Educational centers that decide to do online exams face a challenge: without being able to monitor students in person, how do you ensure that they do not copy? A Valencian university found the solution with a sophisticated video surveillance and facial recognition system. Well, the joke has paid off.
Resolution. In the summer of last year, the Spanish Data Protection Agency (AEPD) filed a complaint against the International University of Valencia or VIU for the use of facial recognition and recording to carry out online exams. As reported in À Punt, the resolution has already arrived and the VIU is going to have to pay 650,000 euros
The system. In the VIU evaluation regulations, it is detailed that a “facial recognition technology system” will be used in online tests. This system consists of the use of two cameras (which the student must provide), one to monitor the student and another for the environment, ensuring that there are no other people in the same room. The software is constantly capturing and analyzing images in real time to verify the student’s identity through AI. At the same time, the program is responsible for controlling the screen and even the devices connected to the computer with which the test is carried out.
Two fines. The 650,000 euros are actually the sum of two fines. The first, of 300,000 euros, is for having failed to comply with article 9 of the RGPD, which prohibits the processing of biometric data with few exceptions. The second, which amounts to 350,000 euros, is due to a breach of article 5.1c of the GDPR, which states that personal data must be “adequate, relevant and limited to what is necessary.” The AEPD considers the use of facial recognition for this purpose to be disproportionate.
Consent discarded. One of the exceptions to article 9 of the GDPR and which the VIU tried to rely on is that “the interested party gave explicit consent.” It is true that the students had agreed to use this control system, the problem is that they were not given any alternative: either they accepted, or they did not take the exam. The AEPD does not “consider the mandatory acceptance of general conditions upon registration to be valid consent”, which is why it rules it out in its resolution.
The VIU also tried to take refuge in the “essential public interest”, another of the exceptions of article 9, but the AEPD has rejected it because there is no specific law for the processing of biometric data in the educational context. The university invoked the university law that says that universities must verify that students have acquired a series of knowledge, but the AEPD has also rejected it as insufficient. Wow, we have to pay.
It’s not just the VIU. There are other universities such as the European University, Isabel I, La Rioja or Burgos that also use similar systems that combine cameras and facial recognition. During the pandemic there was no choice but to opt for online training and this prompted the appearance of video surveillance systems in exams, which raised the eyebrows of the AEPD, which in 2021 already warned that biometrics could not be used to monitor exams. This resolution is the first that imposes a large fine, so it is assumed that universities will make changes if they do not want to go to the cashier’s office.
Open door. The AEPD does not close the door to the use of biometrics as fraud prevention in the educational field, including AI systems. However, it points out that according to the European Union AI Regulation, biometric data is considered high risk, which does not prohibit its use, but does not give express permission to use it in this context.
In WorldOfSoftware | I’ll take the exam online for €20: the new student situation is an open bar for cheating
Images | VIU, Pexels
