Software that aims to prevent university students from cheating while they take home exams during the Covid-19 pandemic is getting its first legal test under Europe’s privacy law.
The Amsterdam University student council is trying to stop use of Proctorio Inc. monitoring software. The students lost the first round when the Amsterdam District Court denied a preliminary injunction last month. The council appealed and expects a ruling within weeks on whether the court will hear it.
“The use of the program was unnecessary,” said Sofie van Londen, the attorney who represented the complainants. “The decision-making process leading up to the use of the program should have included the students.”
The court case shows the dilemma universities face as they try to prevent cheating while protecting privacy during a pandemic that has forced students to learn remotely. Proctoring software creates an exam-hall environment for students taking tests with webcams, keystroke trackers, and even eye-movement detectors.
Schools increasingly view the software as a solution to cheating, but “there are inherent privacy risks with these technologies,” said Estelle Masse, senior policy analyst at the data protection advocacy group Access Now.
For instance, the bloc-wide privacy law, the General Data Protection Regulation, requires explicit consent from people to process their data. However, privacy advocates question whether locked-down students who take exams at home can freely offer consent, especially if no practical alternative is available for taking tests.
At Amsterdam University, students view the technology as intrusive and wonder what information the camera records when they take tests, van Londen said.
A campus spokesman, Yasha Lange, said the university carried out a data protection assessment as required by the GDPR. The decision to use proctoring is valid for the coronavirus lockdown period, when distance learning is mandatory, he said.
Scottsdale, Ariz.-based Proctorio did not respond to a request for comment. The company on its website says test takers’ privacy “is at the core of our product,” and that data is transferred and stored with zero-knowledge encryption.
One software provider, Splashgain Technology Solutions Pvt Ltd, touts the convenience of having a human proctor monitor exams remotely and chat with users.
“There are a lot of cost-savings,” said Swapnil Dharmadhikari, director of the Pune, India-based company. “Students need not travel to the exam hall.”
In Europe, the list of campuses that have turned to proctoring software includes Delft and Tilburg universities in the Netherlands, the Technical University of Munich, VIVES University for Applied Sciences in Belgium, and Sorbonne University in France.
Use of such software will likely grow even after the pandemic, Dharmadhikari said.
The Splashgain platform uses facial recognition to ensure the correct student is taking an exam, he said. If the student leaves or consults a smartphone, or an additional person appears next to the student, the proctor will get an alert.
Doug Winneg, an executive vice president at Glendale, Calif.-based PSI Services LLC, which offers an online proctoring platform, said educators should use it only to notify certified online proctors of behavior they need to review personally.
“Technology should be used to protect data privacy,” he said.
As use of such software increases, national data regulators in Europe—who are charged with ensuring compliance with the GDPR—are taking note.
Anders Ballangrud, communication adviser at the Norwegian Data Protection Authority, said universities using the technology and their vendors must guard student privacy.
“Even in these extraordinary times, data controllers and data processors must ensure the protection of the data,” he said.
The Netherlands data agency said universities and their suppliers should process as little student information as possible and store it no longer than necessary. They should also inform students, teachers, and parents of minor children about how they protect personal data, the agency said.
Denmark’s agency referred to its decision earlier this year criticizing a pilot program by the government’s IT Education Agency. Around 8,000 students were asked to install and test the program which, in the opinion of the agency, did not ensure a level of security “appropriate to the risk” as demanded by the GDPR.
Even if universities get student permission to use proctoring software, such consent may not satisfy GDPR requirements, said Patrick Van Eecke, global co-chair of DLA Piper’s data privacy practice.
“The GDPR clearly states that consent should be freely given,” Van Eecke said. Such consent wouldn’t be regarded as freely given where there’s a clear authority imbalance, such as one involving a student and a school, he said.
Universities, instead, should use a different legal basis under the GDPR known as “legitimate interest,” he said.
“We indeed see that some universities have moved from asking the students for consent to legitimate interest,” Van Eecke said.
The “legitimate interest” standard requires universities to consider other, less-intrusive measures to mitigate the risk of exam cheating, including changes to the test format, said Jesper Lund, chairman of Denmark’s IT-Political Association. Another challenge under the standard is addressing students’ rights to object, he said.
“This hurdle may be very difficult to meet in practice unless the university can offer an alternative exam without online proctoring, such as exam halls,” Lund said.
The Amsterdam District Court, in denying the students’ preliminary injunction, said the university had a “legitimate interest” in introducing the monitoring under the GDPR—namely the coronavirus pandemic.
The court made clear that students may request an alternative exam, the students’ lawyer, van Londen said.
Not For All
Oxford, Cambridge, and the London School of Economics said they do not use proctoring software for exams. Sweden’s Karolinska Institute also said it didn’t use such software, citing privacy concerns.
“We do not comply with GDPR and other Swedish legislation if we demand that the students film themselves and their work or exam place in their home environment,” Institute spokesman Christian Edling said.
Such privacy concerns may limit the growth of proctoring sofware when the pandemic ends, Lund said.
“Because of the many challenges raised by the GDPR,” he said, “I would not expect that online proctoring will become widely used in the EU.”
—With reporting by Daniel R. Stoller