2:21-cv-02051-CSB-EIL # 1 Page 1 of 25
`E-FILED
` Friday, 12 March, 2021 01:47:13 PM
`
` Clerk, U.S. District Court, ILCD
`
`IN THE UNITED STATES DISTRICT COURT
`FOR THE CENTRAL DISTRICT OF ILLINOIS
`URBANA DIVISION
`
`
`RUTVIK THAKKAR, WILLIAM GONIGAM,
`and ANDREA KOHLENBERG, individually
`and on behalf of all others similarly situated,
`
`
`
`Case No.
`
`CLASS ACTION COMPLAINT
`
`JURY TRIAL DEMANDED
`
`Plaintiffs,
`
`
`Defendant.
`
`v.
`
`
`PROCTORU INC.,
`
`
`
`
`
`
`Plaintiffs Rutvik Thakkar, William Gonigam, and Andrea Kohlenberg (“Plaintiffs”),
`
`individually and on behalf of all other persons similarly situated, by and through their attorneys,
`
`make the following allegations pursuant to the investigation of their counsel and based upon
`
`information and belief, except as to allegations specifically pertaining to themselves and their
`
`counsel, which are based on personal knowledge.
`
`NATURE OF THE ACTION
`
`1.
`
`This is a class action suit brought against Defendant ProctorU Inc. (“ProctorU” or
`
`“Defendant”) for violations of the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS
`
`14/1 et seq. Defendant develops, owns, and operates an eponymous online proctoring software
`
`that collects biometric information.
`
`2.
`
`Plaintiffs bring this action for damages and other legal and equitable remedies
`
`resulting from the illegal actions of Defendant in collecting, storing and using their and other
`
`- 1 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 2 of 25
`
`
`
`similarly situated individuals’ biometric identifiers1 and biometric information2 (referred to
`
`collectively at times as “biometrics”). Defendant failed to provide the requisite data retention and
`
`destruction policies, and failed to properly “store, transmit, and protect from disclosure” these
`
`biometrics, in direct violation of BIPA.
`
`3.
`
`The Illinois Legislature has found that “[b]iometrics are unlike other unique
`
`identifiers that are used to access finances or other sensitive information.” 740 ILCS 14/5(c). “For
`
`example, social security numbers, when compromised, can be changed. Biometrics, however, are
`
`biologically unique to the individual; therefore, once compromised, the individual has no recourse,
`
`is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated
`
`transactions.” Id.
`
`4.
`
`In recognition of these concerns over the security of individuals’ biometrics the
`
`Illinois Legislature enacted BIPA, which provides, inter alia, that a private entity like Defendant
`
`that possesses biometrics must inform individuals in writing of the specific purpose and length of
`
`term for which such biometric identifiers or biometric information are being collected, stored and
`
`used. 740 ILCS 14/15(b).
`
`5.
`
`Moreover, entities collecting biometrics must publish publicly available written
`
`retention schedules and guidelines for permanently destroying biometrics collected. See 740 ILCS
`
`14/15(a).
`
`6.
`
`Finally, entities collecting biometrics must:
`
`(1) store, transmit, and protect from disclosure all biometric identifiers and
`biometric information using the reasonable standard of care within the private
`entity’s industry; and
`                                                            
`1
`A “biometric identifier” is any personal feature that is unique to an individual, including
`fingerprints, iris scans, DNA and “face geometry”, among others.
`2
`“Biometric information” is any information captured, converted, stored or shared based on
`a person’s biometric identifier used to identify an individual.
`
`- 2 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 3 of 25
`
`
`
`
`(2) store, transmit, and protect from disclosure all biometric identifiers and
`biometric information in a manner that is the same as or more protective than
`the manner in which the private entity stores, transmits, and protects other
`confidential and sensitive information.
`
`See 740 ILCS 14/15(e).
`
`7.
`
`In direct violation of §§ 15(a) and 15(b) of BIPA, Defendant collected, stored and
`
`used—without first publishing sufficiently specific data retention and deletion policies—the
`
`biometrics of hundreds or thousands of students who used Defendant’s software to take online
`
`exams.
`
`8.
`
`In direct violation of the foregoing provisions of BIPA § 15(e), Defendant also
`
`failed to “store, transmit, and protect from disclosure all biometric identifiers using the reasonable
`
`standard of care within” its industry, “and in a manner that is the same as or more protective than
`
`the manner in which” it collected other sensitive information.
`
`9.
`
`Plaintiffs are students who used ProctorU. During Plaintiffs’ use of the software,
`
`ProctorU collected their biometrics, including eye movements and facial expressions (i.e., face
`
`geometry) and keystroke biometrics.
`
`10.
`
`Because Defendant did not take the proper steps to safeguard Plaintiffs’ biometrics,
`
`Defendant was subject to a data breach. Further, Defendant does not sufficiently specify how long
`
`it will retain biometric information, or when it will delete such information. Accordingly, the only
`
`reasonable conclusion is that Defendant has not, and will not, destroy biometric data when the
`
`initial purpose for collecting or obtaining such data has been satisfied.
`
`11.
`
`BIPA confers on Plaintiffs and all other similarly situated Illinois residents a right
`
`to know of such risks, which are inherently presented by the collection and storage of biometrics,
`
`and a right to have their biometrics stored using a reasonable standard of care and in a manner that
`
`- 3 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 4 of 25
`
`
`
`is as protective if not more than the manner in which entities store other confidential information,
`
`and a right to know how long such risks will persist after ceasing using Defendant’s software.
`
`12.
`
`Yet, Defendant failed to take such reasonable safeguards to protect the biometrics
`
`of Plaintiffs or the Class, and failed to provide sufficient data retention or destruction policies to
`
`Plaintiffs or the Class.
`
`13.
`
`Plaintiffs bring this action to prevent Defendant from further violating the privacy
`
`rights of Illinois residents and to recover statutory damages for Defendant’s improper and
`
`lackluster collection, storage, and protection of these individuals’ biometrics in violation of BIPA.
`
`JURISDICTION AND VENUE
`
`14.
`
`This Court has subject matter jurisdiction over this action pursuant to 28 U.S.C.
`
`§ 1332(d) because there are more than 100 class members and the aggregate amount in
`
`controversy exceeds $5,000,000, exclusive of interest, fees, and costs, and at least one Class
`
`member is a citizen of a state different from Defendant.
`
`15.
`
`This Court has personal jurisdiction over Defendant because the biometrics that
`
`give rise to this lawsuit (1) belonged to Illinois residents, and (2) were collected by Defendant at
`
`Illinois schools or from students taking exams in Illinois.
`
`16.
`
`Venue is proper in this District pursuant to 28 U.S.C. § 1391 because Defendant
`
`does substantial business in this District and a substantial part of the events giving rise to Plaintiffs’
`
`claims took place within this District because Plaintiff Thakkar’s biometrics were collected in this
`
`District.
`
`PARTIES
`
`17.
`
`Plaintiff Rutvik Thakkar is, and has been at all relevant times, a resident of
`
`Champaign, Illinois and has an intent to remain there, and is therefore a domiciliary of Illinois.
`
`- 4 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 5 of 25
`
`
`
`18.
`
`Plaintiff William Gonigam is, and has been at all relevant times, a resident of
`
`Sleepy Hollow, Illinois and has an intent to remain there, and is therefore a domiciliary of Illinois.
`
`19.
`
`Plaintiff Andrea Kohlenberg is, and has been at all relevant times, a resident of
`
`Wheaton, Illinois and has an intent to remain there, and is therefore a domiciliary of Illinois.
`
`20.
`
`Defendant ProctorU Inc. is a Delaware corporation with its principal place of
`
`business at 2200 Riverchase Center Suite #600, Birmingham, Alabama 35244. Defendant
`
`develops, owns, and operates an online proctoring software of the same that is used throughout
`
`Illinois.
`
`FACTUAL BACKGROUND
`
`I.
`
`Illinois’ Biometric Information Privacy Act
`
`21.
`
`The use of a biometric scanning system entails serious risks. Unlike other methods
`
`of identification, facial geometry is a permanent, unique biometric identifier associated with an
`
`individual. This exposes individuals to serious and irreversible privacy risks. For example, if a
`
`device or database containing individuals’ facial geometry data is hacked, breached, or otherwise
`
`exposed, individuals have no means by which to prevent identity theft and unauthorized tracking.
`
`22.
`
`Recognizing the need to protect citizens from these risks, Illinois enacted the
`
`Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”) in 2008, to regulate
`
`companies that collect and store biometric information, such as facial geometry. See Illinois House
`
`Transcript, 2008 Reg. Sess. No. 276.
`
`23.
`
`BIPA requires that a private entity in possession of biometrics:
`
`must develop a written policy, made available to the public, establishing a
`retention schedule and guidelines for permanently destroying biometric
`identifiers and biometric information when the initial purpose for collecting or
`obtaining such identifiers or information has been satisfied or within 3 years of
`the individual’s last interaction with the private entity, whichever occurs first.
`
`
`
`- 5 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 6 of 25
`
`
`
`740 ILCS 14/15(a).
`
`
`24. Moreover, entities collecting biometrics must inform individuals “in writing of the
`
`specific purpose and length of term for which a biometric identifier or biometric information is
`
`being collected, stored, and used.” 740 ILCS 14/15(b)(2).
`
`25.
`
`Further, entities collecting biometrics must:
`
`(1) store, transmit, and protect from disclosure all biometric identifiers and
`biometric information using the reasonable standard of care within the private
`entity’s industry; and
`
`(2) store, transmit, and protect from disclosure all biometric identifiers and
`biometric information in a manner that is the same as or more protective than
`the manner in which the private entity stores, transmits, and protects other
`confidential and sensitive information.
`
`See 740 ILCS 14/15(e).
`
`26.
`
`As alleged below, Defendant violated BIPA §§ 15(a) and 15(b) by failing to specify
`
`the length of time that it would retain biometrics, or provide a deletion schedule for biometric
`
`information.
`
`27. Moreover, and upon information and belief, because Defendant has failed to specify
`
`the length of time it retains biometrics, the only reasonable conclusion is that Defendant has not,
`
`and will not, destroy biometric data when the initial purpose for collecting or obtaining such data
`
`has been satisfied.
`
`28.
`
`Further, as alleged below, Defendant violated BIPA § 15(e) by:
`
`(a)
`
`(b)
`
`Failing to store, transmit, and protect from disclosure all biometric
`identifiers and biometric information using the reasonable standard of care
`within Defendant’s industry; and
`
`Failing to store, transmit, and protect from disclosure all biometric
`identifiers and biometric information in a manner that is the same as or more
`protective than the manner in which Defendant stores, transmits, and
`protects other confidential and sensitive information.
`
`
`- 6 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 7 of 25
`
`
`
`II.
`
`Defendant Violates Illinois’ Biometric Information Privacy Act
`
`29.
`
`30.
`
`Defendant develops, owns, and operates an eponymous online proctoring software.
`
`One of the ways in which ProctorU monitors students is by collecting and
`
`monitoring their facial geometry. According to ProctorU’s advertising materials, this includes
`
`“[m]ultiple face recognition, eye movement tracking, [and] auditory analysis.”
`
`31.
`
`Indeed, Defendant’s Privacy Policy notes that “[w]e require you to share your photo
`
`ID on camera and we use that ID in conjunction with biometric facial recognition software to
`
`authenticate your identity. We also require you to perform a biometric keystroke measurement for
`
`some exams.”
`
`32.
`
`Defendant’s Privacy Policy also states that “[d]uring testing, we automatically track
`
`your keystroke pattern to ensure it matches the biometric profile created before the start of your
`
`exam.” Keystroke biometrics capture the exact way a student may type.
`
`33.
`
`To capture students’ biometrics, Defendant requires students to take a photo as
`
`“baseline” for their appearance before students begin an exam:
`
`- 7 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 8 of 25
`
`
`
`34.
`
`By using its facial recognition software, ProctorU can check for “suspicious
`
`behavior.” For instance, if a student looks down from their computer screen into their lap (e.g.,
`
`because a student is looking up an answer on her or her phone), ProctorU will detect this facial
`
`movement and record it as a possible instance of cheating:
`
`
`
`35.
`
`Defendant uses biometrics to create an identity profile for students and to confirm
`
`students’ identities during testing so as to prevent cheating.
`
`36.
`
`Online proctoring companies like Defendant have seen a significant uptick in light
`
`of the COVID-19 pandemic, which has caused institutions to move exams online. This has led to
`
`significant privacy implications for students.
`
`- 8 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 9 of 25
`
`
`
`37.
`
`For instance, some students taking the Bar Exam were forced to urinate while being
`
`monitored, because if they “broke eye contact,” their exams would be terminated.3
`
`38.
`
`Other students have broken down in tears during exams, recorded on video by
`
`online proctoring companies such as ProctorU.4
`
`39.
`
`Students have also published numerous petitions across the country to ask school
`
`administrators to cease using online proctoring tools.5
`
`40.
`
`Defendant has been in the crosshairs of this debate. In March 2020, the UC Santa
`
`Barbara Faculty Association wrote to the school’s chancellor to “express [its] serious concern
`
`about the potential widespread adoption of ProctorU.”6 The faculty argued that ProctorU’s
`
`infringement on “the privacy and digital rights of our students” was not worth “the expediency of
`
`a takehome final exam.” ProctorU responded by threatening the faculty association with a lawsuit
`
`for defamation.7
`
`41.
`
`However, these concerns were warranted. Despite representing in its Privacy
`
`Policy that it “use[s] commercially reasonable technical, organizational, and administrative
`
`                                                            
`3 Staci Zaretskym Law Students Forced To Urinate While Being Watched By Proctors During
`Remote Ethics Exam, ABOVE THE LAW, Aug. 18, 2020, https://abovethelaw.com/2020/08/law-
`students-forced-to-urinate-while-being-watched-by-proctors-during-remote-ethics-exam/.
`4 Thomas Germain, Poor Security at Online Proctoring Company May Have Put Student Data at
`Risk, CONSUMER REPORTS, Dec. 10, 2020, https://www.consumerreports.org/digital-security/
`poor-security-at-online-proctoring-company-proctortrack-may-have-put-student-data-at-risk/.
`5 Jason Kelley, Students Are Pushing Back Against Proctoring Surveillance Apps, ELECTRONIC
`FRONTIER FOUNDATION, Sept. 25, 2020, https://www.eff.org/deeplinks/2020/09/students-are-
`pushing-back-against-proctoring-surveillance-apps.
`6 https://pubcit.typepad.com/files/proctoru_2020-copy.pdf.
`7 Adam Steinbaugh, ProctorU Threatens UC Santa Barbara Faculty Over Criticism During
`Coronavirus Crisis, FIRE, Mar. 26, 2020, https://www.thefire.org/proctoru-threatens-uc-santa-
`barbara-faculty-over-criticism-during-coronavirus-crisis/; see also https://pubcit.typepad.com/
`files/bradley-bullying-letter.pdf (link to demand letter from ProctorU).
`
`- 9 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 10 of 25
`
`
`
`measures to protect our Services against unauthorized or unlawful access or processing and against
`
`accidental loss, theft, disclosure, copying, modification, destruction, or damage,” ProctorU was
`
`subject to a data breach in July 2020 that exposed the records of almost 500,000 students.8
`
`42.
`
`Thus, in direct violation of BIPA § 15(e)(1), from at least approximately June 2019
`
`through present, Defendant has failed to “store, transmit, and protect from disclosure all”
`
`biometrics in its possession using a “reasonable standard of care.”
`
`43.
`
`In addition, in direct violation of BIPA § 15(e)(2), from at least June 2019 through
`
`present, Defendant has failed to “store, transmit, and protect from disclosure all” biometrics in its
`
`possession information in a manner that is the same as or more protective than the manner in which
`
`[it] stores, transmits, and protects other confidential and sensitive information.”
`
`44.
`
`Further, as some commentators have noted, ProctorU has no time limit on how long
`
`it retains biometrics.9 Rather, ProctorU’s Privacy Policy simply states that “We retain information
`
`for as long as necessary to perform the Services described in this Policy, as long as necessary for
`
`us to perform any contract with you or your institution, or as long as needed to comply with our
`
`legal obligations.” The Privacy Policy does not have a section on the deletion of biometric
`
`information.
`
`45. Moreover, the data breach concerned records that dated back to 2012.10 This lends
`
`credence to the allegation that ProctorU is retaining records beyond when the initial purpose for
`
`collecting or obtaining such data has been satisfied.
`
`                                                            
`8 Lawrence Abrams, ProctorU Confirms Data Breach After Database Leaked Online,
`BLEEPINGCOMPUTER, Aug. 9, 2020, https://www.bleepingcomputer.com/news/security/proctoru-
`confirms-data-breach-after-database-leaked-online/.
`9 Jason Kelley & Lindsay Oliver, Proctoring Apps Subject Students to Unnecessary Surveillance,
`ELECTRONIC FRONTIER FOUNDATION, Aug. 20, 2020, https://www.eff.org/deeplinks/2020/09/
`students-are-pushing-back-against-proctoring-surveillance-apps
`10 Lawrence Abrams, ProctorU Confirms Data Breach After Database Leaked Online.
`
`- 10 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 11 of 25
`
`
`
`46.
`
`In direct violation of BIPA § 15(b)(2), from at least approximately June 2019
`
`through present, Defendant never informed Illinois students who had their facial geometry
`
`collected of the length of time for which their biometric identifiers or information would be
`
`collected, stored and used.
`
`47.
`
`In direct violation of § 15(a) of BIPA, from at least approximately June 2019
`
`through present, Defendant did not have written, publicly available policies identifying its
`
`retention schedules or guidelines, and has continued to retain the biometrics beyond the intended
`
`purpose for collection.
`
`III.
`
`Experience of Plaintiff Rutvik Thakkar
`
`48.
`
`Plaintiff Thakkar is an Illinois domiciliary. Plaintiff Thakkar used ProctorU to take
`
`his Test of English as a Foreign Language (“TOEFL”) exam online in January 2021.
`
`49. When Plaintiff Thakkar used ProctorU, his facial geometry, including his eye
`
`movements and facial expressions, was collected by Defendant.
`
`50. When Plaintiff Thakkar logged onto ProctorU, his facial geometry would be
`
`matched up to the biometrics he provided to Defendant to ensure he was the individual who was
`
`supposed to be taking an exam.
`
`51.
`
`Defendant did not inform Plaintiff Thakkar of the specific length of time that it
`
`intended to collect, store, and use his biometrics, nor did Defendant provide Plaintiff Thakkar with
`
`a retention schedule and guidelines for permanently destroying her biometrics.
`
`52.
`
`Upon information and belief, ProctorU continues to retain Plaintiff Thakkar’s
`
`biometrics beyond the intend purpose for collection.
`
`53.
`
`Thus, when Plaintiff Thakkar provided his biometrics to Defendant, Defendant
`
`collected said biometrics in violation of BIPA §§ 15(a) and 15(b).
`
`- 11 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 12 of 25
`
`
`
`54.
`
`Further, when Plaintiff Thakkar provided his biometrics to Defendant, and upon
`
`information and belief, the biometrics were not stored, transmitted, or protected from disclosure
`
`using a “reasonable standard of care.”
`
`55.
`
`In addition, when Plaintiff Thakkar provided his biometrics to Defendant, and upon
`
`information and belief, the biometrics were not stored, transmitted, or protected from disclosure
`
`“in a manner that is the same as or more protective than the manner in which [Defendant] stores,
`
`transmits, and protects other confidential and sensitive information.”
`
`56.
`
`Thus, when Plaintiff Thakkar provided his biometrics to Defendant, Defendant
`
`collected said biometrics in violation of BIPA § 15(e).
`
`IV.
`
`Experience of Plaintiff William Gonigam
`
`57.
`
`Plaintiff Gonigam is an Illinois domiciliary. Plaintiff Gonigam used ProctorU to
`
`take online exams at the University of Illinois at Urbana-Champaign online from at least June 2019
`
`through at least August 2020.
`
`58.
`
`Plaintiff Gonigam also used ProctorU to take the Graduate Record Examination
`
`(“GRE”) online in January 2021.
`
`59. When Plaintiff Gonigam used ProctorU, his facial geometry, including his eye
`
`movements and facial expressions, was collected by Defendant.
`
`60. When Plaintiff Gonigam logged onto ProctorU, his facial geometry would be
`
`matched up to the biometrics he provided to Defendant to ensure he was the individual who was
`
`supposed to be taking an exam.
`
`61.
`
`Defendant did not inform Plaintiff Gonigam of the specific length of time that it
`
`intended to collect, store, and use his biometrics, nor did Defendant provide Plaintiff Gonigam
`
`with a retention schedule and guidelines for permanently destroying her biometrics.
`
`- 12 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 13 of 25
`
`
`
`62.
`
`Upon information and belief, ProctorU continues to retain Plaintiff Gonigam’s
`
`biometrics beyond the intend purpose for collection.
`
`63.
`
`Thus, when Plaintiff Gonigam provided his biometrics to Defendant, Defendant
`
`collected said biometrics in violation of BIPA §§ 15(a) and 15(b).
`
`64.
`
`Further, when Plaintiff Gonigam provided his biometrics to Defendant, and upon
`
`information and belief, the biometrics were not stored, transmitted, or protected from disclosure
`
`using a “reasonable standard of care.”
`
`65.
`
`In addition, when Plaintiff Gonigam provided his biometrics to Defendant, and
`
`upon information and belief, the biometrics were not stored, transmitted, or protected from
`
`disclosure “in a manner that is the same as or more protective than the manner in which
`
`[Defendant] stores, transmits, and protects other confidential and sensitive information.”
`
`66.
`
`Thus, when Plaintiff Gonigam provided his biometrics to Defendant, Defendant
`
`collected said biometrics in violation of BIPA § 15(e).
`
`V.
`
`Experience of Plaintiff Amanda Kohlenberg
`
`67.
`
`Plaintiff Kohlenberg is an Illinois domiciliary. Plaintiff Kohlenberg used ProctorU
`
`to take her Law School Admission Test (the “LSAT”) online in November 2020.
`
`68. When Plaintiff Kohlenberg used ProctorU, her facial geometry, including her eye
`
`movements and facial expressions, was collected by Defendant.
`
`69. When Plaintiff Kohlenberg logged onto ProctorU, her facial geometry would be
`
`matched up to the biometrics she provided to Defendant to ensure she was the individual who was
`
`supposed to be taking an exam.
`
`- 13 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 14 of 25
`
`
`
`70.
`
`Defendant did not inform Plaintiff Kohlenberg of the specific length of time that it
`
`intended to collect, store, and use her biometrics, nor did Defendant provide Plaintiff Kohlenberg
`
`with a retention schedule and guidelines for permanently destroying her biometrics.
`
`71.
`
`Upon information and belief, ProctorU continues to retain Plaintiff Kohlenberg’s
`
`biometrics beyond the intend purpose for collection.
`
`72.
`
`Thus, when Plaintiff Kohlenberg provided her biometrics to Defendant, Defendant
`
`collected said biometrics in violation of BIPA §§ 15(a) and 15(b).
`
`73.
`
`Further, when Plaintiff Kohlenberg provided her biometrics to Defendant, and upon
`
`information and belief, the biometrics were not stored, transmitted, or protected from disclosure
`
`using a “reasonable standard of care.”
`
`74.
`
`In addition, when Plaintiff Kohlenberg provided her biometrics to Defendant, and
`
`upon information and belief, the biometrics were not stored, transmitted, or protected from
`
`disclosure “in a manner that is the same as or more protective than the manner in which
`
`[Defendant] stores, transmits, and protects other confidential and sensitive information.”
`
`75.
`
`Thus, when Plaintiff Kohlenberg provided her biometrics to Defendant, Defendant
`
`collected said biometrics in violation of BIPA § 15(e).
`
`CLASS ALLEGATIONS
`
`76.
`
`Class Definition: Plaintiffs seek to represent a class of similarly situated
`
`individuals defined as all Illinois residents who used ProctorU to take an exam online and and
`
`who had their facial geometry collected, captured, received, or otherwise obtained and/or stored
`
`by Defendant (the “Class”).
`
`77.
`
`Plaintiff Thakkar seeks to represent a subclass of similarly situated individuals,
`
`defined as follows (the “TOEFL Subclass”):
`
`- 14 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 15 of 25
`
`
`
`All Illinois residents who took the TOEFL online from March 2020
`through present and who had their facial geometry collected, captured,
`received, or otherwise obtained and/or stored by Defendant.
`
`Plaintiff Gonigam seeks to represent a subclass of similarly situated individuals,
`
`
`78.
`
`defined as follows (the “UIC Subclass”):
`
`All students at the University of Illinois at Urbana-Champaign took an
`online exam from June 2019 through August 2020 and who had their
`facial geometry collected, captured, received, or otherwise obtained
`and/or stored by Defendant.
`
`Plaintiff Gonigam also seeks to represent a subclass of similarly situated
`
`79.
`
`individuals, defined as follows (the “GRE Subclass”):
`
`All Illinois residents who took the LSAT online from March 2020
`through present and who had their facial geometry collected, captured,
`received, or otherwise obtained and/or stored by Defendant.
`
`Plaintiff Kohlenberg seeks to represent a subclass of similarly situated
`
`80.
`
`individuals, defined as follows (the “LSAT Subclass”):
`
`All Illinois residents who took the LSAT online from March 2020
`through present and who had their facial geometry collected, captured,
`received, or otherwise obtained and/or stored by Defendant.
`
`Collectively, the Class, TOEFL Subclass, the UIC Subclass, the GRE Subclass, and
`
`81.
`
`the LSAT Subclass shall be known as the “Classes.”
`
`82.
`
`Subject to additional information obtained through further investigation and
`
`discovery, the above-described Classes may be modified or narrowed as appropriate, including
`
`through the use of multi-state subclasses.
`
`83.
`
`Numerosity: At this time, Plaintiffs do not know the exact number of members of
`
`the aforementioned Classes. However, given the size of Defendant’s business and the number of
`
`students who took the TOEFL, LSAT, GRE, or online exams at the University of Illinois Urbana-
`
`- 15 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 16 of 25
`
`
`
`Champaign, the number of persons within the Classes is believed to be so numerous that joinder
`
`of all members is impractical.
`
`84.
`
`Commonality and Predominance: There is a well-defined community of interest
`
`in the questions of law and fact involved in this case. Questions of law and fact common to the
`
`members of the Classes that predominate over questions that may affect individual members of
`
`the Classes include:
`
`(a) whether Defendant collected or otherwise obtained Plaintiffs’ and the
`Classes’ biometric identifiers and/or biometric information;
`
`
`(b) whether Defendant developed a written policy, made available to the
`public, establishing a retention schedule and guidelines for permanently
`destroying biometric identifiers and biometric information when the
`initial purpose for collecting or obtaining such identifiers or information
`has been satisfied or within 3 years of their last interaction, whichever
`occurs first;
`
`
`(c) whether Defendant destroyed Plaintiffs’ and the Classes’ biometric
`identifiers and/or biometric information once that information was no
`longer needed for the purpose for which it was originally collected; and
`
`
`(d) whether Defendant used a reasonable standard of care when collecting,
`storing, and protecting from disclosure the biometrics of Plaintiffs and
`the Classes;
`
`
`(e) whether Defendant collected, stored, and protecting from disclosure the
`biometrics of Plaintiffs and the Classes in a manner that that is as
`protective if not more than the manner in which Defendant collects other
`biometric information;
`
`(f) whether Defendant’s violations of BIPA were committed intentionally,
`recklessly, or negligently.
`
`85.
`
`Typicality: Plaintiffs claims are typical of those of the Classes because Plaintiffs,
`
`
`
`
`
`like all members of the Classes, used ProctorU to take an online exam, and had their biometrics
`
`recorded and improperly stored by Defendant in violation of BIPA.
`
`- 16 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 17 of 25
`
`
`
`86.
`
`Adequate Representation: Plaintiffs have retained and are represented by
`
`qualified and competent counsel who are highly experienced in complex consumer class action
`
`litigation. Plaintiffs and their counsel are committed to vigorously prosecuting this class action.
`
`Moreover, Plaintiffs are able to fairly and adequately represent and protect the interests of the
`
`Classes. Neither Plaintiffs nor their counsel have any interest adverse to, or in conflict with, the
`
`interests of the absent members of the Classes. Plaintiffs have raised viable statutory claims or the
`
`type reasonably expected to be raised by members of the Classes, and will vigorously pursue those
`
`claims. If necessary, Plaintiffs may seek leave of this Court to amend this Class Action Complaint
`
`to include additional representatives to represent the Classes, additional claims as may be
`
`appropriate, or to amend the definition of the Classes to address any steps that Defendant took.
`
`87.
`
`Superiority: A class action is superior to other available methods for the fair and
`
`efficient adjudication of this controversy because individual litigation of the claims of all members
`
`of the Classes is impracticable. Even if every member of the Classes could afford to pursue
`
`individual litigation, the Court system could not. It would be unduly burdensome to the courts in
`
`which individual litigation of numerous cases would proceed. Individualized litigation would also
`
`present the potential for varying, inconsistent or contradictory judgments, and would magnify the
`
`delay and expense to all parties and to the court system resulting from multiple trials of the same
`
`factual issues. By contrast, the maintenance of this action as a class action, with respect to some
`
`or all of the issues presented herein, presents few management difficulties, conserves the resources
`
`of the parties and of the court system and protects the rights of each member of the Classes.
`
`Plaintiffs anticipate no difficulty in the management of this action as a class action. Class-wide
`
`relief is essential to compliance with BIPA.
`
`- 17 -
`
`

`

`2:21-cv-02051-CSB-EIL # 1 Page 18 of 25
`
`
`
`COUNT I – FOR DAMAGES AGAINST DEFENDANT
`VIOLATION OF 740 ILCS 14/15(A)
`
`88.
`
`89.
`
`Plaintiffs incorporate the foregoing allegations as if fully set forth herein.
`
`Plaintiffs bring this claim individually and on behalf of the members of the
`
`proposed Classes against Defendant.
`
`90.
`
`BIPA mandates that companies in possession of biometric data establish and
`
`maintain a satisfactory biometric data retention – and, importantly, deletion – policy. Specifically,
`
`those companies must: (i) make publicly available a written policy establishing a retention
`
`schedule and guidelines for permanent deletion of biometric data (at most three years after the
`
`company’s last interaction with the individual); and (ii) actually adhere to that retention schedule
`
`and actually delete the biometric information. See 740 ILCS 14/15(a).
`
`91.
`
`92.
`
`Defendant failed to comply with these BIPA mandates.
`
`Defendant is a corporation and does business in Illinois and thus qualifies as a
`
`“private entity” under BIPA. See 740