The Rise of Facial Recognition in Online Exams
Educational institutions transitioning to online exams face significant challenges in maintaining academic integrity. How can they ensure students aren’t cheating when physical monitoring isn’t an option? In this pursuit, a Valencian university—a pioneering institution—implemented a sophisticated facial recognition and video surveillance system. However, what seemed like a sound strategy has come back to haunt them.
The Legal Backlash
In the summer of last year, the Spanish Data Protection Agency (AEPD) took a stand against the International University of Valencia (VIU). The AEPD filed a complaint regarding the university’s use of facial recognition and surveillance to conduct online exams. A recent ruling has now mandated the VIU to pay a staggering fine of €650,000. This ruling marks a significant moment in the ongoing debate about privacy and surveillance in educational contexts.
Breakdown of the Fines
The hefty fine is composed of two penalties:
- €300,000 for violating Article 9 of the GDPR, which restricts the processing of biometric data except under specific conditions.
- €350,000 for contravening Article 5.1c of the GDPR, which stipulates that personal data must be adequate, relevant, and limited to what is necessary. The AEPD deemed the use of facial recognition in this case disproportionate.
The Technology Behind the Surveillance
The VIU’s examination system was outlined in its evaluation regulations, indicating the adoption of facial recognition technology. Students were required to use two cameras—one for monitoring themselves and another for the surrounding environment. The program continuously captured and analyzed images to verify the students’ identities and even monitored screens and connected devices throughout the exam.
Consent: A Controversial Issue
VIU’s defense hinged on the students’ consent to the system. While students technically agreed to using this control system, the AEPD argued that the lack of alternatives rendered this consent invalid; students either accepted the program or were unable to take the exam. The AEPD concluded that mandatory acceptance upon registration does not equate to valid consent.
Widespread Implications
The scrutiny doesn’t stop with the VIU. Other universities, such as the European University, Isabel I, La Rioja, and Burgos, have introduced similar systems combining video surveillance and facial recognition. The pandemic fueled an urgency for online examinations, leading to the rapid adoption of these technologies. The AEPD had previously warned against using biometric systems for monitoring exams and has now set a precedent with this substantial fine. Institutions must reconsider their existing systems to avoid similar penalties.
Future Possibilities
Despite these rulings, the AEPD does not entirely discount the use of biometric measures in education. They indicate that while biometric data is classified as high-risk under EU AI regulations, this does not outright ban its use—pending adherence to stringent regulations.
As discussions around digital privacy, consent, and technological ethics unfold, institutions must tread cautiously. The implications of this ruling may very well shape the future of online education and examination practices, requiring a balance between integrity and privacy.