The impact of the use of eProctoring software on the privacy of university students
This article addresses the following question: what is the impact of the use of eProctoring programmes on the privacy of university students? A case that occurred in a Peruvian university in 2020 is used here to examine concepts related to eProctoring, namely privacy and personal data protection. The level of adoption of these technologies is also assessed, with a special focus on the Latin American region. The article ends with an analysis of the interaction between eProctoring and personal data protection rules, including the most recent case law on the matter.
Even though eProctoring, or remote proctoring, software has existed for years, it was not very well known before the Covid-19 pandemic. Unlike other educational tools, eProctoring has an enormous capacity to disrupt, mostly due to the intensive use of state-of-the-art technologies such as biometrics, facial recognition and artificial intelligence.
The advent of online classes in 2020 as a result of the pandemic marked the beginning of the widespread adoption of these computer programmes around the world. Their ability to control tests online and detect misconduct such as impersonation and plagiarism made these programmes a very attractive solution for universities.
However, the deployment of these technologies has sparked many negative reactions among student communities. Perhaps the most pertinent reactions revolve around whether it is appropriate to adopt technologies perceived as exceedingly invasive of privacy. Despite this and other concerns, universities have often imposed their use, even if the results are not always positive.
This article seeks to shed more light on the impact of the use of these technologies on the privacy of university students. Although it focuses on the Latin American region, and in Peru in particular, it addresses a problem that is also found with similar characteristics in other places where these programmes have been implemented.
In August 2020, Universidad Nacional Mayor de San Marcos (UNMSM), the biggest public university in Peru, announced that its annual admission test would be held online.11. Karina Garay, “San Marcos Anuncia Examen Virtual De Admisión Para El 2 y 3 De Octubre”. Agencia Peruana de Noticias Andina, August 28, 2020, accessed December 9, 2021, https://andina.pe/agencia/noticia-san-marcos-anuncia-examen-virtual-admision-para-2-y-3-octubre-811627.aspx. After months of uncertainty due to the measures adopted to restrain the spread of Covid-19, the news came as a relief to many applicants, but it also brought a new set of concerns with it.
In its announcement, Universidad San Marcos also indicated that it had established a few measures to avoid any dishonest conduct that could occur in a test held online, but it did not go into detail on the matter. However, a week later, the head of the UNMSM Central Admissions Office provided more details in an interview:
Now that we have decided that the admissions test will be held online, a series of questions arise, mostly regarding the possibility of some students cheating on the test by using the computer to look for answers on web pages, having someone help them answer the questions or getting someone else to take the test in the applicant’s place. (…) An app that uses artificial intelligence will be used to identify whether the applicant in front of the computer on the day of the test is the same individual who completed the biometric registration. (…) This security application will record images once a minute and detect if someone is opening a web page other than that of the test. Furthermore, it will detect if the computer is connected to a peripheral device, such as a screen, a HDMI cable or remote software. The system can also register if someone takes a screenshot of the test or makes changes to a Windows window.22. “San Marcos: cómo evitarán plagios y suplantaciones en examen virtual de admisión”. Agencia Peruana de Noticias Andina, September 1, 2020, accessed December 9, 2021, https://andina.pe/agencia/noticia-san-marcos-como-evitaran-plagios-y-suplantaciones-examen-virtual-admision-811770.aspx.
Many applicants to the admissions test were initially sceptical and later stated their opposition to this new method for several reasons: some were related to the context of the pandemic, but others referred to structural deficiencies such as the digital divide and the fear generated by the use of previously unknown technologies which had become crucial for holding the test. In the months that followed, these people became organized and coordinated their resistance efforts to try to stop the online test.
However, UNMSM did not give in to the pressure and on the dates scheduled in October, it proceeded with the online test. Participation was low: only 8,000 out of an initial total of over 15,000 people took the exam. As many of its detractors expected, several incidents were reported during the test. For instance, there were complaints that many students were allowed to take the test without leaving their camera on even though this was a mandatory requirement. There were also reports that both questions and answers from the test were shared on social media. Even more astonishing were the complaints stating that the test had been broadcasted live on the Twitch streaming platform.33. L. Ancajima, “Examen Virtual De La UNMSM: Denuncian Plagio, Transmisiones En Vivo y Más Durante Su Desarrollo”. RPP, October 4, 2020, accessed December 9, 2021, https://rpp.pe/tecnologia/redes-sociales/examen-virtual-de-la-unmsm-denuncian-plagio-transmisiones-en-vivo-y-mas-durante-su-desarrollo-noticia-1296176.
In spite of these complaints, which led entities such as the Congress of the Republic44. “Congreso cita a rector de San Marcos por incidentes en el examen de admisión virtual”, Diario El Peruano, October 3, 2020, accessed December 9, 2021, https://elperuano.pe/noticia/104779-congreso-cita-a-rector-de-san-marcos-por-incidentes-en-el-examen-de-admision-virtual., the Superintendencia Nacional de Educación Universitaria (SUNEDU)55. “Sunedu sobre examen virtual de San Marcos: Existen suficientes indicios para iniciar una indagación”, Diario El Comercio, October 3, 2020, accessed December 9, 2021, https://elcomercio.pe/lima/sucesos/sunedu-sobre-examen-virtual-de-san-marcos-existen-suficientes-indicios-para-iniciar-una-indagacion-unmsm-nndc-noticia/. and even the Autoridad de Protección de Datos Personales (APDP) to make statements,66. “La Autoridad Nacional de Protección de Datos Personales realiza acciones de fiscalización para verificar el adecuado tratamiento de los datos personales en el examen de admisión online realizado por la Universidad Nacional Mayor de San Marcos”, Press release, October 5, 2020, accessed December 9, 2021, https://www.redipd.org/es/noticias/la-autoridad-nacional-de-proteccion-de-datos-personales-realiza-acciones-de-fiscalizacion. UNMSM ignored them and a few days later, it published the results of the admission test. In the following weeks, interest in the case dwindled and, with the exception of the APDP which initiated an administrative investigation, the other entities did not take any action.
During the aforementioned events, the press never disclosed which “technologies using artificial intelligence” to detect plagiarism and impersonations announced by the UNMSM authorities were, in fact, used. However, in an investigation that we conducted in early 2021, we found that the technology that the university used was called SMOWL, a software programme created and distributed by Smowltech, a Spanish company that specializes in providing remote supervision services for online tests, also known as eProctoring.77. SMOWL, home page, 2021, accessed October 15, 2021, https://smowl.net/es.
As we mentioned earlier, the case of the Universidad San Marcos led us to launch an investigation into the implications of the use of these technologic tools. At the end of the first quarter of 2021, we published a report that included an initial mapping of the adoption of eProctoring in Latin America, as well as a review of the applicable privacy and personal data protection legislation.88. Carlos Guerrero Argote, “¿Vigilados en la escuela?: Impacto en la privacidad a partir del uso de tecnologías de e-proctoring en la región de Latinoamérica”. Programa Líderes 2.0 de LACNIC, 2021, accessed December 9, 2021, https://descargas.lacnic.net/lideres/carlos-guerrero/carlos-guerrero-informe.pdf. We comment on some of the results below.
For the aforementioned study, we chose three countries as case studies: Argentina, Chile and Peru. For each one, we consulted open source documents to determine the level of adoption of eProctoring solutions by public and private universities in 2020.
This initial survey produced the following results: in Argentina, we found 10 cases where one or more eProctoring software products had been adopted, of which 2 were in public universities and 8, in private ones. In Chile, 11 cases were detected: 1 in a public university and 10 in private universities. Finally, 25 cases were identified in Peru: 12 in public and 13 in private universities. The three most common eProctoring software products used were, in order of importance: SUMADI, SMOWL and METTL.99. See Annex 1 at the end of this article.
Although the evidence gathered was insufficient to identify patterns in the universities’ practices, one recurring factor was that most programmes were used almost exclusively to control online tests and, in general, were adopted as last minute solutions. This latter observation was perhaps why they were almost always adopted unannounced and often without any process in place to properly familiarize students and professors with the software.
Another interesting aspect of note was that most eProctoring programmes used highly advanced technologies. For instance, the three most common programmes used artificial intelligence algorithms fed with data obtained from tools such as facial recognition and biometrics. Furthermore, the programmes obtained data by taking control of the devices that the students used to take the tests, which required them to have peripheral devices (cameras, microphones) and an operating system that met the programme’s requirements.
The fact that, in order to function, eProctoring programmes needed to consume a large amount of data produced by students while they took the tests was cause for alarm in the case of Universidad San Marcos, as mentioned earlier. One of the concerns we identified that is directly related to privacy was the fact that these technologies were seen as highly invasive because they constantly recorded students, their surroundings and all actions they performed on their devices. This data was the main source of information for disqualifying students while using parameters that were not always explained and were generally confusing.
Our study found that most eProctoring software processed personal data such as: IP address, browsing history, facial image, first and last names, facial features and voice. Some of these items were considered sensitive data in the three countries studied, which meant that different rules that regulate their processing had to be enforced, particularly those related to personal data protection.1010. See Annex 2 at the end of this article.
Even though we found that the countries had nationwide personal data protection laws and mandatory provisions in this area, we also discovered that applying them to the use of eProctoring was not a matter without controversy. One issue, for instance, was jurisdiction: none of the three most commonly used programmes was supplied to the universities by companies domiciled in the country; their suppliers were registered abroad and operated through the Internet. An apparent anomie was also found due to the fact that earlier regulations did not cover the use of eProctoring and as a result, it was not clear how strict the obligations such as the registration of personal databases or the request for consent were, particularly in a crisis situation like the one experienced in 2020 because of the Covid-19 pandemic.
Nonetheless, the investigation was able to prove that, at least in Argentina and Peru, after overcoming the issue of the territorial scope of personal data protection rules, many general and specific provisions are fully applicable – if not to the companies supplying eProctoring, then at least to the universities that had hired their services. However, when faced with a compliance assessment, in most cases, save for a few exceptions, it seemed like the universities had believed that these provisions did not apply to them or they had simply chosen to disregard them.
There was an additional problem in determining more precisely to what extent the personal data protection rules in these countries had been breached, which would mean that infractions had been committed. With the exception of Peru, data protection authorities had not initiated investigations or inspection processes on the matter. As such, most of the conclusions in the study mentioned were speculative and official statements were required in order to make the findings more robust or to determine if they should be discarded.
We stated in the introduction that even though the focus of our study was Latin America, there are conflicts caused by the deployment of eProctoring all over the world. Proof of this is that when Universidad San Marcos announced the use of SMOWL to control its online admissions test in Peru, similar situations surfaced in other countries. Such is the case of Spain, a country where as of date, the Autoridad Española de Protección de Datos (AEPD) has issued at least one statement on a case involving the use of eProctoring at Universidad de la Rioja (UNIR).
As explained in a report by the Newtral webpage,1111. M. Gonzalo, “Proctoring: cuando la evaluación de exámenes es vigilancia”. Newtral, May 12, 2021, accessed December 9, 2021, https://www.newtral.es/proctoring-que-es-evaluacion-examenes-vigilancia-unir/20210512/. in March 2021, UNIR notified its students that due to the Covid-19 pandemic, it would hold its July tests online. After this announcement, it indicated that it would implement a “biometric authentication” programme as a security measure. Similar to the case of Universidad San Marcos, a large group of Spanish students expressed criticism of the change, but they were not properly heard. Even the software used in this case was the same one used in Peru: SMOWL.
The affected persons took this case to court and before the AEPD. The latter issued a warning statement in July of this year.1212. “Resolución de Advertencia”, Agencia Española de Protección de Datos, 2021, accessed October 15, 2021, https://www.newtral.es/wp-content/uploads/2021/08/documentoEnvio_624316-1.pdf?x60645. Some conclusions in the document were:
Furthermore, the arguments above were also presented in a report published by the AEPD one year ago on the use of facial recognition techniques for online tests.1313. Note N/REF: 0036/2020 of the Agencia Española de Protección de Datos. The report had already indicated that:
Even though the case in Peru is still awaiting a final resolution from the data protection authority, many elements included in the complaint filed with the APDP are similar to the ones in the Spanish case.1414. Carlos Guerrero Argote, “Denunciamos a la Universidad Nacional Mayor de San Marcos por el uso de software biométrico en su Examen Virtual”. Hiperderecho, September 22, 2020, accessed December 9, 2021, https://hiperderecho.org/2020/09/denunciamos-a-la-universidad-nacional-mayor-de-san-marcos-por-el-uso-de-software-biometrico-en-su-examen-virtual/. For instance, regarding the principle of legality in Peruvian law, which presupposes that a legitimate basis for the processing of personal data exists, to date, the country does not have any specific regulation on the use of tools such as eProctoring. According to the investigation mentioned in the previous section, the Universidad San Marcos seems to have interpreted this gap as something that allows it to ignore formal obligations in our system, such as the prior registration of a personal database (a mandatory requirement).
Something similar occurs in the case of consent, which was denounced before the Authority as being absent or vitiated, since the university did not offer sufficient information to applicants regarding the nature of the processing of their data by SMOWL. Another argument along the same line was that even if there is proof that consent was requested, it could not be freely given, since refusing to give it (and therefore refraining from taking part in the online test) would result in serious harm to applicants, as it would deprive them of the possibility of being admitted to the university that year.
There is also the issue of proportionality. It is true that Peruvian legislation is not as advanced as that of Spain, as the former was inspired by a regulation that predates the General Data Protection Regulation of Spain.1515. We would say that it is closer to Directive 95/46/EC and Spain’s Organic Data Protection Law of 1999. Even so, it makes sense to consider the need to assess whether a tool such as SMOWL was indeed necessary in the context of the Covid-19 pandemic, and not just a convenient way to achieve the goal of holding tests and preventing misconduct.
There are other aspects that differ from what occurred in the UNIR case, which we feel we should mention because they could appear in Spain or in other countries where eProctoring technologies are used, especially when deployed on a large scale. This element (also included in the complaint) points to an apparent breach of the principle of security which is explicitly addressed in Peruvian law in a directive that establishes specific obligations depending on the type of data, the purpose of processing the data and whether the owner of the database is a public or private entity.1616. Directive on the Security of Information Managed by Personal Databases of 2014, issued by the Data Protection Authority of the Ministry of Justice. Violations of this principle can be seen in the multiple irregularities that occurred during the online test, which were mentioned in the second section, such as the absence of prior registration of the database and the lack of disclosure of privacy policies on the university’s website, among others.
We can draw the following conclusions from what we have discussed in this article:
|Name of the University||Type of Institution||eProctoring Technology|
|Universidad Empresarial Siglo 21||Private||KLARWAY|
|Universidad Argentina de la Empresa||Private||PROCTORIO|
|Universidad de Congreso||Private||PROCTORIO|
|Instituto Tecnológico de Buenos Aires||Private||RESPONDUS|
|Universidad de Morón||Private||SUMADI|
|Universidad de Palermo||Private||SUMADI|
|Universidad Católica de Salta||Private||NOT SPECIFIED|
|Universidad de San Andrés||Private||RESPONDUS|
|Universidad Nacional de Córdoba||Public||RESPONDUS|
|Universidad Nacional del Chaco Austral||Public||SMOWL|
|Name of the University||Type of Institution||eProctoring Technology|
|Universidad Diego Portales||Private||RESPONDUS|
|Universidad de Las Américas||Private||SMOWL, SUMADI|
|Universidad de Concepción||Private||SUMADI|
|Universidad Católica de Temuco||Private||SUMADI|
|Universidad Católica del Maule||Private||SUMADI|
|Universidad Santo Tomás||Private||SUMADI|
|Universidad San Sebastián||Private||SUMADI|
|Universidad Gabriela Mistral||Private||SUMADI|
|Pontificia Universidad Católica de Chile||Private||NOT SPECIFIED|
|Universidad de Chile||Public||SEVERAL|
|Name of the University||Type of Institution||eProctoring Technology|
|Universidad San Ignacio de Loyola||Private||EXAM|
|Universidad Nacional de San Agustín||Public||METTL|
|Universidad Nacional de Juliaca||Public||METTL|
|Universidad de Piura||Private||METTL|
|Universidad Privada Antenor Orrego||Private||METTL|
|Universidad Nacional Agraria La Molina||Public||METTL|
|Universidad Nacional de Jaén||Public||NOT SPECIFIED|
|Universidad Nacional del Santa||Public||NOT SPECIFIED|
|Universidad Nacional de Piura||Public||NOT SPECIFIED|
|Universidad Nacional José María Arguedas||Public||NOT SPECIFIED|
|Universidad Nacional Autónoma Altoandina de Tarma||Public||NOT SPECIFIED|
|Universidad Católica San Pablo||Private||NOT SPECIFIED|
|Universidad de Lima||Private||PROCTOR TRACK|
|Pontificia Universidad Católica del Perú||Private||PROCTOR TRACK|
|Universidad Nacional Autónoma de Alto Amazonas||Public||SAFE EXAM BROWSER|
|Universidad Católica de Santa María||Private||SAFE EXAM BROWSER|
|Universidad Nacional Mayor de San Marcos||Public||SMOWL|
|Universidad Nacional de Ingeniería||Public||SMOWL|
|Universidad Nacional Jorge Basadre Grohmann||Public||SMOWL|
|Universidad Peruana Cayetano Heredia||Private||SMOWL|
|Universidad Privada San Juan Bautista||Private||SMOWL|
|Universidad César Vallejo||Private||SMOWL|
|Universidad del Pacífico||Private||SUMADI|
|Universidad Privada del Norte||Private||SUMADI|
|Universidad Peruana de Ciencias Aplicadas||Private||SUMADI|
|Tool||Personal data processed|
|Facial recognition to validate identity||Image, facial features, name, identity document|
|Real-time monitoring using a webcam||Image, voice, facial features, IP address|
|Image recording and/or capturing through webcam||Image|
|Audio recording and/or capturing through a microphone||Voice|
|Algorithm-based determination of suspicious behaviour||Image, voice, facial features, IP address, browsing history|
|Blocking actions (in devices)||IP address, browsing history|