UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
COURTNIE PATTERSON, individually and ) on behalf of all others similarly situated, ) ) Plaintiff, ) ) No. 20 C 7692 v. ) ) Judge Rebecca R. Pallmeyer RESPONDUS, INC. and ) LEWIS UNIVERSITY, ) ) Defendants. )
MEMORANDUM OPINION AND ORDER In this putative class action, Plaintiff Courtnie Patterson claims that Defendants Respondus, Inc. and Lewis University violated her rights under the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq. Earlier this year, the court denied in part each Defendant’s motion to dismiss. See Patterson v. Respondus, Inc., __ F. Supp. 3d __, 2022 WL 860946 (N.D. Ill. Mar. 23, 2022). Among other rulings, the court concluded that Defendant Lewis had failed to establish that it is exempt from BIPA compliance by virtue of its status as a “financial institution” subject to the Gramm–Leach–Bliley Act (GLBA), a federal privacy law. See 740 ILCS 14/25(c) (exempting from BIPA any “financial institution” regulated under the GLBA). Lewis now asks the court to reconsider that ruling. As explained below, the motion [86] is denied. BACKGROUND BIPA is an Illinois law that regulates how private entities may collect and handle individuals’ biometric data. Section 15 contains BIPA’s substantive regulations, see 740 ILCS 14/15, and section 20 creates a private cause of action for violations, see id. § 14/20. Although BIPA generally imposes its regulations on any “private entity” that might collect or handle biometric data, see id. § 14/15, section 25(c) contains an important limitation on BIPA’s scope: “Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm–Leach–Bliley Act of 1999 and the rules promulgated thereunder.” Id. § 14/25. Title V of the GLBA, 15 U.S.C. §§ 6801 et seq., is a federal privacy law; it regulates how “financial institutions” handle certain customer information. See 15 U.S.C. § 6801(a) (statement of policy); see also Am. Bar Ass’n v. FTC, 430 F.3d 457, 459 (D.C. Cir. 2005) (background); N.Y. State Bar Ass’n v. FTC, 276 F. Supp. 2d 110, 111–12 (D.D.C. 2003) (same). Among other things, the GLBA “limits the instances in which a financial institution may disclose nonpublic personal information about a consumer to nonaffiliated third parties and requires financial institutions to provide certain privacy notices to their consumers and customers.” CFPB, Privacy of Consumer Financial Information (Regulation P), 76 Fed. Reg. 79,025, 79,025 (Dec. 21, 2011) (citing 15 U.S.C. §§ 6802, 6803(a)). In its motion to dismiss, Lewis argued that it fits within the BIPA exemption, 740 ILCS 14/25(c), which would foreclose Patterson’s claims against it. Patterson challenged that defense for two reasons. First, Patterson argued that the term “financial institution,” as used in BIPA, should be given its plain and ordinary meaning, which would not encompass a university like Lewis. Second, Patterson argued that even if BIPA incorporates the GLBA’s specialized definition of “financial institution,” which is broader than the term’s plain meaning, Lewis has not established as a matter of law that it satisfies that broader definition—and therefore has not shown that it is “subject to” the GLBA and its rules. In its earlier opinion, this court did not address the first issue, instead simply sustaining Patterson’s second objection—that is, the court concluded that Lewis had not established that it was “subject to” the GLBA and its rules. Lewis had relied heavily on a Federal Trade Commission (FTC) notice published in the Federal Register in 2000, when the agency promulgated a final rule under the GLBA. According to that FTC statement, educational institutions like Lewis may qualify as “financial institutions” subject to the GLBA if they are “significantly engaged in lending funds to consumers.” Lewis contended that this language supported its argument, but the court noted a concern about its continued force: since the time the FTC issued that statement, rulemaking authority under the GLBA was transferred from the FTC to the Consumer Financial Protection Bureau (CFPB). Lewis cited no regulations, policy statements, or other materials from the CFPB. And the FTC rule that Lewis cited indirectly, by way of the 2000 Federal Register notice, has since been narrowed to cover only certain entities in the motor-vehicle industry—a category that unquestionably does not encompass universities. Lewis’s failure to comment on these developments undermined the court’s confidence that the FTC’s statements remain relevant or authoritative. Thus, the court explained that it was rejecting Lewis’s argument “[b]ased on the information it has been shown,” but it hinted at the possible usefulness of “further briefing” about the GLBA’s complicated regulatory scheme. Lewis now asks the court to reconsider its ruling on BIPA’s financial-institution exemption or, in the alternative, to certify the issue for interlocutory appeal. LEGAL STANDARD A motion to reconsider an interlocutory order, such as the denial of a motion to dismiss, is governed by Federal Rule of Civil Procedure 54(b). Patrick v. City of Chicago, 103 F. Supp. 3d 907, 911 (N.D. Ill. 2015). Motions for reconsideration are ordinarily viewed with disfavor. Birdo v. Gomez, 214 F. Supp. 3d 709, 714 (N.D. Ill. 2016); see also Caine v. Burge, 897 F. Supp. 2d 714, 716–17 (N.D. Ill. 2012). And they are said to serve a “limited function”—either “to correct manifest errors of law or fact or to present newly discovered evidence.” Conditioned Ocular Enhancement, Inc. v. Bonaventura, 458 F. Supp. 2d 704, 707 (N.D. Ill. 2006) (quoting Caisse Nationale de Credit Agricole v. CBI Indus., Inc., 90 F.3d 1264, 1269 (7th Cir. 1996)); see also Zurich Cap. Mkts. Inc. v. Coglianese, 383 F. Supp. 2d 1041, 1045 (N.D. Ill. 2005) (“Motions to reconsider are not at the disposal of parties who want to ‘rehash’ old arguments.” (internal quotation marks omitted)). Although the standard for reconsideration is a high one, Rule 54(b) preserves the district court’s broad, inherent authority to revise its interlocutory orders at any time before it enters final judgment. Wiegel v. Stork Craft Mfg., Inc., 891 F. Supp. 2d 941, 944 (N.D. Ill. 2012); see also Galvan v. Norberg, 678 F.3d 581, 587 & n.3 (7th Cir. 2012) (noting a district court’s “sweeping authority” under Rule 54(b)). In this case, the court’s earlier opinion did not reject Lewis’s argument conclusively. Instead, it suggested that “further briefing” was likely to help provide a “more decisive answer” about whether Lewis is subject to the GLBA. Having effectively invited this motion, the court is inclined to entertain it. DISCUSSION The court’s analysis proceeds in two steps. First, the court considers section 25(c) of BIPA and concludes, contrary to Patterson’s plain-meaning construction, that BIPA directly incorporates the GLBA’s definition of the term “financial institution.” Second, the court assesses whether Lewis satisfies that incorporated federal definition. As explained below, the court concludes that Lewis has failed to establish, at this stage, that it is “significantly engaged in financial activities” within the meaning of the GLBA. I. Definition of “Financial Institution” in Section 25(c) of BIPA Section 25(c) of BIPA provides that “[n]othing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm–Leach–Bliley Act of 1999 and the rules promulgated thereunder.” 740 ILCS 14/25(c). Thus, BIPA restrictions do not apply to institutions subject to GLBA’s privacy provisions. In its motion to dismiss, Lewis argued that section 25(c) incorporates its definition of “financial institution” directly from the GLBA. Patterson responded that the term “financial institution” in section 25(c) should instead be given its plain and ordinary meaning, which is narrower than the GLBA’s (and would not, on its face, include a university like Lewis). The court declined to weigh in on the proper construction because Lewis had not satisfied the court that it was “subject to” the GLBA and its rules—a showing that was required under either party’s interpretation of the BIPA exemption. Having been given clearer information about the GLBA, the court now addresses the definitional issue regarding section 25(c) of BIPA. When interpreting an Illinois statute like BIPA, the court applies Illinois rules of statutory construction.1 See Zahn v. N. Am. Power & Gas, LLC, 815 F.3d 1082, 1089 (7th Cir. 2016). Under Illinois law, “[t]he primary rule of statutory construction is to ascertain and give effect to the intent of the legislature.” People v. Donoho, 204 Ill. 2d 159, 171, 788 N.E.2d 707, 715 (2003). The parties have cited only three cases squarely considering section 25(c) of BIPA, but each one has adopted Lewis’s position that section 25(c) incorporates the GLBA’s definition of “financial institution.”2 See Doe v. Elmhurst Univ., No. 2020 L 1400, slip op. at 1 (Ill. Cir. Ct. DuPage Cnty. June 9, 2021) (“The term ‘financial institution’ in Section 14/25(c) of [BIPA] means an entity that is subject to Title V of the [GLBA] and the rules promulgated thereunder . . . .”), Ex. A to Def. Lewis Univ.’s Reply in Supp. of Its Mot. to Dismiss [61-1]; Doe v. Northwestern Univ., __ F. Supp. 3d __, 2022 WL 1485905, at *1 (N.D. Ill. Feb. 22, 2022) (Lefkow, J.) (citing Elmhurst and holding that “the plain meaning of ‘financial institution’ in BIPA is the same as in GLBA”); Duerr v. Bradley Univ., __ F. Supp. 3d __, 2022 WL 1487747, at *5 (C.D. Ill. Mar. 10, 2022) (holding that “the Illinois legislature intended ‘financial institution’ to have the meaning given to it by the GLBA”). After this motion had been briefed, a fourth such decision was issued. See Fee v. Ill. Inst. of Tech., No. 21 C 2512, 2022 WL 2791818, at *2 (N.D. Ill. July 15, 2022) (Wood, J.) (“BIPA’s exemption for financial institutions subject to Title V of the GLBA means what it says and is therefore best understood by looking to Title V of the GLBA.” (emphasis added)).
1 Neither the Illinois Supreme Court nor any intermediate Illinois appellate court appears to have directly discussed the scope of the BIPA section 25(c) exemption. In the absence of such guidance, this court’s task is to determine how the Illinois Supreme Court would interpret the statute. See Rodas v. Seidlin, 656 F.3d 610, 626 (7th Cir. 2011).
2 The GLBA defines “financial institution” as “any institution the business of which is engaging in financial activities,” 15 U.S.C. § 6809(3)(A), such as “[l]ending, exchanging, transferring, investing for others, or safeguarding money or securities”; “[p]roviding financial, investment, or economic advisory services”; and “[u]nderwriting, dealing in, or making a market in securities,” 12 U.S.C. § 1843(k)(4) (enumerating various types of activities “considered to be financial in nature”). The court discusses this language in more detail below in Section II. In each of these decisions, the courts have concluded that the meaning of section 25(c) is clear. Duerr, for example, cited the settled-meaning canon, which provides that “if a term has a settled legal meaning, the courts will normally infer that the legislature intended to incorporate that established meaning into the law.” Duerr, 2022 WL 1487747, at *5 (quoting Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶ 29, 129 N.E.3d 1197, 1205). Given that “financial institution” is “the specific term of art used in the GLBA to describe GLBA-regulated entities,” the court concluded that section 25(c) was clearly intended to incorporate the GLBA’s definition of “financial institution” (and “affiliate”). Id. The Fee court took a slightly different interpretive approach but arrived at the same conclusion. It found that the plaintiff’s interpretation of section 25(c), like Patterson’s here, “is unnatural and relies on reading the term ‘financial institution’ in isolation from the ‘subject to Title V of the GLBA’ language.” Fee, 2022 WL 2791818, at *4. This court agrees with the reasoning of other courts on this issue. “Financial institution” is the central term of art that establishes the scope of the privacy restrictions imposed by GLBA. See 15 U.S.C. § 6801(a) (“It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information.” (emphasis added)); see also 12 C.F.R. § 1016.3(l)(3)(i) (defining “financial institution”). So, too, is “affiliate” a central term within the GLBA. See, e.g., 15 U.S.C. § 6802(a) (“[A] financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information . . . .” (emphasis added)); see also 12 C.F.R. § 1016.3(a)(1) (defining “affiliate”). The court finds it difficult to accept that BIPA’s straightforward language—which exempts “a financial institution or an affiliate of a financial institution that is subject to Title V of the [GLBA]”—refers to anything other than a “financial institution” within the meaning of the GLBA. Patterson nevertheless offers several reasons why BIPA’s use of “financial institution” (and presumably “affiliate”) should simply be given plain and ordinary meaning.3 The court does not find these arguments persuasive, and in fact finds some of them support Lewis’s incorporated- definition theory. For example, Patterson seizes on a stray comment in BIPA’s legislative history, when one of the bill’s sponsors described the section 25(c) exemption as applying to “banks that are covered under Federal Law.” IL H.R. Tran. 2008 Reg. Sess. No. 276 (May 30, 2008). (See also Pl.’s Mem. in Opp. to Def. Lewis Univ.’s Rule 12(b)(6) Mot. to Dismiss [55] (hereinafter “Patterson Mot. to Dismiss Opp.”) at 4–5.) Patterson says that the use of the word “banks” favors her plain- meaning construction of “financial institution,” but she appears to have overlooked the rest of the quotation. An intention to exempt from BIPA any entities that are “covered under Federal Law,” as the sponsor expressed, suggests that BIPA should not apply where the GLBA does. In other words, to the extent this legislative-history comment should carry any weight, it favors a construction of section 25(c) that directly harmonizes the respective scopes of BIPA and the GLBA. That harmony would be achieved through Lewis’s construction, not Patterson’s. As other courts have suggested, incorporating the GLBA’s definition of “financial institutions” into BIPA’s section 25(c) exemption would ensure that BIPA does not duplicate or conflict with the GLBA by subjecting any entities to both statutes. See Bryant v. Compass Grp. USA, Inc., 503 F. Supp. 3d 597, 601 (N.D. Ill. 2020) (speculating that the Illinois legislature “likely excluded financial institutions [from BIPA] because they are already subject to a comprehensive privacy protection
3 Patterson offers typical dictionary definitions for the term “financial institution.” See, e.g., Financial institution, BLACK’S LAW DICTIONARY (11th ed. 2019) (defining “financial institution” as a “business, organization, or other entity that manages money, credit, or capital, such as a bank, credit union, savings-and-loan association, securities broker or dealer, pawnbroker, or investment company”); Financial institution, MERRIAM-WEBSTER.COM (last accessed Oct. 6, 2022), https://www.merriam-webster.com/dictionary/financial%20institution (“a company that deals with money (as a bank, savings and loan, credit union, etc.)”). regime under federal law” (citing the GLBA)); Stauffer v. Innovative Heights Fairview Heights, LLC, 480 F. Supp. 3d 888, 902 (S.D. Ill. 2020) (approving of the theory that section 25(c) was crafted in order to protect BIPA from federal-preemption challenges); Fee, 2022 WL 2791818, at *4 (same). Next, Patterson opposes Lewis’s incorporation-by-reference construction because, in her view, expanding the section 25(c) exemption so broadly would undermine BIPA’s remedial scheme in a manner that its drafters cannot realistically have intended. (See Patterson Mot. to Dismiss Opp. at 9–11.) By its plain terms, BIPA covers any “private entity,” 740 ILCS 14/15, which means “any individual, partnership, corporation, limited liability company, association, or other group, however organized,” id. § 14/10. And the Illinois legislature expressed concern about the growing use of biometric data in various types of settings, such as “grocery stores, gas stations, and school cafeterias.” Id. § 14/5(b). According to Patterson, this language confirms that BIPA’s drafters intended for the law’s protections to apply broadly. If those drafters had intended to grant an exemption to every entity that is subject to the GLBA, Patterson urges, then they would have expressed that intent more plainly in section 25(c). By way of example, Patterson points out that the GLBA’s definition of a “financial institution” encompasses any retailer that “extends credit by issuing its own credit card directly to consumers.” 12 C.F.R. § 1016.3(l)(3)(ii)(A). Through a declaration, Patterson identifies several dozen major companies that offer branded credit cards to their customers and could therefore be exempt from BIPA under Lewis’s interpretation of section 25(c). (See Decl. of Samuel J. Strauss in Supp. of Patterson Mot. to Dismiss Opp. [56] (listing retailers such as Costco and Ikea, automobile manufacturers such as Ford and Toyota, oil companies such as Exxon Mobil and Shell, technology companies such as Apple and Uber, airlines such as American Airlines and JetBlue Airways, hotel chains such as Hyatt and Marriott, and travel websites such as Expedia and Priceline).) It is unlikely, Patterson urges, that the Illinois legislature would have exempted all these entities from BIPA without saying so more directly. The court does not believe that principles of statutory interpretation compel the conclusion for which Patterson argues. Lewis’s construction of section 25(c) does appear to narrow BIPA’s overall scope, but Patterson has not demonstrated that Lewis’s construction truly creates an exception that swallows the rule. Even if many companies (especially large ones) do offer branded credit cards to their customers, scores of others do not. And, as discussed above, BIPA’s drafters may well have viewed a broad exemption as being necessary to avoid a conflict with federal law. See Bryant, 503 F. Supp. 3d at 601; Stauffer, 480 F. Supp. 3d at 902; Fee, 2022 WL 2791818, at *4. Finally, Patterson argues that Lewis’s construction of section 25(c) would violate the Special Legislation Clause of the Illinois Constitution by creating arbitrary distinctions among the entities regulated by BIPA. (See Patterson Mot. to Dismiss Opp. at 11–12.) The Special Legislation Clause provides that “[t]he General Assembly shall pass no special or local law when a general law is or can be made applicable.” ILL. CONST. art. IV, § 13. By prohibiting the legislature from “conferring a special benefit or exclusive privilege on a person or a group of persons to the exclusion of others similarly situated,” the clause aims to “prevent arbitrary legislative classifications that discriminate in favor of a select group without a sound, reasonable basis.”4 Best v. Taylor Mach. Works, 179 Ill. 2d 367, 391, 689 N.E.2d 1057, 1069–70 (1997). Special-legislation challenges require a two-step inquiry. The court determines, first, “whether the statutory amendments discriminate in favor of a select group”; if they do, the court then determines “whether the classification created by the statutory amendments is arbitrary.” Allen v. Woodfield Chevrolet, Inc., 208 Ill. 2d 12, 22, 802 N.E.2d 752, 758–59 (2003). Where the dispute
4 See, e.g., Moline Sch. Dist. No. 40 Bd. of Educ. v. Quinn, 2016 IL 119704, ¶ 28, 54 N.E.3d 825, 832 (invalidating property-tax exemption that, in practice, provided relief to only a single airport operator, where “there is no reasonable basis for limiting the tax incentives to this particular type of business at this particular facility in this particular part of the state”); Allen v. Woodfield Chevrolet, Inc., 208 Ill. 2d 12, 23, 33, 802 N.E.2d 752, 759, 765 (2003) (invalidating various amendments to consumer-fraud statute that placed car dealers on “more advantageous footing” than other types of retailers, where the “artificially narrow focus” was “designed primarily to confer a benefit on a particular group, rather than to promote the general welfare”). does not involve a fundamental right or suspect classification, it is subject to the rational-basis standard, which requires only that the classification be “rationally related to a legitimate state interest.” Id. As Patterson sees things, an exemption from BIPA’s scope for all GLBA-regulated institutions would discriminate in favor of larger entities, which are more likely to qualify as “financial institutions” under the GLBA. (Patterson Mot. to Dismiss Opp. at 10.) “There is simply no rational reason for creating a scenario that would burden small local businesses while allowing larger multinational entities to use biometric authentication and verification equipment without any need for wading through the consent and disclosure framework put in place by BIPA.” (Id. at 11.) But the court has already identified a rational basis for exempting GLBA-regulated entities from BIPA: avoiding a preemption challenge based on an apparent conflict with federal law. Supra; see also Bryant, 503 F. Supp. 3d at 601 (rejecting a similar special-legislation challenge to section 25(c) and noting that “[t]he General Assembly’s decision to exclude certain entities from BIPA’s coverage is eminently rational”); Fee, 2022 WL 2791818, at *4 (“[T]he legislature could have rationally excluded financial institutions subject to Title V of the GLBA either because it concluded that Title V’s privacy regulations were sufficient or out of a concern over federal preemption.”).5 For the reasons discussed above, the court agrees with Lewis that section 25(c) of BIPA simply incorporates the GLBA’s definition of “financial institution.”
5 Patterson herself articulates no cogent reason why “national banks or local credit unions”—but not other entities that are subject to the GLBA—would be exempt from BIPA. (See Patterson Mot. to Dismiss Opp. at 4.) Because Patterson’s special-legislation argument fails on its own merits, however, the court need not address Lewis’s contention that Patterson’s plain- meaning construction itself might violate the Special Legislation Clause. (Def. Lewis Univ.’s Reply in Supp. of Its Mot. to Dismiss [61] at 8 (arguing that Patterson’s plain-meaning construction of section 25(c) “would be nothing more than a random handout to certain entities in the financial industry, chosen solely based on whether they satisfy the dictionary definition of ‘financial institution.’”).) II. Whether Lewis Is a “Financial Institution” Under the GLBA Having determined that section 25(c) incorporates the GLBA’s definition of “financial institution,” the court turns to the question whether Lewis satisfies that definition. As noted above, Title V of the GLBA, 15 U.S.C. §§ 6801 et seq., is a federal privacy law that regulates how “financial institutions” handle certain customer information. See 15 U.S.C. § 6801(a) (statement of policy). A. Applicable GLBA Regulations The statute provides that a “financial institution” is “any institution the business of which is engaging in financial activities,” 15 U.S.C. § 6809(3)(A), such as “[l]ending, exchanging, transferring, investing for others, or safeguarding money or securities”; “[p]roviding financial, investment, or economic advisory services”; and “[u]nderwriting, dealing in, or making a market in securities,” 12 U.S.C. § 1843(k)(4) (enumerating various types of activities “considered to be financial in nature”). Lewis has given little attention to this statutory text in either of its two motions. Instead, it has focused mainly on “the rules promulgated []under” the GLBA. See 740 ILCS 14/25(c). The court therefore discusses the GLBA’s regulatory landscape in some detail. When first enacted, Title V of the GLBA granted rulemaking authority to several agencies, including the FTC. See Gramm–Leach–Bliley Act (GLBA), Pub. L. No. 106-102, § 504(a), 113 Stat. 1338, 1439 (1999). (See also Def. Lewis Univ.’s Mem. in Supp. of Its Mot. for Recons. [87] (hereinafter “Lewis Mem.”) at 3.) Section 504 of the GLBA allocated this rulemaking authority consistent with the scope of each agency’s enforcement authority under section 505. GLBA § 504(a), 113 Stat. at 1439. The FTC, the last agency listed in section 505, was given enforcement authority (and hence rulemaking authority) over “any other financial institution or other person that is not subject to the jurisdiction of any agency or authority under” the preceding paragraphs. GLBA § 505(a)(7), 113 Stat. at 1441. The FTC soon issued a final rule pursuant to this broad, residual rulemaking authority. See FTC, Privacy of Consumer Financial Information, 65 Fed. Reg. 33,646, 33,648 (May 24, 2000) (promulgating 16 C.F.R. pt. 313). The FTC’s rule stated that “[a]n institution that is significantly engaged in financial activities is a financial institution.” Id. at 33,679; see also id. at 33,654–56 (analysis). In its commentary on the new rule, the FTC stated that it “disagrees with those commenters who suggested that colleges and universities are not financial institutions,” as “[m]any, if not all, such institutions appear to be significantly engaged in lending funds to consumers.” Id. at 33,648. The agency noted, however, that “such entities are subject to the stringent privacy provisions in the Federal Educational Rights and Privacy Act [FERPA] and its implementing regulations.” Id. (citation omitted). It therefore added an important provision to the text of the rule: “Any institution of higher education that complies with the [FERPA] and its implementing regulations, and that is also a financial institution subject to the requirements of this part, shall be deemed to be in compliance with this part if it is in compliance with FERPA.” Id. at 33,678 (citations omitted). Lewis’s motion to dismiss summarized the FTC’s position more or less clearly. Missing from Lewis’s analysis, however, was recognition that in 2010, the Dodd–Frank Act transferred most section 504 rulemaking authority—including most of the FTC’s—to the Consumer Financial Protection Bureau (CFPB).6 See Dodd–Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 1093, 124 Stat. 1376, 2095–96 (2010); see also FTC, Privacy of Consumer Financial Information Rule Under the Gramm–Leach–Bliley Act, 86 Fed. Reg. 70,020, 70,020 (2021) (describing this change). As things stand now, the FTC has section 504 rulemaking authority only over certain entities in the motor-vehicle industry.7 15 U.S.C. § 6804(a)(1)(C); 12 U.S.C. § 5519(a); see also 86 Fed. Reg. at 70,020 (describing this change).
6 This was an understandable omission; it appears that several courts also failed to note that the FTC no longer possess the authority under which it published the 2000 rules and related policy statements. See Doe v. Northwestern Univ., __ F. Supp. 3d __, 2022 WL 1485905 (N.D. Ill. Feb. 22, 2022); Doe v. Elmhurst Univ., No. 2020 L 1400 (Ill. Cir. Ct. DuPage Cnty. Nov. 18, 2021); Duerr v. Bradley Univ., __ F. Supp. 3d __, 2022 WL 1487747 (C.D. Ill. Mar. 10, 2022).
7 Although the Dodd–Frank narrowed the FTC’s section 504 rulemaking authority, the agency has retained its broad section 505 enforcement jurisdiction. 15 U.S.C. § 6805(a)(7). In its motion for reconsideration, Lewis notes that the CFPB, after being empowered by the Dodd–Frank Act, restated most of the existing GLBA regulations as its own regulations. See 12 C.F.R. pt. 1016; see also 76 Fed. Reg. at 79,025 (describing the CFPB’s process of republishing the existing GLBA regulations under the agency’s new authority conferred by Dodd– Frank). Thus, CFPB’s regulations contain a definition of “financial institutions” that, as it turns out, is substantially the same as the FTC’s definition. (See Lewis Mem. at 4 (citing 12 C.F.R. § 1016.3(l)(3)(i)).)8 In fact, the CFPB maintains a specific definition of “financial institutions” that applies to entities, like Lewis, that are subject to the FTC’s still-broad enforcement jurisdiction.9 Second, the CFPB’s regulations contain a carveout for institutions that comply with FERPA. (See Lewis Mem. at 3–4 (citing 12 C.F.R. § 1016.3(b)(2)(ii)).) Again, that means the CFPB’s rule is substantially the same as the FTC’s rule was, at least with respect to the provisions that Lewis cited in its motion to dismiss.10 B. Lewis’s “Financial Activities” The court turns now to the merits of Lewis’s argument that it is a “financial institution . . . that is subject to” the GLBA and its rules. It is worth restating in full the CFPB’s definition of a “financial institution” under the GLBA:
8 Compare 12 C.F.R. § 1016.3(l)(3)(i) (CFPB) (“[A]n institution that is significantly engaged in financial activities is a financial institution.”), with 16 C.F.R. § 313.3(k)(1) (FTC) (“An institution that is significantly engaged in financial activities, or significantly engaged in activities incidental to such financial activities, is a financial institution.”).
9 Compare 12 C.F.R. § 1016.3(l)(1) (CFPB’s default definition of “financial institution”), with id. § 1016.3(l)(3)(i) (CFPB’s definition of “financial institution” for entities subject to FTC’s enforcement jurisdiction under 15 U.S.C. § 6805(a)(7)).
10 Compare 12 C.F.R. § 1016.1(b)(2)(ii) (CFPB) (“Any institution of higher education that complies with the [FERPA] and its implementing regulations and that is also a financial institution described in § 1016.3(l)(3) of this part, shall be deemed to be in compliance with this part if it is in compliance with FERPA.”), with 16 C.F.R. § 313.1(b) (2021) (FTC) (“Any institution of higher education that complies with the [FERPA] and its implementing regulations and that is also a financial institution subject to the requirements of this part, shall be deemed to be in compliance with this part if it is in compliance with FERPA.”). [F]inancial institution means any institution the business of which is engaging in financial activities as described in [12 U.S.C. 1843(k)]. For purposes of [entities subject to the FTC’s enforcement jurisdiction], an institution that is significantly engaged in financial activities is a financial institution. 12 C.F.R. § 1016.3(l)(3)(i). According to Patterson, the phrase “the business of which” means that entities “merely ‘engaging in’ financial activities tangential to their core business” cannot be included. (Pl.’s Mem. in Opp. to Def. Lewis Univ.’s Mot. for Recons. [94] (hereinafter “Patterson Opp.”) at 11.) Because Lewis’s core business is providing education, not lending money, Patterson believes that it cannot be considered a “financial institution” under this rule. (Id. at 7– 11.) Reasonable as that construction of paragraph (l)(3)(i) appears to be, it is inconsistent with the language of the second sentence, which clarifies the scope of the first. For entities within the FTC’s enforcement jurisdiction (such as universities like Lewis), the CFPB defines “financial institution” as “an institution that is significantly engaged in financial activities.” 12 C.F.R. § 1016.3(l)(3)(i) (emphasis added). CFPB regulations include examples that suggest that the word “significantly” means something less than “primarily” (the meaning that Patterson prefers). Id. § 1016.3(l)(3)(ii) (listing examples of “financial institutions,” such as a “retailer that extends credit by issuing its own credit card directly to consumers”). Patterson’s preferred definition would also be inconsistent with the FTC’s statement (made when it had still broad GLBA rulemaking authority) that it “disagrees with those commenters who suggested that colleges and universities are not financial institutions,” as “[m]any, if not all, such institutions appear to be significantly engaged in lending funds to consumers.” 65 Fed. Reg. at 33,648.11
11 As the court has now discussed at length, the FTC no longer possesses the rulemaking authority that it had when it made this statement in 2000. Yet Patterson has failed to cite any material change in the applicable rules under the CFPB’s authority. In fact, it appears that the CFPB crafted its rules to leave the FTC’s existing policies intact. The court thus sees no reason why the FTC statement should not help determine the proper scope of the GLBA. Cf. Santangelo v. Comcast Corp., No. 15 C 293, 2015 WL 3421156, at *4 n.5 (N.D. Ill. May 28, 2015) (citing cases that relied on a policy statement from an agency that no longer possessed the pertinent legal authority, where the successor agency had not taken a contrary position). The court therefore rejects Patterson’s suggestion that a university cannot possibly qualify as a “financial institution” within the meaning of the GLBA. But Lewis cannot rely on the FTC’s statement that many colleges and universities “appear to be” financial institutions; it still must establish that it is, in fact, “significantly engaged” in financial activities. Lewis cites various judicially noticeable facts that it believes are sufficient to answer this inquiry affirmatively.12 According to Lewis’s website, for example, 98% of the university’s students receive financial aid. Financial Aid: Overview, LEWIS UNIV. (last visited Oct. 11, 2022), https://www.lewisu.edu/ admissions/finaid/index.htm. First-year students at Lewis receive an average of $18,000 per year in grants and scholarships. Id. And the university participates in programs offering a “vast array of Federal subsidized and unsubsidized loans.” Financial Aid: Student Loans, LEWIS UNIV. (last visited Oct. 11, 2022), https://www.lewisu.edu/admissions/finaid/loans.htm. The website of the Federal Student Aid Office, an agency within the Department of Education, notes Lewis’s participation in federal financial aid programs under Title IV of the Higher Education Act of 1965. See Federal School Code Lists, FED. STUDENT AID (last visited Oct. 11, 2022), https://fsapartners.ed.gov/knowledge-center/library/resource-type/Federal%20School%20Code %20Lists (identifying Lewis under school code number 1707). A few courts have found similar facts to be sufficient, at the pleading stage, to establish that a university defendant was “significantly engaged in financial activities” within the meaning of the GLBA. See Northwestern, 2022 WL 1485905, at *2; Hr’g Tr. at 24:19–26:9, Elmhurst, No. 2020 L 1400 (Ill. Cir. Ct. DuPage Cnty. Nov. 18, 2021), Ex. 3 to Def. Lewis Univ.’s Mot. for Leave to Cite Add. Authority [76-3]; Bradley, 2022 WL 1487747, at *7.
12 “[W]hen requested by a party, a court ‘shall’ take judicial notice of a fact that is ‘not subject to reasonable dispute in that it is . . . capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned.’” Denius v. Dunlap, 330 F.3d 919, 926 (7th Cir. 2003) (quoting FED. R. EVID. 201(b), (d)). Judicial notice under Rule 201 may extend to facts contained on a defendant’s website. Goplin v. WeConnect, Inc., 893 F.3d 488, 491 (7th Cir. 2018). Lewis cited its website in the opening brief for both its motions, and Patterson has made no argument in opposition to those citations. The court thus finds that it is appropriate to take judicial notice of the facts that Lewis has cited here. This court is less certain. At most, these facts seem to demonstrate that Lewis participates in programs through which its students obtain loans from third-party lenders. In other words, these facts do not establish that Lewis itself is “significantly engaged in lending funds to consumers.” 65 Fed. Reg. at 33,648. Judge Wood, of this district, recently rejected a university’s motion to dismiss on the same grounds. Fee, 2022 WL 2791818, at *5 (“[T]he fact that IIT is a participant in federal student aid does not, by itself, establish that IIT is regularly extending or administering student loans.”) (emphasis omitted). She noted that “further factfinding” was necessary to determine “how many IIT students receive federal student aid, whether IIT itself makes loans to its students, or the nature and extent of IIT's involvement with respect to its students’ loans (federal or otherwise).” Id. This court agrees with that analysis and is unwilling to conclude on this sparse record, that Lewis itself is “significantly engaged” in financial activities within the meaning of the GLBA. Separately from the facts identified above, the parties have spent substantial time arguing about various administrative materials, mainly from the Department of Education. For example, the Federal Student Aid Office has issued “Dear Colleague” letters stating that universities are subject to Title V of the GLBA. See Fed. Student Aid Office, U.S. Dep’t of Educ., GEN-15-18, Protecting Student Information (July 29, 2015), https://fsapartners.ed.gov/knowledge-center/ library/dear-colleague-letters/2015-07-29/protecting-student-information (“Under Title V of the Gramm-Leach-Bliley Act, financial services organizations, including institutions of higher education, are required to ensure the security and confidentiality of customer records and information.”).13
13 See also Fed. Student Aid Office, U.S. Dep’t of Educ., GEN-16-12, Protecting Student Information (July 1, 2016), https://fsapartners.ed.gov/knowledge-center/library/dear- colleague-letters/2016-07-01/gen-16-12-subject-protecting-student-information (similar); Fed. Student Aid Office, U.S. Dep’t of Educ., Enforcement of Cybersecurity Requirements Under the Gramm–Leach–Bliley Act (Feb. 28, 2020), https://fsapartners.ed.gov/knowledge-center/library/ electronic-announcements/2020-02-28/enforcement-cybersecurity-requirements-under-gramm- leach-bliley-act (similar). Lewis urges the court to defer to the Department’s statements under Skidmore v. Swift & Co., 323 U.S. 134 (1944), because the Department “has shown that it has expertise pertaining to higher education with relationship to financial student aid programs.” (Lewis Mem. at 5.) The court disagrees. “Under Skidmore, a court will respect an agency’s interpretation of the statute it administers, but only to the extent that the agency’s interpretation possesses the ‘power to persuade.” Vulcan Constr. Materials, L.P. v. Fed. Mine Safety & Health Rev. Comm'n, 700 F.3d 297, 316 (7th Cir. 2012) (emphasis added) (quoting Skidmore, 323 U.S. at 140). Because no agency within the Department of Education has any authority under the GLBA, see 15 U.S.C. §§ 6804-6805, it is not appropriate to defer to the Department’s interpretation of the GLBA’s scope. See Fee, 2022 WL 2791818, at *5 (rejecting the argument that Department of Education agencies are entitled to deference in interpreting the GLBA, because “the Department of Education has not been given rulemaking or enforcement authority with respect to the statute”)."4 CONCLUSION For the foregoing reasons, the court denies Lewis’s motion for reconsideration [86] and denies its request to certify this issue for interlocutory appeal without prejudice.
ENTER:
Dated: October 11 2022 REBECCA R. PALLMEYER United States District Judge
“4 Somewhat similarly, Lewis cites a “Program Participation Agreement” that it has entered with the Department of Education. (See Program Participation Agreement, Ex. B to Lewis Mem. [87-2].) Because this agreement expressly requires that Lewis comply with the GLBA, Lewis presents the document as evidence that it is “subject to” the GLBA. But as Patterson points out, this agreement seems to show merely that the Department of Education—again, an agency without any formal authority under the GLBA—has elected to require institutions like Lewis to comply with certain GLBA provisions. (Patterson Opp. at 5—7.) 17