The teacher supervises in Zoom and Teams; automated monitoring in Proctorio
Laurea’s online teaching uses the Zoom and Teams systems, which students log into with their own student credentials. During an assessed performance, the course teacher may ask the student to open their video camera or to record a requested image of the performance and thus monitor that the student is completing their studies online appropriately. Monitoring methods are used according to separate instructions and only in connection with those assessed performances where it is necessary to identify the student via a video connection. It is the student’s responsibility that nothing of a private nature is visible in the image.
Laurea has also introduced the Proctorio exam system, which monitors the student’s performance without the teacher’s presence. Automated analysis highlights potential cheating attempts and other suspicious situations based on the student’s behaviour, which the teacher reviews manually afterwards. The teacher then decides whether to take further action because of suspected cheating.
Using the systems, the student’s identity can also be confirmed by having the student, if necessary, record or show an image of their identity document before the exam begins. ID cards must not be requested to be shown in a video connection where other students are present, and the ID image must not be stored in the system unnecessarily.
Each piece of personal data is necessary
It is not possible to implement supervision of studies completed online without collecting personal data about students. The supervision of online teaching processes the following personal data about students:
- Student’s login details
- Student’s video and audio recordings
- The student’s exam or other performance
- If necessary, an image of the student’s identity document (only in separately defined one-to-one situations)
In addition, the Proctorio exam system analyses the following personal data:
- Recordings of the computer desktop of the student participating in the exam
- The student’s behaviour (for example computer usage and head movements)
- Other possible recordings of the actions of the student participating in the exam
During the planning of online exams, methods have been considered by which exams could be monitored so that interference with the student’s privacy is as small as possible and the processing of personal data is as limited as possible.
These measures are the following:
- Monitoring exams by spot-checks. However, monitoring then does not cover all students, making it unreliable. Spot checks also require considerable resources from an individual teacher if there are tens of participants or more.
- Not requiring presentation of identity documents when the teacher can identify the persons participating in the supervised performance by other means (for example based on previous performances). However, it is unlikely that the teacher knows all students, so it is not possible to completely forego identity verification by identity document.
The aim is to ensure smooth studies, equal treatment and to prevent cheating
From the students’ perspective, supervision of online teaching enables students’ studies to progress smoothly despite possible exceptional situations, equal monitoring and treatment of students completing on-campus and online studies, and minimization of suspected cheating. If a performance were not supervised, Laurea has identified a significant risk of cheating. Committing exam fraud is a serious act, which can result in failure of the course or, in particularly serious cases, suspension from Laurea for up to one year (Laurea University of Applied Sciences’ guidelines on preventing fraudulent activity and handling suspected fraud 2020). Supervision also improves students’ legal protection in suspected cheating cases, since then the parties have clear recordings of the situation.
The personal data collected in connection with supervision of online teaching are therefore used for the following purposes:
- To identify the student participating in the study performance or exam, to ensure that the student has the right to participate in the study performance or to take the exam
- To proctor the exam and prevent fraudulent activity
- To assess the student’s performances
- To promote the student’s studies by enabling teaching and exams to be provided online
- To safeguard the student’s legal protection in potential misuse suspicions
The processing of personal data is lawful
Processing of personal data always requires a legal basis in accordance with the EU’s General Data Protection Regulation. Personal data are processed on the basis of Laurea’s legitimate interest. There is a legal, important and justified reason for processing students’ personal data in online teaching, and the processing does not cause such harm to students that their rights and freedoms would override Laurea’s legitimate interest. By accepting the terms of use, students commit that their data may be monitored in online teaching.
When processing of personal data is based on legitimate interests, the data subject has the right to object to the processing at any time. When a data subject exercises their right to object (GDPR art. 21), the data subject’s personal data must generally not be processed for online teaching monitoring purposes and Laurea acknowledges that there is no overriding legitimate and justified reason in this case that would override the data subject’s interests and rights.
However, the student should note that if they want to exercise their right to object before their performance has been checked for appropriateness, the exam will remain unassessed after the exercise of the right to object. Personal data may still be processed despite the objection if it is necessary for establishing, exercising or defending a legal claim.
All personal data remain secure
Laurea processes only the data about students that are necessary for supervision. Although the monitoring is somewhat extensive, it is strictly limited. Data are retained only for a limited time as long as the data are necessary to demonstrate the appropriateness of the exam performance. The current retention period is up to 6 months from the study performance.
Monitoring data are not reused for other purposes nor combined with other data collected about students in other contexts. Personal data are also not disclosed to parties outside Laurea, and the systems used in online teaching do not have direct access on their servers to students’ personal data stored encrypted.
Risks related to online teaching have been assessed and risk-based control measures have been defined as additional safeguards for data protection and to reduce the potential negative effects of processing. Measures include, for example, reviewing contracts of processors of personal data, user guidance and communication, and prevention of automated decision-making. All systems used at Laurea must comply with Finnish law and European data protection legislation. Personnel are committed to following Laurea University of Applied Sciences’ information security and data protection guidelines in all activities related to online teaching.
Laurea ensures that the processing of students’ personal data is always appropriate and planned, and does not lead to disproportionate outcomes for students. Personal data processing in online teaching is transparent to students, and comprehensive notices and instructions have been prepared for students on how different platforms are used and what kind of personal data processing is involved. The data controller’s documentation and demonstration obligation’s balancing test of the legitimate interest for monitoring online teaching is available from Laurea’s data protection officer.
The process concerning possible suspicions of cheating has taken into account students’ legal protection and appeal options (see Laurea’s degree regulations section 22). In addition, the data subject is always offered the opportunity to use their rights under the Data Protection Regulation.