Monitor and fail

2. The case of the Universidad San Marcos

In August 2020, Universidad Nacional Mayor de San Marcos (UNMSM), the biggest public university in Peru, announced that its annual admission test would be held online.11. Karina Garay, “San Marcos Anuncia Examen Virtual De Admisión Para El 2 y 3 De Octubre”. Agencia Peruana de Noticias Andina, August 28, 2020, accessed December 9, 2021, https://andina.pe/agencia/noticia-san-marcos-anuncia-examen-virtual-admision-para-2-y-3-octubre-811627.aspx. After months of uncertainty due to the measures adopted to restrain the spread of Covid-19, the news came as a relief to many applicants, but it also brought a new set of concerns with it.

In its announcement, Universidad San Marcos also indicated that it had established a few measures to avoid any dishonest conduct that could occur in a test held online, but it did not go into detail on the matter. However, a week later, the head of the UNMSM Central Admissions Office provided more details in an interview:

Now that we have decided that the admissions test will be held online, a series of questions arise, mostly regarding the possibility of some students cheating on the test by using the computer to look for answers on web pages, having someone help them answer the questions or getting someone else to take the test in the applicant’s place. (…) An app that uses artificial intelligence will be used to identify whether the applicant in front of the computer on the day of the test is the same individual who completed the biometric registration. (…) This security application will record images once a minute and detect if someone is opening a web page other than that of the test. Furthermore, it will detect if the computer is connected to a peripheral device, such as a screen, a HDMI cable or remote software. The system can also register if someone takes a screenshot of the test or makes changes to a Windows window.22. “San Marcos: cómo evitarán plagios y suplantaciones en examen virtual de admisión”. Agencia Peruana de Noticias Andina, September 1, 2020, accessed December 9, 2021, https://andina.pe/agencia/noticia-san-marcos-como-evitaran-plagios-y-suplantaciones-examen-virtual-admision-811770.aspx.

Many applicants to the admissions test were initially sceptical and later stated their opposition to this new method for several reasons: some were related to the context of the pandemic, but others referred to structural deficiencies such as the digital divide and the fear generated by the use of previously unknown technologies which had become crucial for holding the test. In the months that followed, these people became organized and coordinated their resistance efforts to try to stop the online test.

However, UNMSM did not give in to the pressure and on the dates scheduled in October, it proceeded with the online test. Participation was low: only 8,000 out of an initial total of over 15,000 people took the exam. As many of its detractors expected, several incidents were reported during the test. For instance, there were complaints that many students were allowed to take the test without leaving their camera on even though this was a mandatory requirement. There were also reports that both questions and answers from the test were shared on social media. Even more astonishing were the complaints stating that the test had been broadcasted live on the Twitch streaming platform.33. L. Ancajima, “Examen Virtual De La UNMSM: Denuncian Plagio, Transmisiones En Vivo y Más Durante Su Desarrollo”. RPP, October 4, 2020, accessed December 9, 2021, https://rpp.pe/tecnologia/redes-sociales/examen-virtual-de-la-unmsm-denuncian-plagio-transmisiones-en-vivo-y-mas-durante-su-desarrollo-noticia-1296176.

In spite of these complaints, which led entities such as the Congress of the Republic44. “Congreso cita a rector de San Marcos por incidentes en el examen de admisión virtual”, Diario El Peruano, October 3, 2020, accessed December 9, 2021, https://elperuano.pe/noticia/104779-congreso-cita-a-rector-de-san-marcos-por-incidentes-en-el-examen-de-admision-virtual., the Superintendencia Nacional de Educación Universitaria (SUNEDU)55. “Sunedu sobre examen virtual de San Marcos: Existen suficientes indicios para iniciar una indagación”, Diario El Comercio, October 3, 2020, accessed December 9, 2021, https://elcomercio.pe/lima/sucesos/sunedu-sobre-examen-virtual-de-san-marcos-existen-suficientes-indicios-para-iniciar-una-indagacion-unmsm-nndc-noticia/. and even the Autoridad de Protección de Datos Personales (APDP) to make statements,66. “La Autoridad Nacional de Protección de Datos Personales realiza acciones de fiscalización para verificar el adecuado tratamiento de los datos personales en el examen de admisión online realizado por la Universidad Nacional Mayor de San Marcos”, Press release, October 5, 2020, accessed December 9, 2021, https://www.redipd.org/es/noticias/la-autoridad-nacional-de-proteccion-de-datos-personales-realiza-acciones-de-fiscalizacion. UNMSM ignored them and a few days later, it published the results of the admission test. In the following weeks, interest in the case dwindled and, with the exception of the APDP which initiated an administrative investigation, the other entities did not take any action.

During the aforementioned events, the press never disclosed which “technologies using artificial intelligence” to detect plagiarism and impersonations announced by the UNMSM authorities were, in fact, used. However, in an investigation that we conducted in early 2021, we found that the technology that the university used was called SMOWL, a software programme created and distributed by Smowltech, a Spanish company that specializes in providing remote supervision services for online tests, also known as eProctoring.77. SMOWL, home page, 2021, accessed October 15, 2021, https://smowl.net/es.

3. eProctoring in Latin America and personal data protection

As we mentioned earlier, the case of the Universidad San Marcos led us to launch an investigation into the implications of the use of these technologic tools. At the end of the first quarter of 2021, we published a report that included an initial mapping of the adoption of eProctoring in Latin America, as well as a review of the applicable privacy and personal data protection legislation.88. Carlos Guerrero Argote, “¿Vigilados en la escuela?: Impacto en la privacidad a partir del uso de tecnologías de e-proctoring en la región de Latinoamérica”. Programa Líderes 2.0 de LACNIC, 2021, accessed December 9, 2021, https://descargas.lacnic.net/lideres/carlos-guerrero/carlos-guerrero-informe.pdf. We comment on some of the results below.

3.1 The deployment of eProctoring in Latin America

For the aforementioned study, we chose three countries as case studies: Argentina, Chile and Peru. For each one, we consulted open source documents to determine the level of adoption of eProctoring solutions by public and private universities in 2020.

This initial survey produced the following results: in Argentina, we found 10 cases where one or more eProctoring software products had been adopted, of which 2 were in public universities and 8, in private ones. In Chile, 11 cases were detected: 1 in a public university and 10 in private universities. Finally, 25 cases were identified in Peru: 12 in public and 13 in private universities. The three most common eProctoring software products used were, in order of importance: SUMADI, SMOWL and METTL.99. See Annex 1 at the end of this article.

Although the evidence gathered was insufficient to identify patterns in the universities’ practices, one recurring factor was that most programmes were used almost exclusively to control online tests and, in general, were adopted as last minute solutions. This latter observation was perhaps why they were almost always adopted unannounced and often without any process in place to properly familiarize students and professors with the software.

Another interesting aspect of note was that most eProctoring programmes used highly advanced technologies. For instance, the three most common programmes used artificial intelligence algorithms fed with data obtained from tools such as facial recognition and biometrics. Furthermore, the programmes obtained data by taking control of the devices that the students used to take the tests, which required them to have peripheral devices (cameras, microphones) and an operating system that met the programme’s requirements.

3.2 Personal data protections applicable to eProctoring

The fact that, in order to function, eProctoring programmes needed to consume a large amount of data produced by students while they took the tests was cause for alarm in the case of Universidad San Marcos, as mentioned earlier. One of the concerns we identified that is directly related to privacy was the fact that these technologies were seen as highly invasive because they constantly recorded students, their surroundings and all actions they performed on their devices. This data was the main source of information for disqualifying students while using parameters that were not always explained and were generally confusing.

Our study found that most eProctoring software processed personal data such as: IP address, browsing history, facial image, first and last names, facial features and voice. Some of these items were considered sensitive data in the three countries studied, which meant that different rules that regulate their processing had to be enforced, particularly those related to personal data protection.1010. See Annex 2 at the end of this article.

Even though we found that the countries had nationwide personal data protection laws and mandatory provisions in this area, we also discovered that applying them to the use of eProctoring was not a matter without controversy. One issue, for instance, was jurisdiction: none of the three most commonly used programmes was supplied to the universities by companies domiciled in the country; their suppliers were registered abroad and operated through the Internet. An apparent anomie was also found due to the fact that earlier regulations did not cover the use of eProctoring and as a result, it was not clear how strict the obligations such as the registration of personal databases or the request for consent were, particularly in a crisis situation like the one experienced in 2020 because of the Covid-19 pandemic.

Nonetheless, the investigation was able to prove that, at least in Argentina and Peru, after overcoming the issue of the territorial scope of personal data protection rules, many general and specific provisions are fully applicable – if not to the companies supplying eProctoring, then at least to the universities that had hired their services. However, when faced with a compliance assessment, in most cases, save for a few exceptions, it seemed like the universities had believed that these provisions did not apply to them or they had simply chosen to disregard them.

There was an additional problem in determining more precisely to what extent the personal data protection rules in these countries had been breached, which would mean that infractions had been committed. With the exception of Peru, data protection authorities had not initiated investigations or inspection processes on the matter. As such, most of the conclusions in the study mentioned were speculative and official statements were required in order to make the findings more robust or to determine if they should be discarded.

4. Impact on privacy: the cases of Spain and Peru on eProctoring

We stated in the introduction that even though the focus of our study was Latin America, there are conflicts caused by the deployment of eProctoring all over the world. Proof of this is that when Universidad San Marcos announced the use of SMOWL to control its online admissions test in Peru, similar situations surfaced in other countries. Such is the case of Spain, a country where as of date, the Autoridad Española de Protección de Datos (AEPD) has issued at least one statement on a case involving the use of eProctoring at Universidad de la Rioja (UNIR).

4.1. The case of UNIR in Spain

As explained in a report by the Newtral webpage,1111. M. Gonzalo, “Proctoring: cuando la evaluación de exámenes es vigilancia”. Newtral, May 12, 2021, accessed December 9, 2021, https://www.newtral.es/proctoring-que-es-evaluacion-examenes-vigilancia-unir/20210512/. in March 2021, UNIR notified its students that due to the Covid-19 pandemic, it would hold its July tests online. After this announcement, it indicated that it would implement a “biometric authentication” programme as a security measure. Similar to the case of Universidad San Marcos, a large group of Spanish students expressed criticism of the change, but they were not properly heard. Even the software used in this case was the same one used in Peru: SMOWL.

The affected persons took this case to court and before the AEPD. The latter issued a warning statement in July of this year.1212. “Resolución de Advertencia”, Agencia Española de Protección de Datos, 2021, accessed October 15, 2021, https://www.newtral.es/wp-content/uploads/2021/08/documentoEnvio_624316-1.pdf?x60645. Some conclusions in the document were:

• An analysis on the impacts on privacy should be carried out to determine whether the use of programmes such as eProctoring is truly the best option for achieving the goals of the educational assessments.
• While the processing of biometric data using facial recognition technologies may be convenient for universities, it does not mean that it is necessary or an indispensable condition when dealing with sensitive data.

Furthermore, the arguments above were also presented in a report published by the AEPD one year ago on the use of facial recognition techniques for online tests.1313. Note N/REF: 0036/2020 of the Agencia Española de Protección de Datos. The report had already indicated that:

• The pandemic did not suspend the need to observe human rights, including the right to informational self-determination in the European Union.
• One cannot consider consent to be free in these cases if the person who gives their consent cannot withdraw it without suffering any harm. Therefore, there is a need to establish alternatives that do not involve the use of technologies such as facial recognition.
• There appears to be a need for a rule with the force of law that permits and sets limits on the use of technologies that collect sensitive data (such as facial recognition) in the case of online tests.

4.2 The case of UNMSM in Peru

Even though the case in Peru is still awaiting a final resolution from the data protection authority, many elements included in the complaint filed with the APDP are similar to the ones in the Spanish case.1414. Carlos Guerrero Argote, “Denunciamos a la Universidad Nacional Mayor de San Marcos por el uso de software biométrico en su Examen Virtual”. Hiperderecho, September 22, 2020, accessed December 9, 2021, https://hiperderecho.org/2020/09/denunciamos-a-la-universidad-nacional-mayor-de-san-marcos-por-el-uso-de-software-biometrico-en-su-examen-virtual/. For instance, regarding the principle of legality in Peruvian law, which presupposes that a legitimate basis for the processing of personal data exists, to date, the country does not have any specific regulation on the use of tools such as eProctoring. According to the investigation mentioned in the previous section, the Universidad San Marcos seems to have interpreted this gap as something that allows it to ignore formal obligations in our system, such as the prior registration of a personal database (a mandatory requirement).

Something similar occurs in the case of consent, which was denounced before the Authority as being absent or vitiated, since the university did not offer sufficient information to applicants regarding the nature of the processing of their data by SMOWL. Another argument along the same line was that even if there is proof that consent was requested, it could not be freely given, since refusing to give it (and therefore refraining from taking part in the online test) would result in serious harm to applicants, as it would deprive them of the possibility of being admitted to the university that year.

There is also the issue of proportionality. It is true that Peruvian legislation is not as advanced as that of Spain, as the former was inspired by a regulation that predates the General Data Protection Regulation of Spain.1515. We would say that it is closer to Directive 95/46/EC and Spain’s Organic Data Protection Law of 1999. Even so, it makes sense to consider the need to assess whether a tool such as SMOWL was indeed necessary in the context of the Covid-19 pandemic, and not just a convenient way to achieve the goal of holding tests and preventing misconduct.

There are other aspects that differ from what occurred in the UNIR case, which we feel we should mention because they could appear in Spain or in other countries where eProctoring technologies are used, especially when deployed on a large scale. This element (also included in the complaint) points to an apparent breach of the principle of security which is explicitly addressed in Peruvian law in a directive that establishes specific obligations depending on the type of data, the purpose of processing the data and whether the owner of the database is a public or private entity.1616. Directive on the Security of Information Managed by Personal Databases of 2014, issued by the Data Protection Authority of the Ministry of Justice. Violations of this principle can be seen in the multiple irregularities that occurred during the online test, which were mentioned in the second section, such as the absence of prior registration of the database and the lack of disclosure of privacy policies on the university’s website, among others.

5. Conclusion

We can draw the following conclusions from what we have discussed in this article:

• eProctoring programmes have been widely adopted around the world as a result of the Covid-19 pandemic. In Latin America alone, a total of 46 universities used them in 2020, mainly to control their online tests.
• At least in the case of the use of the SMOWL software at Universidad de San Marcos in 2020, the events there suggest that there is a need for a critical assessment of the impact of these technologies and the threat they pose to students, particularly regarding their privacy.
• A previous study on eProctoring identified regulations in Argentina, Chile and Peru that directly applied to these programmes due to their processing of multiple kinds of personal data, some of which are sensitive. However, it is not clear to what extent the said regulations are applicable. The lack of official statements on the subject contributes to this lack of clarity.
• In 2021, the Spanish Data Protection Authority issued a resolution warning UNIR against the use of SMOWL software after receiving a complaint from students at said university. The main argument for recommending that it avoid using it was the lack of necessity and proportionality.
• It is not yet clear if the Peruvian authority will take a stance similar to the one the Spanish authority adopted in the UNIR case. Even so, its decision could surely serve as a model for resolutions in Latin American countries with similar legislation.

ANNEXES

Annexes 1: Tables on the rate of use of eProctoring in the countries studied1717. The original database containing the consolidated mapping of the three countries can be found and downloaded here: "Mapeando el uso de software de e-proctoring en universidades de Latinoamérica", (n.d.), accessed October 15, 2021, https://bit.ly/30qcud3.

A) Argentina

B) Chile

C) Peru

2. Annex 2: Personal data processed by type of technology1818. The original database containing the personal data processed by type of tool, as well as the tools identified in each type of eProctoring software, can be found and downloaded from: "Datos tratados por cada tecnología", (n.d.), accessed October 15, 2021, https://bit.ly/2YQgqmI.