Rb. Amsterdam - C/13/684665 / KG ZA 20-481

Rb. Amsterdam - C/13/684665 / KG ZA 20-481

Court:	Rb. Amsterdam (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 5 GDPR Article 6(1)(e) GDPR Article 9 GDPR Wet op het Hoger Onderwijs en Wetenschappelijk onderzoek
Decided:	11. 6.2020
Published:	n/a
Parties:	Student council of the Universiteit van Amsterdam Departmental student council Universiteit van Amsterdam
National Case Number/Name:	C/13/684665 / KG ZA 20-481
European Case Law Identifier:	n/a
Appeal from:	none, first instance
Appeal to:	n/a
Original Language(s):	Dutch
Original Source:	De Rechtspraak (in Dutch)
Initial Contributor:	n/a

The Amsterdam Court of First Instance rejected the request by student representatives and an individual student for a preliminary injunction against the use of digital surveillance software for exams by a public university. The court ruled that measures against covid-19 did not allow for a suitable alternative and the processing could therefore be based on Article 6(1)(e) GDPR.

English Summary

Facts

The national government has decided to suspend regular education activities at universities, including exams, as a measure to contain the covid-19 pandemic. Defendant has decided to use an online proctoring application, Proctorio, that monitors students while they take their exam from their home. The software records the user's webcam, microphone, internet traffic and inputs.

Dispute

The court had to give a preliminary decision on whether the processing is legal.

Holding

Defendant has a public task of organizing education and administering exams, provided by law. Because of restrictions by the national government, the use of online proctoring is the only suitable option of administering exams. The processing is therefore necessary for the exercise of an official authority vested in the controller. Recording the webcam of students in a personal environment and requiring them to 'scan' their room does not constitute personal data of a special category as laid down in article 9, because the controller does not track the user's eyes, respiration, stress or biometrics. The processing also does not violate the principles laid down in [Article 5 GDPR|article 5]].

Comment

Note that this is a request for a preliminary injunction, where the court only assesses whether the argument by plaintiff is likely to succeed in a full trial. The proctoring system monitors the user's behaviour and calculates a score that reflects the likelihood that a user was cheating. Only recordings with a high score are manually checked for cheating. The court did not assess whether this constitutes automated individual decision-making, as described in article 22

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

verdict
COURT OF AMSTERDAM

Private law department, civil relief judge

case number / roll number: C / 13/684665 / KG ZA 20-481 HH / LO

Interlocutory judgment of 11 June 2020

in the case of

1. the participation council

CENTRAL STUDENT COUNCIL OF THE UNIVERSITY OF AMSTERDAM,

Based in Amsterdam,

2. the participation council

FACULTY STUDENT COUNCIL OF THE FACULTY OF ECONOMY AND BUSINESS OF THE UNIVERSITY OF AMSTERDAM,

Based in Amsterdam,

3. [Claimant 3],

residing in [place of residence],

plaintiffs by subpoena dated June 2, 2020,

lawyers mr. W. Brussee in The Hague and mr. S. van Londen in Hilversum,

against

the legal person under public law

UNIVERSITY OF AMSTERDAM,

based in Amsterdam,

defendant,

lawyer mr N.N. Bontje in The Hague.

The parties will hereinafter also be referred to as CSR, FSR and [Claimant 3] and the UvA.
1 The procedure

At the hearing on June 4, 2020, plaintiffs explained the claims as described in the subpoena. The UvA has put up a defense. Both parties have submitted written documents and a pleading note. Judgment is determined today.

The following were present at the hearing:

on the side of the claimants: [name 1] (CSR), [name 2] (CSR), [name 3] (CSR) and [name 4] (FSR) with Mr. Brussee and Mr. Van Londen;

on the side of the UvA: [name 5], head of legal affairs, [name 6], director of the Center for Educational Innovation (Faculty of Economics and Business) with Mr. Bontje and Mr. D.R. Stolwijk.
2 The facts
2.1.

[Claimant 3] is a student at the UvA's Faculty of Economics and Business (FEB).
2.2.

On March 15, 2020, the government decided to close schools and universities on March 16, 2020, in connection with the corona crisis. As a result, exams could no longer be taken in the UvA buildings from that date.
2.3.

In connection with the closure of the buildings, the UvA has investigated the possibility of 'online proctoring'; the use of software to access online exams and to detect fraud during online exams.
2.4.

The Student Manual Online Proctored Exams (version 4 June 2020) includes the following.

(…) What is online proctoring?

Online proctoring means remote invigilation (surveillance) of an exam that you take in an online assessment platform. (…)

The UvA will make use of Proctorio (…) for online proctoring. Proctorio works via a plugin tool in Google Chrome. This plugin allows us to record you while you take the exam, and analyze the results. The results are analyzed automatically, and if any irregularity is detected a real person will assess the recorded material.(…)

Recording

 During the exam, your webcam, microphone, web traffic, screen, mouse- and keyboard activity are continuously monitored.

 Additionally, you might be asked to show your room, to check whether you have a clean desk and you are alone.

Browser lock-down

 The plugin can ask you to close all web browser windows before starting the exam and prevent you from opening new browser windows and tabs.

 The plugin will detect second screens and will prevent you from taking the exam in case you have a second screen attached.

 Additional lock-down options which might be turned on for your exam are, amongst others, disabling clipboard functionality, disabling right-mouse clicks and disabling printing functionality.

Verification

 The system will execute a check to make sure the webcam, microphone and screen recording are working as supposed.

 Also, you will be asked to scan your UvA student ID card at the beginning of the exam.

(…)

 The UvA understands that it might feel strange to be recorded during an exam. We understand that we are asking a lot when we ask you to show your room, and may see the files you have on your computer. We provide tips on how to minimize the intrusion into your private space elsewhere in this document.

 The most important reason to choose online proctoring as an alternative, is to minimize study delay for as many students as possible. The UvA has made sure that the footage of the exams can only be viewed by authorized employees. The only purpose to watch the recordings is to check for fraud. After the checks have been completed, all recordings will be deleted automatically after 30 days.

(…)

What about my privacy?

We understand online proctoring is an invasion of your privacy. We are mindful of this, but have decided to use online proctoring nonetheless. Our main reason is to make sure that exams for which it is hard or impossible to find an alternative form of examination (due to the number of students or the nature of the knowledge and/or skills to be examined) do not cause study delay for large groups of students.

The UvA has a Privacy Statement that describes which data are processed, recorded and stored by Proctorio. It describes how Proctorio handles the data, which rules and regulations apply. (…) Proctorio uses end-to-end zero knowledge encryption, which means they store that data in such a way that they cannot unencrypt and access it themselves, only authorized UvA staff can access the data. (…)

How am I monitored by the proctoring system?

Proctorio records your screen, webcam, audio, keystrokes and some information about your computer system to determine whether

● you are looking away from the screen a lot,

● you leave the area visible via the webcam,

● unpermitted sound can be heard,

● you are using a phone,

● you are opening unpermitted browser tabs or programs,

● you are typing much more or less than fellow students, and

● other people appear on screen. (…)

2.5.

At the beginning of April 2020, the UvA held a pilot in which three (practice) exams were administered using online proctoring using Proctorio software.
2.6.

At the time of the pilot, advice was sought from the UvA's Data Protection Officer (FG), who gave positive advice on 24 April 2020 about the use of online proctoring during the Covid-19 crisis.
2.7.

The UvA also conducted a DPIA (Data Protection Impact Assessment) at Proctorio. This is an instrument to (previously) identify the privacy risks of a data processing and to then be able to take measures to reduce the risks. The DPIA involves, among others, the Security Officer, the Information Manager, the Privacy Officer, the DPO and the Chief Information Security Officer (CISO).
2.8.

By letter of 29 April 2020, the CSR gave unsolicited advice about the use of online proctoring to the Executive Board (CvB) of the UvA. The CSR has stated that it has serious objections to the use of online proctoring. If the Executive Board nevertheless continues to implement it, the CSR advises, among other things, to establish a privacy protocol that will be provided to the student when his consent is requested for data processing. The CSR also advises not to perform a room scan and to make an alternative available if a student is unable or unwilling to work with proctoring, without this leading to a study delay.
2.9.

An internal memo from the UvA of 1 May 2020 states the following, among other things.

(…) Privacy and Security

Requirement: Student data must be processed securely in accordance with GDPR rules and guidelines.

The guarantee of the processing of students' data according to the GDPR has been checked using the standard process that is followed when new ICT systems are used. An Information Security & Privacy report and DPIA (comprehensive risk analysis) have been made. A Privacy Statement has been formulated and the processing agreement is currently being finalized. It seems that compliance with the GDPR rules is sufficiently guaranteed by Proctorio, and can be sufficiently guaranteed by the UvA, assuming that the advice in these reports is followed with regard to restricting access, deleting downloaded data during appeal procedures, etc. …)

Appendix 4: CISO Advice deployment Proctorio (…)

For now, the CISO is of the opinion that, given the great interests in being able to take examinations and the expectation that Proctorio will have a clear action perspective in mid-May to mitigate the current risks, it will provisionally give positive advice for the use of Proctorio. (…)
2.10.

On May 11, 2020, the Executive Board made a formal decision to use online proctoring with Proctorio as a test option, during the Covid-19 crisis, during exams where no suitable alternative to proctoring can be found. The decision states that the use of online proctoring in other situations not covered by the Covid-19 measures requires new decision-making.
2.11.

By letter of 18 May 2020, the Executive Board responded to the unsolicited advice from the CSR (2.8). The letter includes the following.

(…) First of all, we understand very well that you are concerned about the privacy of students when using online proctoring. The Executive Board shares this concern and has therefore paid a lot of attention to privacy issues. The UvA sees online proctoring as a tool that should only be used if there is no good alternative.

Before making a decision on proctoring, the UvA focused on privacy issues in particular. For example, it has been established that the data will only be accessible to authorized UvA staff. The images are encrypted and are stored on servers located in the EU. After thirty days everything is automatically deleted. It has also been established that the images will never be used for anything other than detecting possible fraud. The solution meets GDPR requirements and the Data Protection Officer has given a positive advice. (…)
2.12.

The FSR also notified the Executive Board of its objections to online proctoring by letter of 29 May 2020.
2.13.

The Higher Education and Scientific Research Act (WHW) includes the following.

(…) Article 7.13 Teaching and Examination Regulations

1. The board of the institution will draw up education and examination regulations for each study program or group of study programs offered by the institution. (…)

2. The Education and Examination Regulations (…) lay down the applicable procedures and rights and obligations with regard to education and exams. This includes at least: (…)

l. whether the exams are taken orally, in writing or otherwise. (…)
2.14.

The FEB's Education and Examination Regulations (OER) include the following.

(…) Article 4.2 Type of examination (…)

6. The course of review and the guidelines and instructions for assessing and determining the results of examinations and final examinations are described in the "Rules and Guidelines of the Examination Board" pursuant to Article 7.12b of the WHW.

(…)

Appendix I: Rules and guidelines Examination Board 2019-2020

The Rules and Guidelines of the Examination Board are not part of the Education and Examination Regulations, but are additional. According to the law (Article 7.12b paragraph 3 WHW), the content of these Rules and Guidelines is the exclusive competence of the Board of Examiners. The Faculty Student Council (FSR), Program Committees (OC) and the Works Council (OR) have no right of advice or consent to these provisions. (…)

Article 4.5 - Digital tests

If an examination is taken digitally, such an alternative provision is available that in the event of a (technical) failure, the examination concerned can still be taken the same day. (…)

Article 4.7 - Order during exams

1. The examiner must ensure that a sufficient number of invigilators are appointed during written examinations to ensure that the examination runs smoothly. Students must be supervised by an invigilator during the entire examination. (…)
3 The dispute
3.1.

Plaintiffs claim - summarized - enforceable by judgment with stock:

immediately prohibit the UvA from taking further examinations using Proctorio as long as the required approval of the CSR and / or FSR is lacking and the legality of the data processing has not been established;

prohibit the UvA from using the personal data obtained through Proctorio;

to order the UvA no later than 2 days after this judgment:

during the period as referred to under 1, to transfer the keys with which it has access to the personal data of students obtained through Proctorio to a notary for safekeeping;

b. To oblige Proctorio to permanently destroy the personal data in his possession through the use of their program by the UvA;

under penalty of a penalty of € 20,000 per day and with the UvA being ordered to pay the legal costs.
3.2.

The UvA has put up a defense.
3.3.

Insofar as relevant, the statements of the parties will be discussed below.
4 The assessment
Admissibility
4.1.

Plaintiffs have based their claims that the UvA is acting unlawfully by using online proctoring when taking examinations, because the UvA has not complied with the participation rules and has not complied with the privacy legislation, which means that it is a wrongful infringement on student privacy. [Claimant 3] further claims a ban on the use of Proctorio at his next exam on June 12, 2020 on the grounds that he does not authorize the use of his personal data, and he claims a ban on the use of his personal data that has already been came into the hands of the UvA through Proctorio.
4.2.

The UvA argues that claimants cannot be received in their claims. For the CSR and FSR, they can lodge an objection with the Disputes Committee for higher education and appeal to the Enterprise Chamber of the Amsterdam Court of Appeal, with which the Disputes Committee also has an urgent procedure. [Claimant 3] can object to the processing of his personal data and appeal to the administrative court against a rejection thereof. [Claimant 3] may also request the Examination Board for an alternative method of surveillance and an appeal may be lodged against a rejection of that request. Given the possibilities that an individual student has, the CSR and FSR cannot submit the same question to a civil court, according to the UvA.
4.3.

The following is important in assessing admissibility. The claims of the CSR and FSR are based on the statement that the UvA has taken a decision without observing the rules of participation. The UvA argues that they can go to the Disputes Committee for Higher Education and appeal to the Enterprise Chamber of the Amsterdam Court of Appeal. The preliminary relief judge acts as a residual judge in all cases with an urgent nature. In principle, the appointment of another competent court or of special legal proceedings does not render the preliminary relief judge unauthorized. The preliminary relief judge will only declare the plaintiff inadmissible if the other designated judge or legal process offers sufficient legal protection. To this end, it is required that, in urgent cases, a judicial procedure, with sufficient guarantees, is available, in which the claimant can achieve a result comparable to the summary proceedings (HR 16 March 1990, NJ 1990, 500). Plaintiffs have argued that the use of proctoring violates the privacy of students and that the UvA acts in violation of the GDPR. There is no legal basis for data processing and the UvA, as a government body, cannot invoke the exception referred to in Article 6 (1) (f) GDPR. Furthermore, the required purpose limitation is not met; the data processing goes further than strictly necessary for the purpose for which the data is processed, namely the prevention of fraud. For example, Proctorio uses a room scan, eye tracking, sound recording and data analysis. In Proctorio, the UvA has the option to "switch on and off" various options, but it uses all functions, while this is not strictly necessary. In addition, alternatives are available that are less invasive, such as Zoom live proctoring and Proctor Exam. Plaintiffs have also argued that the need for proctoring is lacking because examinations can be re-examined at the university from 15 June 2020. Furthermore, claimants argue that the UvA's balancing of interests under the GDPR cannot be found in the documents underlying the decision of 11 May 2020. The security of the processing of personal data is at stake. An audit will only take place in July 2020; until then, the method used is not safe. Access to the server via the web browser is also unsafe. In addition, there is no processing agreement, so it is not clear that the data remains within the EU and the processor is bound by European regulations. Proctorio is an American company, and the help desk is located in Serbia. The UvA has also omitted certain parts of the CISO (Chief Information Security Officer) advice, so that the assessment of the risks is not clear. The UvA also processes special personal data, such as eye tracking, breathing, coughing and sneezing, in violation of the prohibition in Article 9 of the GDPR. For all these reasons, the use of Proctorio should be discontinued, according to claimants.
4.8.

The UvA has argued that it does not act in violation of privacy law, in particular the GDPR. Due to government measures related to Covid-19, it is not possible to take exams on campus. The UvA has therefore introduced the possibility of distance examinations by means of online proctoring in a very short time, but after careful consideration and advice from various data protection experts. In doing so, she takes the principle that only proctoring is used if no other assessment methods are possible, as is the case with bachelor exams for large groups (more than 150 students) that are aimed at knowledge reproduction, and for resits (due to susceptibility to fraud). . Moreover, online proctoring offers a solution for international students who have left for their home country because of the Covid-19 crisis and cannot come to the campus to take exams. The UvA has done its best to keep the infringement as limited as possible. The main thing is that the data is only processed to determine effective fraudulent behavior. A processing agreement has been concluded with the processor (Proctorio), in which it submits to European privacy legislation. The data is stored on a server in Munich (Germany), so no data will be processed or stored outside the European Union. When using the help desk (which is located in Serbia), no data is shared, unless the student gives permission. The data is automatically deleted after 30 days. The student is not followed live during the exam, but an automated check takes place. Only if the system reports an irregularity, the admissions will be reviewed by an invigilator. During the examination, the invigilator will also perform a random check of the camera images of approximately 15% of the participating students. The system does not determine whether fraud is involved in such cases, the judgment is reserved for the Board of Examiners.

The Student Manual Proctored Exams provides students with extensive information, a test test is made available and tips are given on how students can prevent unwanted data from becoming visible (in the room or on the computer). According to the UvA.
4.9.

The following applies to the assessment. If the UvA uses online proctoring, it is responsible for the processing of personal data. According to the GDPR, the processing of personal data is only lawful if at least one of the conditions of Article 6 (1) is met. The UvA initially invoked Article 6 (1) (f) of the GDPR, but stated at the hearing that in any case there is a situation as referred to in Article 6 (1) of the GDPR, now that it has been established that the UvA may process data in in the context of examinations, on the basis of the provisions of e or f. It is not in dispute that the UvA is a government agency, so that, in view of the text of the GDPR, it cannot invoke the f ground of Article 6 (1) GDPR.

The background to this is that a government agency cannot create a new public task on the basis of "legitimate interests", because that task must be regulated by law. Article 6 paragraph 1 sub e GDPR provides a basis if the processing is necessary for the performance of a task within the context of the exercise of public authority assigned to the controller. This is the case when government agencies perform their statutory task (a so-called public task). It is not necessary for this that the public task or data processing is exhaustively regulated in a law in a formal sense, it is sufficient that the main features are known in the law.

In this case, the public task of the UvA is regulated in or can be traced back to a statutory task, namely its task to provide education, to take exams and to issue diplomas, whereby the quality of that education and of the diplomas are guaranteed. This task has been elaborated in the WHW, and the authority to process data in the context of examinations has been further elaborated in the OER and in the Rules and Guidelines of the Examination Board. The use of online proctoring must then be necessary, as described in e. The interim judge therefore sees the legitimate interest mentioned by the UvA in its decisions in this key.

Need
4.10.

As a result of the Covid-19 crisis and the measures taken by the government to prevent contamination, it is not (or was not) possible for the UvA to take exams on campus. In order to prevent students from getting a study delay, she looked for an alternative. In many cases, this alternative has been found in the form of open book exams, essays or other hand-in assignments. These alternatives are not suitable for a number of cases, such as multiple choice bachelor exams, which are aimed at knowledge reproduction and in which large groups of students participate. After 15 June 2020, the measure that higher education will be given as far away as possible will continue to apply, whereby exams can also be taken digitally. Even then it will therefore not yet be possible to have these exams take place on campus. As of June 15, 2020, only limited on-site teaching activities, including exams and exams, are permitted for a limited number of students and during limited times of the day, and to the extent that this is not sufficient online. Here too, the general instructions of RIVM and GGD must be taken into account. (https://www.rijksoverheid.nl/onderwerpen/coronavirus-covid-19/ouders-scholieren-en-studenten-kinderopvang-en-onderwijs/hogescholen-en-universiteiten-hoger-onderwijs). The alternatives put forward by the claimants in the summons are not sufficient, because they do not offer a test method suitable for knowledge reproduction, nor, in the opinion of the UvA, provide sufficient guarantees for good, reliable and fair examination. That judgment of the UvA is understandable for the time being. In this sense, it is sufficiently plausible that there is currently a need to take exams online.
4.11.

It is established that, on the basis of the OER and the Rules and Guidelines of the Examination Board, students should be supervised by an invigilator during the entire examination. The question is how this can be designed when students take online exams at home and whether the use of online proctoring is necessary. Although it will be a small minority of the students, fraud is an all-time exam. It is not without reason that the OER and the Rules and Guidelines of the Examination Board extensively regulate what is and what is not permitted during examinations, how the investigation takes place, how it is established that fraud has occurred and what the consequences are. It is therefore evident that measures are required during an exam that students take from their own computers from home. After all, the quality of education and the value of the diploma must be guaranteed.

Plaintiffs have proposed alternatives, including making a promise prior to exams. The latter cannot be regarded as a serious alternative. Pursuant to the applicable examination regulations, students are already obliged not to commit fraud, but fraud nevertheless occurs.

Documents submitted by the UvA show that, for example, answers are searched in online learning environments, answers are shared in WhatsApp groups, and that there are students who take exams together in one room or have their exams taken by another.

4.12.

On the basis of the above, it is sufficiently plausible for the time being that in the case of online proctoring during the period that exams cannot take place on campus as a result of the Covid-19 crisis, there is a necessary data processing within the meaning of Article 6, paragraph 1, sub e. GDPR.
4.13.

Next, it must be assessed whether the data processing when using Proctorio meets the other requirements of the GDPR, such as the basic principles referred to in Article 5 GDPR. For example, the processing must comply with the principles of lawfulness, fairness and correctness, and with the purpose limitation principle. Furthermore, the processing pursuant to Article 5 paragraph 1 sub c must be adequate, relevant and limited to what is necessary for the purposes for which the data are processed. The storage of data must also be limited and security must be guaranteed.
4.14.

In the first place, it is sufficiently plausible that the UvA has concluded a processing agreement with the processor (Proctorio), under which the processor is bound by the GDPR. The UvA has not submitted these, but it has been found that the CSR has been given the option of inspection. The UvA also conducted a careful investigation prior to the implementation of Proctorio. For example, a risk analysis was carried out with the involvement of various data protection officers / bodies, the DPIA. This analysis is not a one-off exercise, but an ongoing process, in which the risks of privacy breaches are reduced as much as possible. The DPIA and the annexes to the internal memo of 1 May 2020 show that the various data protection officers (the FG and the CISO) have provisionally approved the use of online proctoring with Proctorio. Extensive pilots have also taken place and the student councils are involved in the research.

It has not been sufficiently disputed that the encrypted data is stored in Munich (Germany), i.e. within the European Union and that, insofar as the help desk located in Serbia is used, no data is shared unless the student gives permission. This means that Article 46 (2) (c) GDPR has been met.
4.15.

That with online proctoring with Proctorio the student's screen becomes visible and a webcam is used that registers a student in his personal environment and where the student can be asked to show his environment and his desk (this seems to be the biggest problem for plaintiffs. in view of the foregoing is inescapable. How else can it be established that the student has no books, notes or telephone on or at his desk, which is checked by the invigilator during exams on campus. Incidentally, in the exceptional situation caused by the current Covid-19 crisis, a large proportion of employees worldwide who work from home are forced to share their personal environment with their colleagues and employer via video calling. The storage of the data is also necessary, now that the system can only combine the data with each other and invigilators only then have the opportunity to carefully examine whether fraud has been committed. Live monitoring of webcams and screens by means of, for example, Zoom, as mentioned by the students, is practically not possible for groups of more than 150 students, at least that cannot be expected from the UvA, regardless of whether there is software that makes possible. For a small group, a supervisor may view the webcams, but other screens that a student has opened cannot be seen, nor is it visible what the student has on his or her desk. Zoom is therefore not suitable for large (by nature) fraud-sensitive exams. In addition, it could be argued that live monitoring of all students is more invasive than proctoring through Proctorio, where most of the camera images and screen data are not viewed.
4.16.

The processing by the UvA only serves for authentication and to establish effective fraudulent behavior. Students are not followed live while taking exams, no eye tracking or recording breath, stress level or biometric data is used. There is therefore no question of the processing of special data within the meaning of Article 9 GDPR. With regard to the room scan, the UvA has argued that this is in fact a desk scan, now that the student is asked to show the environment in his viewing direction. Most of the footage is never viewed.After completing the exam, the invigilator can see the student card that the student had to show before taking the exam via webcam, as well as a score that indicates in percentages to what extent the student has exhibited deviant behavior, such as looking a lot (which can indicate cheat letters or texting with fellow students) or a lot of ambient noise (which may indicate conversations over the phone or with a fellow student present). For the time being, it has not been found that there is any other or more extensive data analysis of the data. The invigilator can only consult the recorded video, sound and / or browser recordings if the system registers significant deviant behavior. In addition, an invigilator can subsequently perform a random check on the desk scan. It uses a URL, the lifespan of which is limited to one hour and which must be logged in by means of multi-factor authentication. The processor (Proctorio) has no access to the data. In this way, safety is guaranteed as much as possible. Furthermore, no eye tracking takes place, but only registers whether a face looks straight forward or not straight forward.

The data is automatically deleted after 30 days. With this retention period, the invigilator can view the data within the review period of usually 15 days if there are suspicions of irregularities in the examination. If there is a suspicion of fraud, the data of the student concerned will be kept until any legal proceedings have been completed and measures have been taken. With these measures and under these circumstances, it is sufficiently plausible that the requirements of Article 5 GDPR have been met. In view of the short time that the UvA has had to find a solution in the current exceptional situation to the problems resulting from the closure of the universities, it has acted carefully. During the hearing, the UvA also argued that it is constantly being analyzed whether a relaxation of the corona measures should lead to a different consideration with regard to the use of online proctoring.
4.17.

The conclusion is that the data processing by the UvA is based on the basis of Article 6 (1) (e) of the GDPR, and that the processing complies with the due care requirements set by the GDPR. The UvA's conduct is therefore not unlawful. It can then be left open whether the student councils are admissible in their claims, insofar as these concern the lawfulness of the data processing. Pursuant to Section 3: 305a of the Dutch Civil Code, only a foundation or association with full legal capacity can institute legal proceedings that protect similar interests of other persons, insofar as they represent these interests under its articles of association and these interests are sufficiently safeguarded. After all, the student councils are not a foundation or association with full legal capacity.
4.18.

On the basis of the above, it has not been established for the time being that the UvA acted in violation of the participation rights of (one of) the student councils when taking the decision to use online proctoring, nor that the UvA is acting in violation of the provisions. in the GDPR. There is therefore no reason to prohibit the use of online proctoring with Proctorio by the UvA as a matter of order. The claims will therefore be dismissed.
4.19.

The fact that online proctoring with Proctorio is legally judged beforehand does not mean that [claimant sub 3] is obliged to take the exam on 12 June 2020. It is his own choice to do that. As put forward by the UvA, [claimant sub 3] can request the Examination Board for an alternative method of surveillance. The fact that he may experience a (possible) study delay does not change this.
4.20.

Plaintiffs will be ordered to pay the costs of the proceedings as the unsuccessful party. The costs on the part of UvA are estimated at:

- court registry fee € 656.00

- lawyer salary 980.00

Total € 1,636.00
5 The decision

The preliminary relief judge
5.1.

refuses the requested facilities,
5.2.

orders the plaintiffs to pay the costs of the proceedings, estimated to date at the UvA at € 1,636.00,
5.3.

declares this judgment enforceable with regard to the cost order.

This judgment was rendered by mr. H.C. Hoogeveen, preliminary relief judge, assisted by Mr. L. Oostinga, Registrar, and pronounced in public on June 11, 2020