Lawsuit Claims DePaul’s Respondus Remote Exam Proctoring Tool Infringed on Ill. Students’ Privacy Rights [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims DePaul University’s use of a remote proctoring tool for online exams constitutes a violation of an Illinois biometric privacy law.

The Chicago university, according to the 22-page case, collects through its Respondus Monitor tool students’ biometric data, including facial recognition and detection data, keystroke patterns, eye monitoring and gaze monitoring data, and camera and microphone recordings, via webcam. The issue, the lawsuit alleges, is that DePaul, a school with more than 21,000 in-person and online students, has made use of the Respondus Monitor’s biometric capture tools without first obtaining students’ written and informed consent to do so, or providing a mandatory retention schedule and guidelines for the destruction of the data.

“Through Respondus Monitor, DePaul collects, captures, and stores everything from a student’s facial features to their voice through a web portal accessed through the student’s personal device,” the complaint states. “Using the Respondus Monitor tool, DePaul is able to collect and aggregate information on all aspects of a student’s life.”

Students, on the other hand, are “left in the dark” with regard to the “vast amount of information” collected through the Respondus Monitor, the complaint alleges. The lawsuit argues that DePaul has violated the Illinois Biometric Information Privacy Act (BIPA) by failing to disclose the use of or obtain students’ consent to use their biometric information and inform the individuals as to how long the sensitive information would be retained.

According to the case, a student who’s to take an online exam must first log into DePaul’s learning management system and open a browser, after which they are required to accept the Respondus Monitor Terms of Use for Students. Per the case, nowhere in the terms of use in effect before January 21, 2021 were students informed that the Respondus tool would collect, capture, analyze and disseminate their biometric identifiers or biometric information. The suit notes that Respondus updated its terms of use on January 21, 2021 to better reflect the extent to which the program captures and records students’ biometrics.

Moreover, neither the privacy policies in effect prior to January 21 nor DePaul’s data policy disclosed that students’ biometrics would be captured by the Respondus Monitor, nor did either establish a retention schedule and guidelines for when and how the data would be destroyed, both of which are requirements under the BIPA.

Per the suit, the BIPA was designed to protect Illinois residents against “the threat of irreversible privacy harms, identity theft, and other economic injuries” arising from the use of their biometric identifiers and information, which the case stresses cannot be changed if compromised.

The lawsuit alleges that DePaul’s failure to adhere to the BIPA’s disclosure and consent requirements amounts to an invasion of the privacy rights of the plaintiff and proposed class members.

The case, filed in Cook County, Illinois Circuit Court, looks to represent all DePaul University students in Illinois who took an assessment using Respondus Monitor at any time within the past five years until January 20, 2021.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.