Stop the Use of Privacy-Invading Exam Proctoring Software - Delft University of Technology

0 have signed. Let’s get to 5,000!


On the 19th of May, Delft University of Technology’s Board of Examiners finalized the exam schedule for Quarter 4. Many of these exams will be proctored with RPNow or with Proctorio, both of which are US-based companies that “pride” themselves with monitoring our screen, webcam, audio, keystrokes, and recording information about our personal computers. They look at eye movement, facial expressions, analyze a student’s every move during the exam[1], and even compare statistics like typing patterns to those of other students. Furthermore, they will ask us to share a video of our entire room and to show identification before partaking in the exam, data which is extremely private and sensitive. All this data will land in the hands of 3rd party companies, and we have no idea what they will do with it.

Regarding these two spyware applications which the university has chosen to use, in their terms of service[2a][2b] it is stated that the users’ data will be published in an "anonymized manner" for personal advertising and that both companies rid themselves of any liability and damages arising from any loss of data or harm to your computer system.

It is the opinion of myself and many other students that such examination practices are not acceptable and define invasion of privacy. The same idea is shared by many other people, including EU lawmakers[3] who have raised the question of the legality of using such software as it does not seem to comply with the GDPR.

A professor at TUD argued that we do not need to give consent to the usage of proctoring software as the university will give away our information without explicit approval under their privacy statement[4] because they deem it necessary. This is utterly flawed as Article 6, "Lawfulness of processing"[5] of the GDPR states:

  • “Processing shall be lawful only if and to the extent that at least one of the following applies:[...](f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

“Students’ identification, computer system, IP address and three-hour long footage of their faces, chest and hands (including of minors) in most people’s opinion, would count as personal data that is worth protecting, and risky enough to pose potential damages to the individuals if released or lost.”[6]

For data processing to happen, there needs to be an absolutely necessary purpose, an argument which can be disproven by the sheer fact that there are other methods of assessment provided by the university to the professors as well as the opening up of the country, set on the 15th of June.

“If a university can successfully argue processing students’ sensitive data without their consent, there is very little hope for the future of GDPR when involving other conflicts where our data needs to be protected. Companies that make a living collecting and processing personal data could use this incident as a precedent argument against GDPR, arguing that conducting business in the way that they do (collecting data without consent) is a legitimate interest for the survival of the company and the jobs of their employees. Even one incident where a double standard is successfully applied can make GDPR useless against big corporations.”[6](Brunna Torino, Data Privacy vs. European Universities: Online Proctoring, 2020)

This is undoubtedly becoming a major issue throughout the EU and has already gained global attention. TU Delft should be at the forefront of combatting this threat to privacy by offering innovative alternatives, not taking the easy way out.

On the 8th of April the university stated that teaching and exams for the 4th quarter of this academic year will take place online[7]. This has sparked concerns from students who are located both in the Netherlands and abroad. These concerns have yet to be taken into consideration by both the university and the student council. These issues are not limited to the ones listed:

  • Invasion of privacy
  • Having to show some form of identification (ID or passport), containing personal information
  • Lack of a proper internet connection[8]
  • Lack of a webcam[8]
  • Stressful exam environment due to the constant monitoring
  • Inability to be in a quiet undisturbed environment (family/roommates)
  • Giving access and control of your computer to spyware
  • Vulnerability to hacking[9]

The given advice for faculties w.r.t. hardware does not state anywhere on their individual pages the need of a webcam or a proper internet connection.[8]

The Board of Examiners was previously aware of the possibility of hacking when using proctoring software and did not want to use it for that reason. Now they welcome it with open arms although there are no changes in the functionality of these spyware applications.[9]

As students, we are forced to partake in more exams than usual at the end of this academic year due to the faculty not finding solutions that are appropriate for the current global situation. This overburdening of the exam period is making it very likely that many will have study delays and possible BSA issues that will carry forward and affect them later on.

We wish to make it clear that students are against the currently chosen method of examination. With the use of Proctorio or RPNow, we are forced to either fail exams or give up our privacy to a foreign entity with unknown intentions. This petition calls for finding more privacy-respecting alternatives of assessment, like the ones used in other universities and the ones suggested by the TUD manual for remote assessment[10]. Here are a few examples:

  • Alternative assignments/projects, such as essay-writing, answering questions and elaborating on arguments that allow us to critically think about the content of a course
  • Time-limited exams, in which students need to download an exam, take it and upload it before a certain time. This is followed up by professors taking a random sample of students and asking them about the content
  • Oral interviews
  • Open-book exams

This petition is coming from a place of care and consideration for the colleagues who do not have the means of open and transparent communication with the university; it tries to give them a voice and represent their opinions and concerns. It is for the students who want to be informed without a veil of uncertainty covering their future. For the people that are concerned about both their education and their privacy.

We want to be taken into account, included in the discussion. We don’t want to be a minority that is bullied into ignoring our right to privacy just because the university is not willing to research other means of assessment. Last but not least, we certainly don’t wish to be pushed away and shunned by the very student organizations we voted to represent us, just because they are playing politics.

Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.”― Edward Snowden

References
[1] Ohio State University. Proctorio Recording Options.
[2a] Proctorio. Terms of Service.
[2b] PSI Services (RPNow). Terms & Conditions.
[3] David M. (2020, May 5). EU lawmakers call for online exam proctoring privacy probe.
[4] TU Delft. Privacy statement.
[5] Art. 6 GDPR Lawfulness of processing.
[6] Brunna T. (2020, May 21). Data Privacy vs. European Universities: Online Proctoring.
[7] TU Delft. Information regarding the coronavirus.
[8] TU Delft. Laptop advice for your study.
[9] Saskia B. (2020, April 2). Why exams do not get rearranged just like that.
[10] TU Delft. How to make your assessment remote in Q4.