Questions regarding the Online-Proctoring exams compliance with the GDPR + - Opozorilo: Mnenje je bilo izdano na podlagi določb Zakona o varstvu osebnih podatkov (ZVOP-1, Uradni list RS, št. 94/07 - uradno prečiščeno besedilo), ki je z dnem
- 2023 prenehal veljati in ga je nadomestil nov Zakon o varstvu osebnih podatkov (ZVOP-2, Uradni list RS, št. 163/22), zato mnenje ni več nujno aktualno. Mnenja po ZVOP-2 so na voljo tukaj. Datum: 05.11.2021 Številka: 5424-1/2021/88 Kategorije: --> Kategorije: Šolstvo, Biometrija, Moderne tehnologije, Inšpekcijski postopki The Information Commissioner (Slovenian National Supervisory Body for Personal Data Protection, below: IP) received your questions regarding experience and legal assessment of "Remotely Proctored Exams" or "Online-Proctoring exams" at our SA practice. We have several opinions published on our website regarding the use of online/remote tools for conducting exams, however only available in Slovene[1]: Opinion num. 07121-1/2021/141 from 26.02.2021; Opinion num. 07121-1/2020/830 from
- 2020; Opinion num. 07120-1/2020/299 from 15.04.
- In opinions above the IP answered applicant’s questions whether professors are allowed to record the remote examinations and ask students to have their camera directed onto them. We were of the opinion that in the processing of students' personal data for the purposes of remote examinations, the consent of the individual (Article 6
(1)(a) of the GDPR) is not an appropriate legal basis, whereas we suggested that the lawful basis based on the necessity for compliance with a legal obligation (Article 6
(1)(
- c)of the GDPR) might be more appropriate. We had also emphasized the need for providing necessary information about the collection and processing of personal data (Article 13 and 14 of the GDPR), while also taking into the account the data minimization, proper security and proportionality principles diligently (and other principles from Article 5 of the GDPR). We had also conducted several inspection procedures regarding the recording of the remote examination (e.g. procedure num. 0610–366/2020/5 from 4. 6. 2021 and num. 0610-351/2020/7 from 17. 6. 2021), where we found that there is no legal basis in the provisions of the GDPR, national Personal data Act (ZVOP-1) or any other lex specialis for the professor to be allowed to record videoconferences with students. A professor who wants to record his/her lessons is therefore not allowed to record students, but is allowed to record only himself/herself. Opinion num. 07120-1/2020/276 from 7. 4. 2020; In this opinion the IP answered an applicant’s question regarding the use of biometric technology during the remote examination. We had emphasized that based on our national Personal data Act (ZVOP-1), the use of biometric measures in the public sector is only allowed if it has a lawful basis, and if it is strictly necessary for the safety of people or property or for the protection of classified information and trade secrets, and if that purpose cannot be achieved by milder means. Since those measures of using biometric technology during remote examination are not covered in our national legislation by any law, we were of the opinion that such processing might be disproportionate. However specific inspection procedure regarding the question above has not been conducted in our practise yet. In the opinions mentioned above we had also emphasized that due to the coronavirus epidemic the use of new technologies, techniques, and methods, which are linked to the remote assessment of knowledge by schools and universities, is inevitable, but they must be carefully thought out and used proportionately. IP emphasizes that it does not oppose the use of information technology in the educational process and believes that especially in the current situation, smart and proportionate use of information technology is necessary to implement a quality and stimulating educational process while ensuring effective implementation of professors' duties. The remote assessment process has been designed by some professors to require students to use modern information technologies (often with personal data processing), so the choice of these technologies, the scope of data collection, and the way remotely proctored exams are carried out should be carefully considered and should not excessively infringe on the privacy of students. Due to the exceptional circumstances related to the need for remote examination, the IP believes that the ministry competent in education should properly specify this legal basis with uniform instructions to schools and universities. Slovenian IP has already called on our national ministry to do so. It is also important that education institutions, as controllers, respect all the principles of personal data protection set out in Article 5 of the GDPR, in particular the principle of data minimization, according to which the personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. Above all, the controllers must also ensure and respect the principle of proportionality. This means that the controller may not process more personal data than is strictly necessary for the implementation of the educational process, such as remote examinations. The educational institution or an individual professor must therefore check the students’ knowledge in a way that least interferes with their right to the protection of personal data and their privacy. Among other things, concerns about the security of personal data and its export to third countries also need to be taken into account. Regarding your other questions and challenges that might arise from the use of AI and biometric technology during remote examination, the Slovenian IP has not had any particular practise that had addressed those questions that are subject of your letter as of yet. However, we had also just recently published guidelines regarding the compliant use of information technologies in education, which we would invite you to read (only available in Slovene). You may find them on the following website: https://www.ip-rs.si/publikacije/priro%C4%8Dniki-in-smernice/smernice-po-splo%C5%A1ni-uredbi-o-varstvu-podatkov-gdpr/smernice-za-skladno-uporabo-informacijskih-re%C5%A1itev-v-%C5%A1olstvu We hope our answers help you. Mojca Prelesnik Information Commissioner of the Republic of Slovenia O NAS Informacijski pooblaščenec Dunajska cesta 22 1000 Ljubljana, Slovenija Zemljevid (vir: najdi.
- si)Telefon: 01 230 97 30 Poštni in varni e-predal: gp.ip(at)ip-rs.si Odgovorna oseba za informacije za medije: dr. Jelena Virant Burnik. Kontakt za medije: Barbara Repovš, mediji@ip-rs.si ali 01 230 97 30 Prijava kršitev (Navodila in obrazci) URADNE URE PON - PET 9.00 - 12.00 POVEZAVE Informacije javnega značaja Priročniki in smernice Obrazci Politika zasebnosti Informacije o obdelavi osebnih podatkov Izjava o dostopnosti Podpora za majhna podjetja Pravice posameznikov Prijava na prejemanje e-novic Informacijski pooblaščenec | 2026