The Amsterdam Court of Appeal gives its verdict and rules against the Central Student Council of the University of Amsterdam. The use of Proctorio's software is permitted under the AVG.
During the first wave of the corona pandemic, the University of Amsterdam(UvA) started using the surveying software Proctorio during online (from home) examinations. The Central Student Council of the UvA(CSR) has privacy objections to the use of Proctorio and claimed in summary proceedings (in brief) a ban on the use of Proctorio by the UvA because it would violate the General Data Protection Regulation(AVG). At first instance, the interim relief judge dismissed CRS's claim. The Court upheld this. According to the Court, the UvA's use of Proctorio meets the requirements of the AVG.
Proctorio is software that identifies a student's deviant behavior while taking an online exam. Proctorio takes over the role of the physical invigilator, so to speak. In summary, Proctorio works as follows. When the exam platform is launched via the web browser of the student's computer, the surveying software is automatically activated. The software prompts the student to activate his microphone and webcam and share his screen. The student is then asked to show his student ID and perform a desktop scan to verify that the student does not have, for example, notes, a phone or a second computer in front of him. During the online exam, image, audio and browser data (among other things) are recorded. In an automated manner, the software checks this data for anomalous behavior that could indicate fraud, such as frequent looking away by the student or a lot of ambient noise (which could indicate app contact or consultation with fellow students). After completion of the exam, the invigilator can randomly check the desk scans as well as consult a score on deviant behavior for each student. If the software has detected significant deviant behavior and thus fraud is suspected, an invigilator can consult the stored data (image, audio and browser data) to assess the situation.
With the use of Proctorio, the UvA processes students' personal data. Students are monitored with images and sound while taking an online exam. This is radical and is only allowed when the requirements of the AVG are met. The basis for the processing is not in dispute. Apparently the parties agree that the UvA uses Proctorio to fulfill a task within the framework of the public authority assigned to the UvA in the Higher Education and Scientific Research Act (Article 6 (i)(e) AVG). But for data processing to be based on that basis, the data processing must also be necessary and proportionate for that purpose. The SRC disputes that this is the case. Also, according to the CSR, by using Proctorio, the UvA would violate the purpose limitation principle and the principle of data minimization, process special personal data without a basis and be insufficiently transparent about the use of Proctorio. Incidentally, we understand that Proctorio does not process biometric data. As far as we are concerned, there would not be a basis for that any time soon either.
The UvA argues that in view of the (at the time) coronary measures in force (including the closure of universities and the urgent advice to stay at home as much as possible), it is necessary to offer online examinations so that students do not suffer study delays. According to the UvA, the application of effective anti-fraud measures - as with physical examinations - is necessary for online examinations to ensure fair and reliable examinations - and thus the value of diplomas. The Court of Appeal followed the UvA in its reasoning and ruled that offering online examinations and deploying surveillance software is necessary to fulfill its task. According to the Court of Appeal, the deployment of Proctorio by the UvA also meets the requirements of the AVG. According to the Court, the processing of personal data by the UvA is only aimed at discovering possible fraud and does not go beyond that. In that context, the Court of Appeal considers it relevant that (i) the stored images and sound are only kept for a limited period of time, namely during the grading of the exams, and that (ii) visual inspection of the stored data takes place afterwards only in case significant deviant behavior has been established. The CSR's suggestion that invigilators would view the stored data even without concrete evidence of fraud has not been substantiated by the CSR with concrete evidence to that effect.
What the Court of Appeal does not mention in so many words, but in our opinion may have played an important role in the Court's judgment, is that the Data Protection Officer(FG) of the UvA was actively involved in the deployment of Proctorio and the UvA also conducted a Data Protection Impact Assessment(DPIA) beforehand. In other words, the UvA did not take any chances when deploying Proctorio and carefully assessed the privacy risks.
The CSR also argued that the fight against fraud by the UvA could also be achieved with alternatives that are less sensitive to privacy, such as blurring the image and only occasionally recording sound. However, the Court of Appeal ruled that this would make it less certain whether fraud had actually taken place and would therefore stand in the way of an effective fight against examination fraud. The argument of CSR that the UvA would process special personal data about the race or religion of students with the use of Proctorio (for instance when showing the student card) was also rejected by the Court of Appeal. In line with earlier case law and the current position of the Personal Data Authority(AP), the Court of Appeal has ruled that image recordings do not by definition qualify as special personal data and that it has not been made plausible that the use of Proctorio is aimed at collecting such data or at making distinctions on the basis of these data. Finally, the Court also rejected the CSR's reliance on Article 8 ECHR and Articles 10 and 13 of the Constitution.
In short, according to the Court, the UvA's use of online proctoring is in line with the AVG. Incidentally, that does not mean that the UvA may always deploy online proctoring in the future. This will always depend on the circumstances. In that context, the Court therefore rules that when the necessity for online proctoring ceases, an entirely different debate arises. The need for online proctoring and the related (far-reaching) invasion of students' privacy thus becomes difficult to sustain.
Online proctoring has received much attention during the corona pandemic. The AP has conducted research into the use of online proctoring research conducted and made practical recommendations for educational institutions considering the use of online proctoring. The AP's recommendations guide an educational institution through the steps that should be taken before deploying online proctoring, including (i) determining the purpose, (ii) determining the need, (iii) determining the basis, (iv) mitigating the invasion of student or pupil privacy, (v) conducting a DPIA and (vi) involving the FG.
