Frequently asked questions

Online proctoring is a form of location-independent digital assessment that involves online invigilation using special software. Online proctoring software promises to allow students to sit their exams anywhere (for example at home) in fraud-resistant conditions and/or with invigilation against fraud. Monitoring software, video images and student screen share feeds should prevent students from engaging in fraud.

There are 4 forms:

• The use of live conferencing tools: with this option, lecturers themselves use regular conferencing software and they take a closer look at the students during the exam. The lecturer can see the students with the webcam and ask them to show identification during the exam. However, the lecturer cannot see the students' screens.
• Live proctoring: the oldest form whereby an invigilator monitors a group of students in real time using webcams. The greatest advantage of this is that the proctor (invigilator) can intervene directly.
• Recorded proctoring: a proctor watches a recording, which is often accelerated – in some cases only random selections are checked. The institution decides whether the proctor reviews everything or random selections.
• Automated proctoring: the software registers and highlights doubtful moments for the proctor to review and assess.

Education institutions find that proctoring is sometimes the only way to prevent fraud in exams, are required by law to prevent fraud during exams, and must be able to guarantee the value of a qualification. As a result, education institutions say that it is sometimes necessary to implement online invigilation. This mainly involves situations where students are unable to take their exam in an exam hall. Exams for elite athletes who are taking part in a tournament are one such example, while exams during the coronavirus crisis, which cannot always be taken in an exam hall, are another. In such cases, education institutions first have to look for alternative solutions. Sometimes they do not think these are possible and they implement online proctoring.

There are different forms of online proctoring, but they all generally have the following procedure in common.

• You log in to take an online exam.
• The technical operation of the system is tested.
• The system checks that you are the person sitting at your laptop and not someone else.
• You will also be asked to show your desk or room.  This will show that you only have the permitted tools nearby.
• The exam starts.
• During the exam, you are monitored to ensure that you do not open any unauthorised tabs in your browser to look up information about the exam's content.
• Your camera and microphone are used to make a recording of you taking the exam. This ensures that you do not communicate with others, walk away or look away noticeably.
• An invigilator checks whether there are any actual indications of fraud by watching live or by checking the recordings.
• The examiner will ultimately decide whether any fraud has taken place.
• The recordings are deleted once the exam score has been finalised.

There are 3 forms:

• An invigilator watches live online. In that case, the invigilator can check for fraud during the exam.
• Video recordings are made. The invigilator checks the video recordings at the end of the exam.
• Video recordings are made. The examiner indicates in advance what is considered as suspicious behaviour (an audible second voice in the room, for example). The system detects any ‘suspicious behaviour’ on this basis. The examiner checks these signs and determines whether any fraud has been committed.

It is therefore never the software that determines whether fraud has been committed; there is always a human assessment.

As far as we know, all education institutions using online proctoring offer the option to test how online proctoring works in advance. Your own education institution will inform you how this can be done.

During online exams, education institutions offer support in solving technical system problems, for example by providing a phone number or chat support. Institutions cannot solve individual technical problems, such as a disrupted internet connection. The institution determines what the consequences are. You can object to this. This is comparable to issues during "paper" exams (such as a power failure or late arrival due to extreme train delays).

The invigilators have all received the same instructions from the institution about what constitutes inadmissible behaviour. The invigilator (proctor) assesses whether there is any inadmissible behaviour and what behaviour is admissible. However, try to prevent a housemate from entering the room unexpectedly. You can do so by letting everyone in the house know when you are taking an online exam, for example.

There are a number of reasons:

• In normal situations, the use of online proctoring is often an option that is chosen by students. For example, students may be spending time abroad or may be unable to go to the exam hall for other reasons. Students no longer have this option due to the coronavirus crisis. It is no longer possible to take an exam on site during such a crisis. Exam alternatives, such as an open book exam, an oral exam or an essay, are not always possible. Postponing exams may also cause delays in the students' programme. In such cases, institutions sometimes opt for mandatory online proctoring.
• Video recordings are made of the student in their personal environment. Students consider this a breach of their privacy.
• Students do not always know what data is being recorded and what happens to that data.

Online proctoring collects data about you. Which data is collected exactly depends on the online proctoring tool and the choices your education institution makes in its use of the online proctoring software. The education institution is obliged to inform you which personal data it processes during online proctoring and for which specific purpose it will use this data. The following personal data may be collected from you (please note that this list of examples is not exhaustive and may therefore differ from one tool to another):

• Name
• Email address
• Photo of your student card
• A photo taken of you using your webcam
• Video and audio recordings of you as a student and of the environment during the exam
• Screen activities during the exam
• Key strokes and mouse clicks during the exam
• The laptop or computer's IP address on the network to which the laptop or computer is connected
• The web pages you visit while taking your exam
• The answers you give to the exam questions
• The software applications you are running (also in the background)

Data is collected to determine whether the right student is taking the exam and whether the student is committing fraud during the exam, for example by using crib sheets, by having someone whisper the answers, or by looking up information online when this is not permitted.

This depends on the situation. If assessments and exams use online proctoring, this involves the collection and processing of students' personal data. The privacy law / General Data Protection Regulation (GDPR) imposes conditions in that respect. The processing of your personal data is only permitted in accordance with a basis that is stated in the law. If there is no legal basis, the use of such data is not permitted, no matter how convenient, useful, effective or desirable the tool's use may be for the education institution.

The purpose of online proctoring is to monitor students with regard to the lawful completion of assessments and exams. Normally, education institutions request permission to process data in the context of online proctoring. Consent is 1 of the 6 lawful bases mentioned in the GDPR. The consent basis is particularly suitable for small groups and specific, exceptional situations. Examples are elite athletes participating in a high-altitude training camp, international work experience and students who indicate that they prefer to sit their exams at home, because they find a busy exam hall or long travel times difficult.

During the coronavirus crisis, consent is usually not a realistic option, as the exam halls are not available and are therefore not an alternative. This would mean that the consent is no longer voluntary, as no other option is available. During the coronavirus crisis, 'performing a task of public interest’ and ‘of legitimate interest’ therefore seem to be the most obvious bases.

A more privacy-friendly alternative may be possible again after the crisis. In that case, the basis for online proctoring that applied during the crisis will immediately expire. This makes the question 'Is it OK?’ very complex and highly dependent on the situation.

The GDPR mentions 6 principles and always has to apply (at least) 1 of the 6. The relevant principles for online proctoring are:

Consent

Normally, education institutions request permission to process data in the context of online proctoring. The consent basis is particularly suitable for small groups and specific, exceptional situations. Examples are elite athletes participating in a high-altitude training camp, international work experience and students who indicate that they prefer to sit their exams at home, because they find a busy exam hall or long travel times difficult.

However, permission must be given freely. This means that refusal must not have any negative consequences, such as a delay in the study programme. During the coronavirus crisis, consent therefore does not tend to be a realistic basis.

Public service

Another basis institutions can call on is public service. It can be said that an education institution's organisation of assessments and exams is a public service. Under the law on higher education, your institution is obliged to organise an assessment or exam for each unit of study.[1] The institution is responsible for the practical organisation of exams[2]. The institution will determine the exact details of how the exams are organised.

Legitimate interest

Under the law on higher education, your education institution is free to organise the practicalities of the exams. In this context, the education institution must always strike a balance between the interests of the institution and the impact on students' privacy. Your education institution must document this consideration. The institution must therefore support the choice of online proctoring when organising assessments and exams, and the interests of the institutions must outweigh the privacy interests of the students. Your privacy as a student should therefore not be disproportionately compromised.

The coronavirus crisis strongly affects whether or not there is a legitimate interest, whether or not online proctoring is proportionate and whether or not the intended objective of assessing students can be achieved in a less drastic manner. If it is not possible for your education institution to organise exams at a physical location and no alternative or equivalent test option is available, there may be a legitimate interest. If it becomes possible again to organise all exams in an exam hall on a large scale, there is probably no longer a legitimate interest.

[1] Article 7.3 Law on higher education and scientific research

[2] Article 7.10 Law on higher education and scientific research

This is a difficult question, because the answer depends on the situation and the chosen basis. Your education institution should explore several examination options to ensure that the option that infringes your privacy the least is selected. Your education institution will therefore first check whether an alternative examination option is possible. The use of online proctoring is only permitted if a more privacy-friendly alternative is not possible. If the education institution ultimately decides to implement online proctoring, it will examine how it can reduce or eliminate any risks of breaching your privacy rights.

During online proctoring, your education institution may only request and use students' personal data that is necessary to organise the exam and to check that no fraud is being committed. The rule is that only data that is strictly necessary to achieve the purpose may be collected. This is also known as ‘data minimisation’. The education institution must not keep this data any longer than is necessary to establish whether or not the exam has been carried out correctly. Your education institution must determine the data retention period itself, must instruct the supplier of the online proctoring software in that regard and must inform you as well.

If any irregularities are detected during the exam, it is permitted to keep the data for as long as your education institution needs it to provide evidence in any objections or complaints procedures.

Nothing else. Your education institution is only permitted to use your personal data to check for fraud in order to guarantee the value of the qualification. This data must subsequently not be processed further for other purposes that do not correspond with the purposes for which the data was collected. This means that your institution must not subsequently use the recordings of your exam in other areas, such as tutoring or learning analytics.

Your education institution must agree with the supplier of the online proctoring software how your personal data in the online proctoring system is used and protected. These arrangements are documented in a processor agreement. The education institution remains responsible for the processing of its students' personal data at all times.

For example, the processor agreement prohibits the supplier from using the personal data for its own purposes, and guarantees that your personal data will be treated confidentially and that the data will be destroyed or returned to the education institution once the retention period has expired.

If the software supplier is located in a country outside the European Economic Area (EEA) (where the GDPR does not apply) and stores your data there, your education institution is obliged to make additional arrangements. These additional arrangements ensure that your data is used with the same or similar guarantees as if the data were processed within the EEA. If your data is stored outside the EEA, your education institution always has to inform you of this in its privacy statement.

The education institution has to inform you of the use of the online proctoring software in clear and understandable language. This information can be found in the privacy statement published on the education institution's website or on a separate page about online proctoring, for example. In any case, the education institution must inform you of the purpose, the legal basis, the personal data collected, the retention periods and the way in which you can exercise your privacy rights.

Yes, you can. The institution will investigate any objection you may have. If in your specific situation your interest outweighs that of the institution, the education institution will have to stop processing the data. The institution may also have a compelling reason that outweighs your interests, even though you have an understandable objection. Please note that this does not relate to objections to the use of online proctoring software in general, but to objections to the use of proctoring in your specific situation.

You have the right to access the personal data that your education institution is processing. This includes video and sound recordings recorded by the online proctoring software. You can submit a request for access to your education institution. The contact details and information on your education institution's data access process can be found in the privacy statement on the website.

If you notice that your details are incorrect or incomplete, you can have them corrected. Your education institution will have to take all reasonable steps to ensure that incorrect personal data is corrected. Please note that this concerns factual inaccuracies. For example, you cannot use the right to rectification to correct a disappointing score.

If (after an access request) you find out that some of your data is incorrect, no longer relevant or no longer necessary for the purpose for which it was collected, you can submit a request to have it deleted. For personal data used and analysed to enable online proctoring, this specifically means that your data must be deleted once the exam has been assessed and an objection or appeal is no longer possible.

When online proctoring is used, some private information will always be revealed. The software or the invigilator will take a look at your private environment. This cannot be prevented. However, you can make sure that this is kept to a minimum (by sitting in an area where there are no personal items, for example). If this is not possible, make sure that you tidy the area you are sitting in as much as possible in advance and that no personal items are visible.  

The education institution must secure your data. The GDPR mentions encryption as one of the possible measures to secure your data. Encryption means that your data is converted from a readable format into an encoded format to prevent access by unauthorised people. Encryption can be applied in several ways. The data traffic between you and the proctoring server may be encrypted, or the data stored by the proctoring supplier may be encrypted. In any case, it is always important to choose a secure method for sending the decryption key between the education institution and the software supplier, and to keep this key up to date to ensure sufficient protection for as long as the collaboration lasts.

Your education institution is responsible for the lawful and careful processing of your personal data. The education institution will provide instructions (set out in the processor agreement) and will inspect the software supplier (in a privacy impact assessment or audit, for example) in order to guarantee the protection of your data.

However, under GDPR legislation, the supplier itself must also take measures to protect personal data against loss, theft or unauthorised access. The supplier of the online proctoring software must itself also meet the requirements of the law. Each supplier will take a different set of measures.

If your education institution uses online proctoring, it is likely that it offers a specific FAQ section on its website. This will give you more information on online proctoring and how it will be applied to your study programme. See your education institution's website for more information.

If you have any questions or concerns regarding online proctoring after reading this information and the information on your education institution's website, you can always contact the exam board or the Data Protection Officer at your education institution.

Each education institution employs a Data Protection Officer. This internal regulator ensures that the education institution applies the laws protecting individuals' personal data. The Data Protection Officer's contact details can always be found in the education institution's privacy statement. The Data Protection Officer's contact details are often also mentioned on the website of your university (of applied sciences).

In June 2020, the UvA student council (the Central Student Council (CSR), the student council of the Faculty of Economics and Business Administration (FEB) and an individual UvA student) demanded in an injunction that the university stop using online proctoring. An injunction is a quick and swift procedure before the court that allows parties to present an urgent issue and obtain a complete ruling from the court. This option was chosen here, as the exams to be organised with online proctoring were going to happen soon. There is a disadvantage to an injunction procedure, however: in principle, the ruling is a provisional decision. After this decision, either party can still start normal (main) court proceedings. Such (main) proceedings take longer, but also offer an opportunity to deal with the dispute in more detail.

The students stated that UvA's use of online proctoring did not observe the codetermination rules and the university needed permission from the Central Student Council/Faculty Student Council in order to use online proctoring. The students also stated that students' privacy was being compromised, which meant that UvA was in breach of the GDPR. The students supported this by arguing that under the privacy law the university did not have a basis for the use of online proctoring and as a public body it could not invoke a legitimate interest (one of the privacy law bases required to process personal data).

The students also stated that the university did not meet the requirement for purpose limitation; UvA's online proctoring uses room scans, eye tracking, sound recordings and data analysis. According to the students, the use of online proctoring would allow the university to process more data than is necessary for the purpose of combating fraud.

Students therefore demanded that the court

1) prohibited the use of online proctoring at UvA for as long as the representative body had not given its consent, and

2) prohibited the university from using the personal data obtained through online proctoring.

The court ruled that the use of online proctoring as applied by UvA in this specific case is permitted. In the various sections of the students' complaint, the court ruled that UvA did not have to request the consent of the representative body to use online proctoring and that there was no question of any unlawful breach of privacy. UvA has a public duty to provide education, exams and qualifications. This basis gives the university the authority to process the necessary personal data in order to perform this duty. The court was also of the opinion that because of the COVID-19 crisis, it must be possible to take certain exams online and that any fraud in that regard must be countered. Finally, the court ruled that UvA must not use the legitimate interest as a basis for online proctoring, as UvA is a public organisation.

This injunction judgment by the court has (provisionally) established that an education institution can regard the coronavirus outbreak, during which exams cannot be organised in an exam hall at the education institution, as a legal basis for the use of online proctoring. 

This ruling is not a carte blanche for online proctoring, but it does mean that an education institution can choose to use online proctoring as part of its public duty to provide education and organise exams without fraud. If your education institution is unable to organise exams in a physical location and there is no alternative (such as open book exams), the education institution may therefore have a legal basis. During these coronavirus times, education institutions therefore have greater freedom in this regard than before or after this period.

The judgment by the court was given in an injunction. The advantage of an injunction procedure is a quick ruling, but this ruling is generally preliminary. Both parties can still initiate main court proceedings. In main proceedings, the court will take far more time to assess the requirements, and will also offer the opportunity to consider the dispute in more detail. The court of the main proceedings may therefore give a different ruling. At present, it is not clear whether any of the parties will initiate main proceedings.