Due to the coronavirus outbreak, my university has tentatively canceled all live forms of live education, including exams. Instead, they have decided to hold exams through an online proctoring software (third-party), which requires access to the computer webcam, microphone, screen, and browsing history to work. This is the first time the university is doing an examination in this manner, and there are no official guidelines for how these exams are to be conducted. I am concerned about my data privacy in the context of these exams, and am wondering what my rights are and how I can exercise them. Specifically, I am wondering whether I can refuse the collection of my personal data through the online proctoring software, and whether the university may reprimand me for doing so. If both are the case, how can I truly say that I 'consent' to data collection and processing when I am coerced, so to speak, by the threat of failing my courses if I do not use this novel software?
-
There's a great answer already that explains what data processors are allowed to do under the GDPR. The practical answer to your question depends on exactly what your university is proposing to do and whether it is 'legitimate' under the GDPR. Usually, software vendors like this publish a privacy policy – what does that say?– sjyMar 15, 2020 at 7:07
1 Answer
How can I truly say that I 'consent' to data collection and processing when I am coerced, so to speak, by the threat of failing my courses if I do not use this novel software?
There is no need for you to "consent".
Consent is just one of the reasons that allows a data processor to collect your data. There are other reasons that allows the data processor to capture your data.
In this case, it seems of application the "legitimate interest clause", as it is in your university's legitimate interest to capture your activity in order to evaluate you.
Of course, that covers only the data collected that is relevant to that interest. They will certainly capture your identity and your answers, they may log your sessions and may try to gather some data to detect if you are somehow cheating, but they would not be allowed to check which are your favorite pornhub videos because that is not relevant for the university's legitimate interest.
Art. 6 of the GDPR states:
Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
This page also provides some in-depth analysis
