Personal data processing in digital teaching and examination
Personal data processing in digital teaching and examination due to the Covid-19 pandemic
In light of the switch to digital teaching and examination due to the current situation with the spread of Covid-19, the data processing officer issues the following recommendations with regard to the processing of personal data. The initial shorter discussion is followed further down on the page by a more complete guidance regarding the processing of personal data in digital teaching and examination.
Guidance regarding the processing of personal data in digital teaching and examination
Both live streaming and recording of students constitute personal data processing pursuant to the GDPR. Live streaming and recording for invigilation purposes constitute a serious infringement of privacy. This is due to the issue being invigilation of a student in a vulnerable situation, usually in the student’s home, which is a private sphere. Recording may be considered a more serious infringement than live monitoring. As a rule, a recording of a student is also an official document which can be disclosed on request from a member of the public. It is therefore particularly important that the University conducts teaching and examination using digital tools with transparency and respect for the privacy of the individual student.
It must also be noted that the University cannot rely on consent in situations relating to teaching and examination of students.
Live streaming refers to sound or moving images transmitted in real time but not recorded or stored.
Recording refers to filming, in which sound and moving images are stored.
The processing of students’ personal data in digital tools is permitted when it is necessary in order to conduct teaching or examination. A decision on whether the processing of personal data is necessary is to be taken in each individual case. In doing so, the vice-chancellor’s current decision on permitted changes to approved course and programme syllabi concerning the forms of assessment of student performance and digital teaching should be taken into consideration.
See the current university-wide decisions regarding covid-19, which you will reach by clicking on this link. (opens in the same window).
The assessment of the need for personal data processing is to take account of whether or not the forms of examination can be adapted to the changed circumstances. For example, can an invigilated written exam be transformed into a take-home exam?
For personal data processing in the form of live streaming or recording for invigilation purposes to be considered necessary, it must actually be an efficient tool for achieving the intended goal. For example, if live streaming for the purposes of invigilation is not deemed to reduce the risk of cheating to any significant extent, digital tools are not to be used for this purpose.
The assessment is to take account of the following factors:
- If necessary, the University may livestream students and teaching staff in connection with teaching if the purpose is to conduct teaching.
- If necessary, the University may record teaching where students may appear if the recording constitutes a part of the learning material.
- If necessary to ensure fair examination, the University may livestream an examination or compulsory component.
- If necessary to ensure fair examination, the University may record the examination or compulsory component if the purpose is for the recording to constitute the basis for the examination.
- The data protection officer considers it to be difficult to justify the recording of examinations or compulsory components in other cases, e.g. for the purposes of invigilation.
It is important to remember that, as a rule, a recording is an official document.
Read more about this under “A recording is an official document” on the page Digital examination, which you will reach by clicking on this link. (opens in the same window).
Lund University has an external Data Protection Officer; Secure State Cyber AB.
The contact person at Secure State Cyber AB is Per Bergstrand and you will reach the contact person via the email address:
dataskyddsombud [at] lu [dot] se