that Patterson has standing, because the unlawful retention of biometric data beyond the time limits set by section 15(a) works a concrete and
The court thus concludes that Patterson has not established Article III standing for her section 15(a) claim against Lewis. It will therefore remand this claim.
3. Section 15(b)
Patterson claims that Lewis violated section 15(b) because it collected her biometric data without (1) informing her in writing that it was doing so, (2) informing her in writing of the purpose and length of the term for which it was doing so, or (3) receiving a written release executed by her. (Compl. (Patterson) ¶¶ 138-40.) In its motions to dismiss, Lewis contends that Patterson has failed to allege that Lewis “collected” her biometric data.
Under section 15(b), a private entity must obtain an individual‘s informed, written consent before it may “collect, capture, purchase, receive through trade, or otherwise obtain” the individual‘s biometric data.
Lewis believes that Patterson has alleged no such active step, but the court disagrees. As described above with respect to the “possession” issue, Patterson has made detailed allegations about how the Respondus Monitor software captures biometric data and transfers it into Lewis‘s hands. (See, e.g., Compl. (Patterson) ¶¶ 36, 46-47, 70-71, 82-87.) Although the
Lewis cites at least one case that directly undermines its own argument. In Namuwonge, an employee asserted a section 15(b) claim against a vendor (Kronos) that provided her employer (Brookdale) with a timekeeping system that collected her biometric data. Namuwonge, 418 F. Supp. 3d at 281-82. The court found that the complaint failed to allege that the vendor took an active step in collecting the biometric data. Id. at 286 (“[T]he more precise allegation . . . makes clear that Brookdale collected the fingerprints using a system that Kronos supplied to Brookdale.“). Here, Respondus‘s role is closer to that of the more-passive vendor, Kronos, while Lewis is akin to the employer, Brookdale, that affirmatively implemented the timekeeping system at issue.
In sum, the court finds that Patterson adequately alleges that Lewis took an active step to “collect” or “obtain” her data, as required by section 15(b).
4. Section 15(c) and Standing
Patterson claims that Lewis violated section 15(c) because it “profits from requiring students to use Respondus Monitor, as it allows Lewis to offer online coursework and thereby receive tuition dollars from students.” (Compl. (Patterson) ¶ 151.) In other words, she does not claim that Lewis sold, leased, or traded her biometric data directly. Rather, she claims that Lewis “otherwise profit[s] from” biometric data by requiring tuition-paying students to use Respondus Monitor, a program through which Lewis obtains their biometric data.
Instead of engaging with that somewhat convoluted theory on the merits, Lewis simply argues that Patterson lacks standing, and the court agrees. Patterson alleges only a bare violation of the “general regulation” prohibiting “the operation of a market” in biometric data. Thornley, 984 F.3d at 1247. Without more substantial allegations about how she was
5. Section 15(d)
Finally, Patterson claims that Lewis violated section 15(d) because it “discloses or disseminates students’ biometric identifiers or biometric information to its instructors and other agents without the students’ consent to the disclosure.” (Compl. (Patterson) ¶ 160.) In its motion to dismiss, Lewis argues that Patterson has failed to allege that Lewis “disclose[d]” or “disseminate[d]” her biometric data, as required by section 15(d). Again, the court agrees with Lewis.
Section 15(d) prohibits a private entity in possession of biometric data from disclosing or disseminating that data except in certain circumstances, such as obtaining a subject‘s consent.
CONCLUSION
For the reasons explained above, Respondus‘s motion to dismiss the Patterson complaint (No. 20 C 7692 [48]) is denied, but the court remands Plaintiff‘s section 15(a) and 15(c) claims against Respondus for lack of standing. Respondus‘s motion to dismiss the Wu complaint (No. 21 C 1785 [21]) is denied, as well, but the court dismisses without prejudice Plaintiff‘s section 15(a) and 15(c) claims for lack of standing. Respondent‘s motion to dismiss the Veiga complaint (No. 21 C 2620 [15]) is also denied, but the court remands Plaintiffs’ section
ENTER:
REBECCA R. PALLMEYER
United States District Judge
Dated: March 23, 2022