A class action complaint brought against DePaul claims the university has been illegally collecting, using and disclosing students’ biometric information without their consent via technology used to proctor remote exams. 

The tool used by the university to proctor online exams is Respondus Monitor. Described to the Washington Post as akin to “spyware,” proctoring software like Respondus Monitor collects data from facial-recognition and eye monitoring data to keystroke patterns and camera and microphone recordings, according to the lawsuit. 

“Through Respondus Monitor, DePaul collects, captures and stores everything from a student’s facial features to their voice through a web portal accessed through the student’s personal device,” the lawsuit reads. “Using the Respondus Monitor tool, DePaul is able to collect and aggregate information on all aspects of a student’s life.”

The complaint claims that because DePaul does not disclose or obtain written consent before collecting and storing users’ biometric data, it is in violation with the state’s Biometric Information Privacy Act, or BIPA. The law, passed in 2008, is designed to protect against invasion of privacy, identity theft and other economic injuries, according to the suit.  

Respondus Lawsuit by DePaulia on Scribd

To use the software prior to an exam, students must go through a number of steps, the complaint reads. 

First, they conduct a webcam check, where students sit in the center of the camera’s frame and speak into the microphone. Then, a photo is captured of the student to confirm their identity; photo identification may be required prior to proceeding. Students must then show the software a 360-degree “environment check” of their location. Finally, a “facial detection check” is conducted, where students look squarely into the webcam. 

That’s when students’ biometric identifiers are captured — without students’ consent, the complaint claims. 

According to the complaint, that Respondus, Inc. retains students’ biometric identifiers and information was not disclosed in the terms of use until Jan. 21. That data can be retained by the institutions utilizing the software for up to four years, which the lawsuit claims was also not disclosed in the terms of use until that date.

DePaul’s data policy also does not disclose that it collects biometric information and identifiers. 

DePaul is not the only university to use Respondus Monitor in the state, and it’s not the first university to be sued for violating BIPA because of that use. Similar allegations were levied against Northwestern, which was sued in February. 

The class action was filed on behalf of all similarly situated persons, meaning any DePaul student who took an exam using Respondus Monitor from the last five years to Jan. 21 — when the collection of biometric data was made known in the software’s terms of use — is included. 

DePaul declined to comment, citing its practice to refrain from commenting on pending litigation.