Examination tests and distance learning courses, online Faq of the Privacy Guarantor

Can public and private universities and training institutions conduct examinations and courses at a distance? Are systems for monitoring participants' behaviour allowed? Can images of students and workers following training activities be collected? These and other questions are answered by the FAQs published by the Privacy Guarantor.

The aim is to clarify how supervision systems can be used for the regularity of examination papers and distance courses. The FAQs point out that although universities and training organisations are entitled to process the data of participants in examinations and courses that take place at a distance, this must be done within the limits of the sector's regulatory framework and exclusively for the purposes of the regularity of the test and course attendance by using, for example, videoconferencing services or platforms that do not allow the collection of irrelevant data such as the geographical location or biometric data of candidates.

In the case of the use of supervision systems (so-called proctoring), it is up to the proprietor, i.e. universities and training organisations, to adopt measures to ensure their compliance with privacy regulations, even if the systems and services are marketed by third parties. Depending on the number of participants or those enrolled in the examination session, type of course or test, the proprietor may assess the need to make an audio-video recording of the examination (including by filming the person's face without extracting biometric data), identifying an appropriate retention period for the recordings. On the other hand, systems involving automated processing of personal data to analyse and predict, also by means of algorithms, the behaviour of the participants, such as, for example, body movements, frequency of mouse clicks, operations performed on the keyboard, attempts to access other applications, Internet activities, in order to elaborate risk indexes or warning signals relating to possible fraudulent behaviour, are not allowed.
The FAQs can be consulted on the website of the Privacy Guarantor www.gpdp.it