Personal data processing in remote teaching and examination
Both real-time monitoring (streaming) and recording of images and sound constitute personal data processing according to the General Data Protection Regulation (GDPR). Both of these methods comprise a serious breach of privacy as the monitoring is of a student in a vulnerable situation and generally occurs in the home, which is a private space. Recording is to be considered a more significant breach and the recording of a student generally also constitutes a public document that is to be disclosed upon request by a member of the public. Therefore, it is of particular importance that the University uses these kind of tools with respect for the individual and in a transparent way.
It should also be noted that the University cannot rely on consent in situations linked to the teaching and examination of a student.
This document contains more detailed and complete recommendations based on the information directed at teaching staff published on the Staff Pages on 27 March 2020 (click here).
The processing of students’ personal data in digital tools is permitted when it is necessary in order to conduct teaching or examination. A decision on whether the processing of personal data is necessary is to be taken in each individual case. In doing so, the Vice-Chancellor’s decision to permit changes to approved course and programme syllabi regarding the spring semester 2020 concerning the forms of assessment of student performance and digital teaching should be taken into consideration.
When assessing whether personal data processing is necessary, consideration should be given to whether the forms of examination can be adapted to the changed conditions.
Example: Can an invigilated on-campus exam be changed into a take-home exam?
For personal data processing in the form of real-time monitoring or recording to be considered necessary it is also a requirement for it to actually be an effective tool to achieve the purpose of the processing.
Example: If real-time monitoring is not assessed to reduce the risk of cheating to any great extent, the tool is not to be used for this purpose.
The assessment is to take place based on the following starting points:
- If necessary, the University may livestream students and teaching staff in connection with teaching if the purpose is to conduct teaching.
- If necessary, the University may record teaching where students may appear if the recording constitutes a part of the learning material.
- If necessary to ensure fair examination, the University may livestream an examination or compulsory component.
- If necessary to ensure fair examination, the University may record the examination or compulsory component if the purpose is for the recording to constitute the basis for the examination.
- The data protection officer considers it to be difficult to justify the recording of examinations or compulsory components in other cases.
It is important to remember that a document is public if it is stored by the University and considered to have been received or produced here. As students submit documents to teaching staff for assessment, these are generally considered to have been "received by the public authority or is in the hands of competent official”. The same applies to lectures or examinations that are recorded. These recordings are then also, as a general rule, considered to be documents that have been received or produced in accordance with the Public Access to Information and Secrecy Act and are therefore considered to be a public document that can be requested.
As a general rule, the same approach applies to the use of personal data processing in remote teaching as it does in ordinary teaching. The personal data processing is to be a requirement to conduct teaching or constitute material for the teaching itself.
Processing of personal data of teaching staff
The processing of personal data of employees in connection with remote teaching takes place on the legal basis of an agreement, as this is part of the employee’s duties in accordance with their employment agreement. This applies to both livestreamed and recorded teaching.
For students who wish to record a teaching session, the Rules on sound recording, photographing and filming in teaching situations apply, which can be found on the Staff Pages (click here to access these).
In these cases, the member of teaching staff is to ensure that other participating students can ask questions and interact with the teaching in such a way that their personal data is not processed by the student making the recording, for example, by ensuring that there is an option to ask questions anonymously. If this is not possible, the recording is not to be authorised by the member of teaching staff.
Processing of personal data of students
The University’s processing of personal data of students during teaching is on the legal basis of public interest together with the Swedish Higher Education Act’s requirements that universities are to carry out teaching. The processing is permitted if the purpose of the processing is teaching (regardless of whether the processing takes places via livestreaming or recording) and the processing constitutes a requirement for the teaching to be carried out.
To livestream a lecture or other teaching session for those who otherwise would have participated on campus is permitted. Likewise, the personal data processing that takes place via student participation with sound and image in such livestreamed teaching sessions, is permitted. This takes place on the legal basis of public interest together with the Higher Education Act’s requirement for universities to carry out teaching.
Always consider which of the functions for webcams, sound and chat need to be activated for students during the teaching session. It may often be justified to use one or several of the functions but do not do this as a matter of routine, make it a conscious choice. Provide information about the students’ (potential) option to turn off functions.
If there is a teaching session in which recording usually takes place even in ordinary circumstances as part of the teaching, it may also be carried out remotely. It may be that the recording comprises material for the student’s own reflection and for discussion with other students and members of teaching staff. The content of the recording therefore constitutes a part of the learning material. Something you should keep in mind in these cases is to encourage students prior to the recording to ensure, as far as possible, that they are in a neutral environment in their home to minimise the breach of privacy.
Recordings from teaching sessions may be deleted two years after the completion of the course component. For questions about storage and deletion, please contact the Records Management and Archives Office.
It is important to inform the students when personal data processing takes place through the digital connection as well as to provide information if anything is being saved. It is also appropriate to provide students with the opportunity to ask questions outside the lecture (it becomes particularly important for questions to be asked outside the lecture if it is to be recorded).
There is a checklist (A) on the Staff Pages of the information that is to be provided (click here on this link to access the checklist).
Sensitive personal data or confidential information is not to be shared or included.
As a general rule, the same approach applies to the use of personal data processing in remote examinations as it does to ordinary examination. Recording is permitted if the purpose of the recording is for it to constitute material for examination or documentation of compulsory components. If the students ordinarily identify themselves at on-campus exams and are monitored by invigilators, this may also take place online.
When students complete examinations, the University processes the students’ personal data on the legal basis of public interest, in which the examination itself is considered to be an exercise of public authority.
The data protection officer considers that the University is able to process the students’ personal data when it is required that they identify themselves by presenting an ID. However, the identification requirement does not apply if it is a form of examination that does not ordinarily require the presentation of an ID (e.g. a take-home exam). If identification at a digital examination is to take place through the presentation of an ID, the risks include the personal identity number being seen by other examination participants. The presentation of an ID must therefore take place in such a way that other participants do not have the possibility of seeing the personal identity number or other unique data. If identification can take place with the help of, for example, photo lists this alternative should be used.
It must be emphasised that identification through technical tools that enable face recognition are not to be used. Such processing comprises processing of sensitive personal data that requires specific legal justification, which the data protection officer does not consider to be available.
Livestreaming of examinations and compulsory components
To identify and monitor students via webcam can, in certain cases, be permissible if necessary; however, it should not take place if it concerns a form of examination that does not ordinarily require the presentation of an ID (e.g. a take-home exam). Decisions on this should be taken prior to each examination and the reasons for the decision should be documented.
In connection with forms of digital examination, there may be a need to both identify students as well as monitor students during the ongoing exam. It is important to inform the students that personal data processing is taking place through the digital connection as well as to inform them that nothing is being saved.
There is a checklist (A) on the Staff Pages of which information is to be provided (click here on this link to access the checklist).
Real-time monitoring of an examination can be organised in ways corresponding to on-campus exams without a recording of students taking place. This involves a member of teaching staff or other person carrying out real-time monitoring of the students’ exam writing via the digital connection. The number of people monitoring the examination may need to be adapted to the particular situation. The University is considered to have legal basis for this type of monitoring in the Higher Education Act and the General Data Protection Regulation with reference to public interest.
Recording of examinations and compulsory components
The recording of students in their home environment is to be considered a serious breach of personal privacy and significant requirements should be met for this to be justified. Decisions on this should be taken prior to each examination and the reasons for the decision are to be documented.
Oral examinations and compulsory components entails that they require assessment of an individual’s performance. This may require them to be documented appropriately. If a recording takes place in these cases to obtain necessary documentation of the material prior to the examination or assessment of the compulsory component, the recording is permitted. It may also be that the recording constitutes material for the student’s own reflection or for discussion, which is also permitted.
In the corresponding case, the recording of students in oral examinations or in other remote compulsory components is permitted. In these cases, prior to the recording, students should be encouraged, as far as possible, to sit in a neutral environment in their home to minimise the breach of privacy.
The data protection officer considers it to be difficult to justify the recording of examinations or compulsory components in other cases, for example for the purpose to use as evidence in a disciplinary matter.
Recordings of examinations may be deleted two years after the examination. For questions about storage and deletion, please contact the Records Management and Archives Office.