ATP PRIVACY LAW ALERT

Court Decision on Remote Proctoring in the Netherlands

Over the past two months a legal drama has been playing out in The Netherlands over the ability of the country's universities to use remote proctoring to monitor the validity and fairness of online exams and enable students to continue to progress their education while the institutions confront the inability of holding in-person classes/exams because of COVID-19.   While no ruling has yet been made by the Dutch Data Protection Authority, on June 11, a local court in Amsterdam ruled that in the limited circumstances presented involving the University of Amsterdam ("UvA"), remote proctoring processing of student personal information "is not unlawful."  This decision is potentially useful, but any testing organization using video surveillance needs to understand the full scope of what the decision means --  and what it does not mean. Among other facts, the decision is limited to the decision by the Dutch government, which established a "public interest" in the use of videoing students under the GDPR.

On April 23, the Dutch Data Protection Authority launched an investigation into the use of online/remote proctoring to ensure that student data is protected by the software providers.  On this issue, the Dutch Minister of Education took the position that, "as long as all legal requirements are met, universities' use of online proctoring software is GDPR-compliant."  The Minister has also been quoted as stating that, "if students want [their special category data, such as medical information or information about race or religion] to not be collected, then they are free to, as much as possible, keep physical appearances that reveal such information away from the proctoring" and "also, students are free to not participate in this form of examination."

There are 14 Dutch universities (institutions for academic university education) currently using online proctoring, of which 3 are private and the others are public, including UvA.  They differ in the extent to which they are using online exam surveillance, but none have rejected it.  Some had started testing online proctoring well before COVID-19 "lockdown" measures were taken by the Dutch government. Other universities have recently started online proctoring pilots and feasibility studies but have yet decided whether to deploy it and if so, at what scale.  Although the Dutch DPA provided an unsolicited, informal ruling to UvA, in which it stated that it "has no serious objections to the use of online proctoring," the Dutch Data Protection Commissioner has not officially decided on whether the use of video surveillance violates the General Data Protection Regulation ("GDPR").[1]

Against this backdrop, on June 2 the central student council (and one individual student) filed an action in the District Court in Amsterdam seeking to restrain the UvA from using Proctorio's online proctoring software for its June exams.  The complaint alleged that students should have the right to refuse to use Proctorio because such online proctoring infringes their personal privacy rights.  In response, the University argued that it has no other way to conduct online assessments in a way that protects the integrity and validity of the exams, courses, or the institution.  A hearing took place on June 4 and the court issued its decision on June 11 (Case No: C / 13/684665 / KG ZA 20-481 of the Court of Amsterdam).  A link to the English translation of the decision is:  https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBAMS:2020:2917

Critical facts specific to this case seem to relate to the court's favorable ruling.  In reaching its decision to use the online proctoring, the UvA took a number of preliminary steps to focus on student privacy issues, including conducting a Data Protection Impact Assessment (DPIA) to weigh the privacy risks.  For example, the UvA committed that all video will only be used to detect potential fraud if the software flags that a student may have been looking away from the computer screen to get help from another source or person,[2] and the video will only be accessible to authorized UvA staff.  In this way, no test taker biometric information is captured.  The video images are encrypted (no data leave the test taker's personal device that are not encrypted) and all data are stored on servers located in the EU.  After thirty days all video is automatically deleted.  Moreover, the Proctorio solution does not require that a test taker enter personally identifiable information (PII) to begin the exam; instead, a test taker simply signs into the Learning Management System (LMS) or the test administration platform. Test takers are made aware of all exam-related data that is collected before the exam begins.  In its contract with Proctorio, the UvA required the vendor to assure its compliance with the GDPR.  Finally, the University's Data Protection Officer reviewed all of the facts and provided an opinion that the solution meets the requirements of the GDPR.  

Although the UvA argued its use of video is permitted under Article 6(1)(f) ("legitimate interest"), the court decided this case based upon Article 6(1)(e) ("public interest" because UvA is a public university), holding,"It is not in dispute that the UvA is a government agency, so that, in view of the text of the GDPR, it cannot invoke the f ground of Article 6 (1) GDPR." [3]  The court also agreed with UvA that no biometric information is captured. Finally, regarding consequences to candidates who exercised the right to object to processing this way, the court did not indicate that the alternative that may involve delay was problematic.

CONCLUSION

The Amsterdam court expressly stated its determination on necessity was based on the fact that "for the time being ...exams cannot take place on campus as a result of...Covid-19" and that there is a "public interest" in allowing the use of video proctoring. Consequently, this decision does not represent a broad endorsement of remote proctoring in all circumstances. Nevertheless, the ATP expects that the ruling should help guide testing organizations on appropriate steps to gain legal as well as DPA approval of video surveillance for remote proctored testing situations under the GDPR - and potentially under privacy laws in the United States.

[1] Three additional DPAs (Spain, France, and Cyprus) have already ruled on the use of video surveillance in online higher education testing in May.  All three decisions supported the use of video to some extent, at least where the decision is based on the national government's decision covering public education.  

[2]  UvA took pains to explain the remote proctoring process in its Student Manual, which provided notice students about the video surveillance, stating that "during the exam, your webcam, microphone, web traffic, screen, mouse- and keyboard activity are continuously monitored.  Additionally, you might be asked to show your room, to check whether you have a clean desk and you are alone."  The manual went on to describe how the student's computer browser will be locked down:

  • · The plugin can ask you to close all web browser windows before starting the exam and prevent you from opening new browser windows and tabs;
  • · The plugin will detect second screens and will prevent you from taking the exam in case you have a second screen attached;
  • · Additional lock-down options which might be turned on for your exam are, amongst others, disabling clipboard functionality, disabling right-mouse clicks and disabling printing functionality.

[3] Some articles about the court decision seem to raise the possibility of a public authority performing activities that are not part of a public task on the basis of legitimate interests. The UvA's initial argument supported that approach, too, by noting that its decision to use remote proctoring was limited to exams of a certain size and that the decision to proceed was limited to the current COVID-19 circumstances and that future use would require new decision making.  While the court noted the impossibility of on-site examination and other alternatives for certain exams, including based on ability to deal with fraud/fairness, measures are needed to guarantee the quality of education and the university submitted evidence of ways that students could cheat without use of remote proctoring, this June 11 ruling does not address what outcome might occur if a private university or other non-public body relies on Article 6(1)(f).