Gerechtshof Amsterdam - 200.280.852/01
| GHAMS - 200.280.852/01 | |
|---|---|
 | |
| Court: | Gerechtshof Amsterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 6(1)(e) GDPR Article 7.13 of the Higher Education and Scientific Research Act (WHW) Article 9.38 of the Higher Education and Scientific Research Act (WHW) |
| Decided: | 01.06.2021 |
| Published: | 01.06.2021 |
| Parties: | |
| National Case Number/Name: | 200.280.852/01 |
| European Case Law Identifier: | ECLI:NL:GHAMS:2021:1560 |
| Appeal from: | Rb. Amsterdam (Netherlands) C/13/684665 / KG ZA 20-481 |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | Decision (in Dutch) |
| Initial Contributor: | Kave Noori |
The Court of Appeal of Amsterdam ruled that the COVID-19 pandemic constituted a special situation that allowed the University of Amsterdam to introduce mandatory electronic surveillance during online exams. Neither the student council nor the faculty council had the right to be involved in the decision-making process.
English Summary
Facts
The case concerns a civil dispute between the plaintiffs Central Student Council (CSR) at the University of Amsterdam ('UvA'), the Student Council at the Faculty of Economics and Business (FSR) of the UvA, and an individual student against the defendant, the UvA.
The outbreak of Covid19 caused the Dutch government to close the universities on 16 March 2020. Due to the closure, it was not possible for the UvA to hold exams on site. After some research and testing, the UvA decided to use an online proctoring tool, essentially a monitoring software called Proctorio. This software allows the university to monitor student behaviour at home while they are taking the exam to see if the student is attempting to cheat on the exam.
Proctorio is installed as a browser plugin. It continuously records the test taker's webcam, microphone, and screen. In addition, the software monitors the student's behaviour to detect unusual behaviour, such as if the student often looks away from the screen, or if there is ambient noise in the room that might indicate that someone else is in the same room with the student, or if the student types more or less than other test takers. The software also monitors the computer's internet traffic, the presence of secondary monitors.
The plaintiffs took the university to court by filing a motion for a preliminary injunction with the District Court of Amsterdam. The district court ruled in favour of UVA, finding that the government's COVID-19 measures did not allow for suitable alternatives and that the surveillance had a legal basis in Article 6(1)(e) GDPR. The plaintiffs appealed to the Court of Appeals Amsterdam Court, seeking an ordinary ruling (not a preliminary injunction).
Before rolling out the software in a real-world scenario, the UvA conducted three simulated tests in April 2020. In the meantime, the UvA asked its own DPO (Data Protection Officer) for advice and received a positive response. The UvA then conducted a DPIA (Data Protection Impact Assessment) to identify data protection risks and find mitigation measures.
The CSR sent a letter to the UvA's Executive Board, which was described in the judgement as "unsolicited advice". In this letter, the CSR strongly opposed the use of proctoring, recommended against the use of room scanning, and recommended that the UvA provide students who cannot/would not use proctoring with alternative means of taking exams without delaying their studies.
The UvA's Executive Board decided on 11 May 2020 that online proctoring would be used for exams during the Covid19 pandemic if there were no suitable alternatives. The use of online proctoring in non-pandemic situations would require a new decision by the board.
Dispute
Was it legal for the UvA to exclude the students from the decision-making when introducing proctoring?
The plaintiffs alleged that the UvA had violated the law by changing the so-called Teaching and Examination Regulations (Onderwijs- en Examensregeling, OER) without following due process. Article 7.13 of the Higher Education and Scientific Research Act (WHW) requires that every Dutch higher education program adopts a OER. A higher education institution may also adopt a OER for a group of programs. The OER is a legal document and can be described as a plan for the educational program. It contains binding rules for the admission criteria, the content and structure of the education and the way in which the students' knowledge is tested.
With respect to examinations, Article 7.13(2)(l) of the Higher Education and Scientific Research Act (WHW) states that the OER must determine the forms (oral, written, other) in which examinations will be taken. The Act also gives the Board of Examiners the power to deviate from this in special cases.
Nevertheless, the WHW requires that the forms of examinations be regulated OER. However, the OER of the Faculty of Economics and Business does not contain any regulations on the form of examinations, but refers to another document entitled "Rules and Guidelines of the Examination Board".
The "Rules and Guidelines of the Examination Board " of the Faculty of Economics, and Business on the other hand, contained regulations on digital examinations. Appendix I of that document also made clear that the Student Council of the Faculty of Business and Economics (FSR) had no right to advise or consent to the regulations. The plaintiffs responded to this provision, claiming that it violated Article 9.38 of the Higher Education and Scientific Research Act (WHW) which states that a dean must obtain the approval of the Faculty Council (a body within the university on which students and staff are represented) when issuing or amending certain regulations in the OER.
Was the introduction of Proctorio compliant with the GDPR?
The plaintiffs claimed that the introduction of Proctorio breached the GDPR in several respects. They claimed that it was unnecessary to introduce monitoring software, that more data than necessary was processed, that there was a lack of transparency and security, and that sensitive personal data was processed without a legal basis.
Holding
Was it lawful for the UvA to exclude students from decision-making when proctoring was introduced?
The court found that the UvA had not breached any procedural rules in deciding to introduce proctoring. This was because the court held that the introduction of proctoring did not mean that a formal decision had been made to change OER. The court referred to Article 7.13(2)(l) of the Higher Education and Scientific Research Act (WHW) which allows the Board of Examiners to depart from OER in special circumstances. The court found that the Covid19 restrictions qualified as a special case.
In addition, the court considered an online exam to be equivalent to a written exam. The rules already allow the UvA to monitor in-person exams, and the online exam was viewed by the court as merely a written exam with another form of monitoring.
In conclusion, the court considered the Covid19 restrictions as a special case where the exam board is allowed to deviate from the OER. Since no formal changes were made to the OER and the court considered online exams with digital surveillance to be equivalent to a supervised in-person exam, neither the CSR nor the Faculty Council had a right to be involved in the decision making.
Was the introduction of Proctorio compliant with the GDPR?
The plaintiffs made a long series of allegations about how the introduction of Proctorio conflicted with the GDPR which were all assessed by the court.
First, the court found that the UvA successfully demonstrated that the use of Proctorio was necessary for the performance of the task of exercising official authority under Article 6(1)(e) GDPR. The court agreed with the UvA that there is a risk that fraud can take place on a large scale when exams are conducted online and answers can be easily shared online in WhatsApp groups. For this reason, the court took the same view as UVA, that the measures are necessary to ensure fair and reliable exams to protect the value of diplomas.
Second, the court found that the plaintiffs failed to prove that use of Proctorio violated the principles of purpose limitation and data minimization. The court disagreed with plaintiffs' contention that occasional, rather than continuous, recording of image and voice would be sufficient to effectively combat fraud. Further, the plaintiffs had presented evidence from an exam that required students to webcam the entire room. The court relied on the manuals provided by the UvA and assumed that the plaintiffs' evidence concerned only an isolated incident.
Third, the plaintiffs had argued that less intrusive alternatives than Proctorio could be used. For example, live monitoring of students via Zoom, open-ended questions instead of multiple choice and plagiarism detection software. The court ruled that the plaintiffs had not presented alternatives that were feasible and sufficiently resistant to cheating.
Fourth, the plaintiffs argued that the UvA had not provided full insight into how the Proctorio software detects cheating. The court did not believe that this would be conducive to effectively combating fraud.
Fifth, the court held that the plaintiffs had not plausibly demonstrated that anyone not authorized by the university to view the video and audio, such as Proctorio or U.S. intelligence agencies, could gain access. The court noted that the plaintiffs had not challenged that the data was encrypted or stored in the EU.
Sixth, the plaintiffs had given examples of situations where examinations could not be held at the scheduled time. The court expressed that the UvA had a responsibility to be prepared for technical malfunctions and also to provide adequate solutions to students who could not take the examination. However, the court did not see this as a reason to ban online exams in general.
Seventh, while the court acknowledged that it was disruptive that students could not go to the bathroom during online exams, it noted that the same was true for on-site exams. The court therefore held that it could not consider this complaint in assessing the legality of online examinations.
In addition, the claimants argued that the images collected could be sensitive personal data for which there was no legal basis for collection. The court ruled that images identifying an individual could not simply be sensitive personal data revealing, for example, religion or race. The court could not foresee that the images would be used by the university to distinguish test takers based on protected characteristics.
Did the proctoring violate Article 8 of the ECHR?
The plaintiffs also argued that proctoring violated Article 8 of the European Convention on Human Rights (ECHR). The court considered whether the interference with privacy by proctoring was justified under Article 8(2) of the ECHR. The court looked back at the reasoning it had used in assessing the lawfulness of proctoring in relation to the GDPR. The court then focused on the fact that Article 7.13(2)(l) of the Higher Education and Scientific Research Act (WHW) allows the court to depart from OER:. The court based the action on the law. Further, it held that it was plausible that the interference with privacy was necessary in a democratic society and could be considered proportionate.
The plaintiffs were unsuccessful in the court in all parts of their action. As the losing side, the plaintiffs were jointly ordered to pay the UvA's costs of the proceedings.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Body
Amsterdam Court of Appeal
Date of judgment
01-06-2021
Date of publication
01-06-2021
Case number
200.280.852/01
Jurisdictions
Civil rights
Special characteristics
Appeal in summary proceedings
Content indication
The student council is demanding that the UvA be banned from conducting online exams using Proctorio. The court has ruled that the student council has no right of consent. The use of Proctorio complies with the requirements of the GDPR. with the Covid measures necessary to fulfill its task. The collection and processing of data does not go beyond what is necessary for the purpose. The deployment of Proctorio also meets the requirements of Article 8 ECHR. The Court of Appeal confirms the negative judgment of the preliminary relief judge.
Locations
Rechtspraak.nl
Enhanced pronunciation
Share pronunciation
print
Save as PDF
Copy link
Statement
AMSTERDAM COURT
Department of Civil Law and Tax Law, Team I
case number : 200.280.852/01
case number Amsterdam court: C/13/684665 / KG ZA 20-481
judgment of the multiple civil chamber of June 1, 2021
regarding
1 CENTRAL STUDENT COUNCIL OF THE UNIVERSITY OF AMSTERDAM,
2. FACULTY STUDENT COUNCIL OF THE UNIVERSITY OF AMSTERDAM FACULTY OF ECONOMY AND BUSINESS,
both established in Amsterdam,
3. [appellant sub 3],
living in [place of residence] ,
appellants,
lawyer: mr. W. Brussee in The Hague,
against
UNIVERSITY OF AMSTERDAM,
Based in Amsterdam,
defendant,
lawyer: mr. G.J. Zwenne in The Hague.
1 The appeal proceedings
The parties are hereinafter referred to as CSR, FSR, [appellant sub 3] and UvA. The appellants collectively are also referred to as CSR et al.
By summons dated July 9, 2020, restored by writ dated July 10, 2020, CSR et al. have appealed against a judgment of the preliminary relief judge in the District Court of Amsterdam dated June 11, 2020, under the above-mentioned case number in summary proceedings between CSR et al as plaintiffs and UvA as defendant. The summons contains the grievances. Productions were also submitted with the summons.
The parties subsequently submitted the following documents:
- statement of defense in the principal appeal, also statement of appeal in the cross-appeal and response to the change of claim, with exhibits;
- statement of defense in the cross-appeal, with exhibits;
- deed requesting a judgment on the part of CSR et al.;
- response letter from the UvA, with productions;
- deed with evidence to the contrary: room scan and eye tracking, on the part of CSR et al., with exhibits;
- deed with evidence: technical risks online testing, Proctorio, on the part of CSR et al., with productions,
- a reply deed from the UvA, with exhibits on the same roll-up date;
- correction of an error on the part of CSR et al., with a production.
Finally, a judgment has been requested.
CSR et al. have concluded in appeal in principle that the Court of Appeal will annul the contested judgment and - provisionally enforceable - will still grant their appeal, as reworded on appeal, ordering the UvA to pay the costs of the proceedings in both instances.
In an cross-appeal, the UvA has concluded that their claim should be declared inadmissible by CSR et al., and the appeal in principle to be rejected and to refuse the amendment of the claim, all this with provision – provisionally enforceable – ordering CSR et al to pay the costs of the proceedings in appeal with subsequent costs and interest.
CSR et al. have concluded in cross-appeal that the application be rejected, with the UvA ordered to pay the costs.
2 Facts
In the contested judgment, the judge in preliminary relief proceedings has listed under 2.1 to 2.14 the facts that it took as the basis for assessing the case. CSR et al. argue in ground 1 that the preliminary relief judge based its judgment on incorrect facts, propositions and assumptions. In view of the explanation thereto, however, the complaint does not concern the facts listed by the preliminary relief judge. The listed facts are therefore not in dispute and therefore also serve as the starting point for the Court of Appeal. The Court of Appeal will take the explanation of ground 1 into account, insofar as relevant, in the assessment of the dispute. In summary, the facts boil down to the following.
2.1
[appellant 3] is a student at the Faculty of Economics and Business (hereinafter: FEB) of the UvA.
2.2
On March 15, 2020, the cabinet decided to close schools and universities as of March 16, 2020 due to the corona crisis. As a result, it was no longer possible to take exams in the UvA buildings from that date.
2.3
In connection with the closure of the buildings, the UvA has investigated the possibility of 'online proctoring': the use of software to give students access to online exams and to detect fraud in online exams.
2.4
At the beginning of April 2020, the UvA held a pilot in which three (practice) exams were administered using online proctoring using software from a company called Proctorio. The parties refer to both this company and this software as Proctorio.
2.5
At the time of the pilot, advice was obtained from the Data Protection Officer (DPO) of the UvA, who advised positively on 24 April 2020 on the use of online proctoring during the Covid-19 crisis.
2.6
The UvA has also conducted a DPIA (Data Protection Impact Assessment) on Proctorio. This is an instrument to map the privacy risks of data processing (in advance) and to be able to take measures afterwards to reduce the risks. The Security Officer, the Information Manager, the Privacy Officer, the DPO and the Chief Information Security Officer (CISO) are involved in drawing up the DPIA.
2.7
In a letter dated 29 April 2020, CSR provided unsolicited advice on the use of online proctoring to the Executive Board (CvB) of the UvA. CSR has stated that it has serious objections to the use of online proctoring. If the Executive Board nevertheless continues with its implementation, CSR advises, among other things, to establish a privacy protocol that will be provided to the student the moment his consent is requested for data processing. CSR also advises not to perform a 'room scan', and to make an alternative available if a student is unable or unwilling to work with proctoring, without this leading to study delay.
2.8
An internal memo from the UvA dated 1 May 2020 states, among other things, the following.
(…) Privacy and Security
Requirement: Student data must be processed securely, in accordance with GDPR rules and guidelines.
The safeguarding of the processing of student data in accordance with the GDPR has been checked on the basis of the standard process that is followed when deploying new ICT systems. An Information Security & Privacy report and DPIA (extensive risk analysis) have been prepared. A Privacy Statement has been formulated and the processing agreement is currently being finalized. It seems that compliance with the GDPR rules is sufficiently guaranteed by Proctorio, and can be sufficiently guaranteed by the UvA, assuming that the advice in these reports is followed with regard to limiting access, removing downloaded data in appeal procedures, etc. ( ...)
Appendix 4: CISO Advice on the deployment of Proctorio (…)
For now, the CISO is of the opinion that, in view of the great interests for being able to take the exam and the expectation that Proctorio will have a clear perspective for action by mid-May to mitigate the current risks, it will provisionally give positive advice for the use of Proctorio. (…)
2.9
On 11 May 2020, the Executive Board made a formal decision to use online proctoring with Proctorio as a testing option, during the Covid-19 crisis, for exams where no suitable alternative to proctoring can be found. The decision states that new decision-making is required for the use of online proctoring in other situations that do not fall under the Covid-19 measures.
2.10
In a letter dated 18 May 2020, the Executive Board responded to the unsolicited advice from CSR (mentioned above under 2.7). That letter includes the following:
(…) First of all, we understand very well that you are concerned about the privacy of students when using online proctoring. The Executive Board shares this concern and has therefore paid a lot of attention to privacy issues. The UvA sees online proctoring as a tool that should only be used if there is no good alternative.
Before making a decision on proctoring, the UvA focused on privacy issues in particular. For example, it has been established that the data will only be accessible to authorized UvA staff. The images are encrypted and are stored on servers located in the EU. After thirty days everything is automatically deleted. It has also been established that the images will never be used for anything other than detecting possible fraud. The solution meets GDPR requirements and the Data Protection Officer has given a positive advice. (…)
2.11
In a letter dated 29 May 2020, FSR also made known its objections to online proctoring to the Executive Board.
2.12
The Student Manual Online Proctored Exams (version 4 June 2020) includes the following.
(…) What is online proctoring?
Online proctoring means remote invigilation (surveillance) of an exam that you take in an online assessment platform. (…)
The UvA will make use of Proctorio (…) for online proctoring. Proctorio works through a plugin tool in Google Chrome. This plugin allows us to record you while you take the exam, and analyze the results. The results are analyzed automatically, and if any irregularity is detected a real person will assess the recorded material.(…)
recording
● During the exam, your webcam, microphone, web traffic, screen, mouse- and keyboard activity are continuously monitored.
● Additionally, you might be asked to show your room, to check whether you have a clean desk and you are alone.
Browser lock down
● The plugin can ask you to close all web browser windows before starting the exam and prevent you from opening new browser windows and tabs.
● The plugin will detect second screens and will prevent you from taking the exam in case you have a second screen attached.
● Additional lock-down options which might be turned on for your exam are, amongst others, disabling clipboard functionality, disabling right-mouse clicks and disabling printing functionality.
Verification
● The system will execute a check to make sure the webcam, microphone and screen recording are working as supposed.
● Also, you will be asked to scan your UvA student ID card at the beginning of the exam.
(…)
● The UvA understands that it might feel strange to be recorded during an exam. We understand that we are asking a lot when we ask you to show your room, and may see the files you have on your computer. We provide tips on how to minimize the intrusion into your private space elsewhere in this document.
● The most important reason to choose online proctoring as an alternative, is to minimize study delay for as many students as possible. The UvA has made sure that the footage of the exams can only be viewed by authorized employees. The only purpose to watch the recordings is to check for fraud. After the checks have been completed, all recordings will be deleted automatically after 30 days.
(…)
What about my privacy?
We understand online proctoring is an invasion of your privacy. We are mindful of this, but have decided to use online proctoring nonetheless. Our main reason is to make sure that exams for which it is hard or impossible to find an alternative form of examination (due to the number of students or the nature of the knowledge and/or skills to be examined) do not cause study delay for large groups of students.
The UvA has a Privacy Statement that describes which data are processed, recorded and stored by Proctorio. It describes how Proctorio handles the data, which rules and regulations apply. (…) Proctorio uses end-to-end zero knowledge encryption, which means they store that data in such a way that they cannot unencrypt and access it themselves, only authorized UvA staff can access the data. (…)
How am I monitored by the proctoring system?
Proctorio records your screen, webcam, audio, keystrokes and some information about your computer system to determine whether
● you are looking away from the screen a lot,
● you leave the area visible via the webcam,
● unpermitted sound can be heard,
● you are using a phone,
● you are opening unpermitted browser tabs or programs,
● you are typing much more or less than fellow students, and
● other people appear on screen. (…)
2.13
The Higher Education and Scientific Research Act (WHW) states, among other things, the following.
(…) Article 7.13 Education and Examination Regulations
1. The board of the institution establishes teaching and examination regulations for each degree program or group of degree programs offered by the institution. (…)
2. In the Education and Examination Regulations (…) the applicable procedures and rights and obligations are laid down with regard to education and examinations. This includes at least: (…)
l. whether the interim examinations are taken orally, in writing or in another way. (…)
2.14
The FEB's education and examination regulations include the following.
(…) Article 4.2 Form of examination (…)
6. The procedure for assessment and the guidelines and instructions for assessing and determining the results of interim and final examinations are described in the 'Rules and Guidelines of the Examination Board' pursuant to Article 7.12b of the WHW.
(…)
Appendix I: Rules and Guidelines Examination Board 2019-2020
The Rules and Guidelines of the Examination Board are not part of the Education and Examination Regulations, but are supplementary. According to the law (Article 7.12b paragraph 3 WHW), the content of these Rules and Guidelines falls under the exclusive competence of the Examination Board. The Faculty Student Council (FSR), Program Committees (OC) and the Works Council (OR) have no right of advice or consent to these provisions. (…)
Article 4.5 – Digital tests
If an exam is taken digitally, an alternative facility is available such that in the event of a (technical) malfunction, the relevant exam can still be taken that same day. (…)
Article 4.7 – Order during examinations
1. The examiner must ensure that a sufficient number of invigilators are appointed for a written examination, who will ensure that the examination runs smoothly. Students must be supervised by an invigilator during the entire examination. (…)
3 Review
The dispute
3.1.1 In the first instance, CSR cs have applied, in short, to prohibit the UvA from conducting examinations using Proctorio as long as the required consent of the CSR and/or FSR is lacking and the lawfulness of the data processing has not been established. with ancillary claims, all on pain of forfeiture of a penalty and with the UvA being ordered to pay the legal costs. UvA has filed a defence.
3.1.2 The preliminary relief judge rejected CSR et al.'s claim. The preliminary relief judge has ruled that CSR et al. are admissible in their claim. After all, there is no other legal remedy open to them with sufficient safeguards by which the requested injunction can be achieved. However, there is no right of consent with regard to the online surveillance decision. The associated data processing is based on Article 6(1)(e) of the GDPR. This data processing also complies with the due care requirements set by the GDPR. There is therefore no ground for granting the claim, according to the preliminary relief judge.
3.1.3 CSR et al. have reformulated their claim on appeal and are now claiming, succinctly stated:
-prohibit Uva from administering online exams via the web browser, unless the consent of CSR and/or FSR and/or permission has been obtained from the user;
and/or
- prohibit the UvA from using the Proctorio program, unless the consent of CSR and/or FSR and/or the user's consent has been obtained;
and/or
- prohibit the UvA from using the personal data of [applicant sub 3] obtained through the Proctorio program as long as no permission has been obtained from him,
where consent always has the meaning that the AVG assigns to it, and where facial recognition, eye movement registration or a room scan may never take place,
all on pain of forfeiture of a penalty.
3.1.4 The UvA argues that the amendment of CSR et al.'s requirement is inadmissible because they are now demanding a ban on all exams that are taken online via web browsers, thereby raising a completely new point of dispute that was not discussed in the first instance. The court is of the opinion that the amendment of the claim is permissible and will therefore rule on the amended claim. Insofar as there is already an entirely new point in dispute, CSR et al. have raised this in a timely manner, after all in the summons on appeal. Moreover, the claim as it has now been supplemented is in line with the claim in the first instance.
3.1.5 CSR et al. argue in ground 2 in appeal in principle that the requirements of the Constitution, the ECHR and the AVG have not been met with regard to data processing. With ground 3 they argue that they, at least CSR and FSR, did have a right of consent with regard to the decision of 11 May 2020, and with ground 4 that that decision was too little defined. In brief, UvA argues in its incidental complaints that CSR et al. cannot be received in their claim. CSR et al.'s appeal will first be discussed. This appeal by CSR et al. fails on the basis of the following.
No consent right
3.2.1 CSR et al argue that the preliminary relief judge erroneously deduced from the Rules and Guidelines of the Examination Board of the FEB that they do not have a right of consent. The FEB's Education and Examination Regulations leave it up to the study guide about how examinations are taken, while Article 7.13, paragraph 2, under 1 of the WHW prescribes that this is laid down in those regulations. With the sub-delegation to the study guide and/or to the aforementioned Rules and Guidelines, the UvA deprives them of their right of consent, according to CSR et al. UvA disputes this.
3.2.2 The court considers as follows. In their introductory summons, CSR et al. refer to Article 9.38 preamble and sub b of the WHW as the basis for their right of consent. In that article, the Faculty Council is granted a right of consent when establishing or changing the Education and Examination Regulations. In any event, there is no question of an adoption or amendment of that regulation in a formal sense. The UvA has also rightly pointed out that although Article 7.13 paragraph 2 under l of the WHW prescribes that the Education and Examination Regulations stipulate whether the examinations are taken orally, in writing or in another way, but also that the Examination Board has the power in special cases. to be determined otherwise. The restrictions imposed by the government due to the Covid-19 pandemic can be regarded as a special case in the opinion of the court. This means that the Examination Board is authorized to take special measures and that no changes to the examination regulations are necessary, as advocated by CSR et al. It is also reasonable to equate an online exam with a 'normal' written exam, in which, albeit in a different form, surveillance is also possible under the current regulations and moreover customary. For this reason, it is also not obvious that a change to the examination regulations is necessary for the use of online surveillance. This means that for the time being the Court of Appeal is of the opinion that the examination regulations have not been changed or needed to be changed from a material point of view, and that therefore CSR and/or FSR did not have a right of consent with regard to the introduction of online surveillance.
Deployment of Proctorio complies with GDPR
3.3.1 CSR et al further argue that the use of Proctorio's software for online examinations does not meet the requirements of the GDPR. According to them, there is no need to deploy surveillance software, more personal data is processed than necessary for the given purpose, there are sufficient alternatives, there is a lack of transparency and security, and special personal data are processed without grounds. According to the UvA, the requirements of the GDPR are met. The Court of Appeal shares the UvA's position on the basis of the following.
3.3.2 It is not in dispute that Proctorio's software is used to perform a task in the exercise of public authority entrusted to the UvA, as referred to in Article 5(1)(e) of the GDPR. However, it is in dispute whether the data processing that takes place through the use of Proctorio is necessary for the fulfillment of that task. The UvA argues that, in view of the Covid-19 measures, students and staff must stay at home and that it is therefore necessary to use other forms of examination than the usual forms, otherwise students will be delayed. No alternative forms of testing such as open book exams, essays or oral exams are possible for courses that focus on knowledge reproduction. Fighting fraud in online exams is necessary to guarantee fair and reliable examinations and thus the value of diplomas. After all, fraud can take place on a large scale, for example by sharing answers in WhatsApp groups and the like, according to the UvA. In the opinion of the Court of Appeal, the UvA has sufficiently demonstrated with this argument that the provision of online exams and the use of surveillance software is necessary to fulfill its task. This is not affected by the fact that the relevant examinations are only part of the diplomas to be obtained, as CSR et al. argue. Nor is it sufficiently significant that the type of examinations (knowledge reproduction) are of minor importance. After all, CSR et al. have not argued in this regard that testing knowledge can be completely dispensed with when obtaining the diplomas.
3.3.3 The UvA has described the data processing when using Proctorio as follows. When starting the exam platform via the web browser of the student's computer, the surveillance software is automatically activated. The software asks to activate the microphone and the webcam and to share the screen. The software then asks to show the student card and to make a desk scan, i.e. images of the environment/desk in the direction of the student. During the exam, image, sound and browser data are registered and stored encrypted on servers in Amsterdam and Munich. After completing the exam, the invigilator, in this case UvA personnel who have been authorized and who have signed a confidentiality agreement, can see the student cards as well as a score for deviant behavior for each student. This deviant behavior can consist of looking away a lot, which can indicate cheating or texting with fellow students, or a lot of ambient noise, which can indicate calling or consulting with those present. After the exam, the invigilator can perform a random sample of the desk scans. In the event of significantly deviating behaviour, the invigilator can consult the recorded data. In case of suspicion of fraud, the invigilator prepares a report for the Examination Board. The data is kept for thirty days so that during the marking of the exams - the marking period is usually fifteen days - suspicions of fraud, for example many similar answers, can still be checked. The data will only be kept for longer if fraud is suspected, until action has been taken against that fraud and any legal proceedings have been completed.
3.3.4 According to CSR et al., the collection and processing of the data goes beyond what is necessary for the purpose, and that collection and processing is therefore contrary to the principles of purpose limitation and data minimization. They point out that it is less invasive to only occasionally record images and sound or to partially blur the image. Even then, students would change their behavior. However, CSR et al. overlook the fact that in this way it is possible to establish with less certainty afterwards whether fraud has actually taken place. The limitation of the data to be collected, as advocated by CSR et al., therefore stands in the way of an effective fight against exam fraud. CSR et al also argue that it is not clear whether the recordings stop between the trial exam and the actual exam or even after the exam has ended. However, CSR et al. have not provided concrete indications that the recordings will take place on or after these times, so that the Court of Appeal disregards their position. CSR et al also state that the registration of eye movements and facial recognition may be involved. They also believe that behavioral control takes place. According to the UvA, it is only automatically determined whether (the degree of) deviant behavior may indicate fraud. A visual check always follows after the automated determination of this. In the opinion of the Court of Appeal, it in no way follows from this course of events that the purpose of collecting or processing the data has been exceeded. The automatic processing is only aimed at detecting possible fraud and does not go beyond that, while the visual check afterwards requires the collection and storage for a limited period of all image, sound and screen data. The mere possibility that the collected data also enables other processing, such as facial recognition or more far-reaching eye tracking, than is necessary for combating fraud, does not mean that target is exceeded. No concrete indications have been given by CSR et al. that these processing operations actually take place, so that it cannot be assumed. There are also no indications that the complete images or other data without concrete indications of fraud are still viewed by invigilators, as CSR et al. suggest. The mere possibility of doing so is also not sufficient for establishing a target being exceeded. It has also not become plausible that the data will be kept longer than is necessary for the purpose. As the UvA argues, indications of fraud can still arise during the marking of the exams, so that there is still a need for visual checks of the data during that period. The fact that lecturers can also fulfill the role of (digital) invigilator - the UvA disputes that this is the case - does not mean that the target has been exceeded either. There has been no evidence of abuse of that role.
3.3.5 CSR et al., in connection with exceeding the target, also argue that the students must perform 360 degree room scans and that this is too drastic and unnecessary. According to the UvA, after room scans were initially prescribed, now only a so-called desk scan is required. CSR et al. submitted a screenshot with their deed submitting (rebuttal) evidence from which, according to them, it appears that a room scan was still requested during an exam on 29 September 2020. The UvA, on the other hand, has submitted manuals from which it appears that only a desk scan is required. Although communication from the UvA is not always clear on this point, the Court of Appeal assumes that only a desk scan is required to be allowed to participate in the examinations. CSR et al. have only provided evidence of one incidental case where a full room scan was requested. Such an incident is insufficient to assume an existing obligation to make a full room scan when answering the question whether a ban on the deployment of Proctorio is justified.
3.3.6 CSR et al. have also argued that sufficient alternatives are available for online surveillance with Proctorio that are less drastic. They mention other surveillance software but do not specify what the benefits would be. They also point to a code of honor that would be used at the University of Groningen, to binding the exams to a strict time, working with alternative questions or differences in the order of questions, replacing multiple choice questions with open questions with a plagiarism test, and live monitoring of all students using software such as Zoom. However, CSR et al. have not made it concrete in this way that there is a workable and sufficiently fraud-resistant alternative for every type of examination, which would make the use of Proctorio completely unnecessary. Nor have CSR et al. given concrete examples of exams where an alternative is available and the UvA has nevertheless opted for the application of Proctorio.
3.3.7 Another complaint from CSR et al is that the UvA has not provided insight into how Proctorio is used. In the course of time, the UvA has put different versions of the 'student manual' on its website and this manual is missing a lot, according to CSR cs CSR cs do complain about the different versions of the manual, and about the fact that according to them the preliminary relief judge allegedly 'googled' the manual after the hearing, but they have not disputed that the version of the manual quoted by the preliminary relief judge in the contested judgment can be used, which quote has been reproduced in this judgment. This manual discusses in detail the use of Proctorio and the consequences this has for the student. Partly in that light, CSR et al. have not explained sufficiently concretely which information that would be important for the student is still missing in the manual. The fact that the UvA should provide full insight into the way in which a suspicion of fraud is detected is not obvious from the point of view of effective fraud prevention.
3.3.8 CSR et al. have also failed to demonstrate sufficiently that others than the invigilators deployed by the UvA, such as Proctorio itself or American intelligence services, can consult the retained data. They have not disputed that this data is stored encrypted and that it is kept within the European Union. It must therefore be assumed that the data is sufficiently protected against illegal use. Furthermore, CSR et al. have not demonstrated that the UvA, Proctorio or the Serbian helpdesk of Proctorio receives or processes student metadata other than necessary for the technical operation of the internet connection or the use of the software.
3.3.9 CSR et al also point out technical problems that could arise during online examinations. In their last act they cite concrete examples of online exams that could not take place at the scheduled times due to failing technology. The UvA must of course take into account the possibility of technical problems and must take appropriate measures to prevent them and, where appropriate, must offer a reasonable solution for taking an interim examination. However, the mere chance of technical problems is insufficient to achieve a general ban on online examinations.
3.3.10 The fact that the use of Proctorio means that students are not allowed to use the toilet during the exam is a nuisance, but necessary in the context of combating fraud. The UvA notes that toilet use is not permitted during exams on location. This limitation cannot therefore be taken into account when assessing whether online proctoring should be prohibited.
3.3.10 CSR et al. finally argue that the images contain special personal data within the meaning of Article 9 of the GDPR because those images, partly because of the student card to be shown, can be used to identify persons according to race or religion. Therefore, consent (as referred to in Article 4(11) GDPR) must be requested from the data subjects for the processing of those images, which has been omitted. However, images of an identifiable person cannot simply be regarded as special personal data concerning, for example, race or religion. In this case, it is unlikely that the acquisition of the visual material will focus on these types of personal characteristics, while it is also unlikely that a distinction will be made on the basis of this material based on these types of personal characteristics. The mere possibility, which CSR et al. suggest, that a teacher or invigilator will allow himself to be influenced by the appearance of a student is insufficient for this.
3.3.11 The foregoing, also viewed in conjunction with each other, does not lead to the conclusion that any provision of the GDPR is violated when deploying Proctorio.
Deployment of Proctorio complies with Article 8 ECHR
3.4.1 CSR et al. also argue on appeal as the basis of their claim that the requirements of Article 8 ECHR have not been met. It is not in dispute that the use of Proctorio infringes the right to private life guaranteed in paragraph 1 of this article. The question is whether the conditions for committing an infringement formulated in paragraph 2 of this article have been met. The court concludes that those conditions are met on the basis of the following.
3.4.2 The WHW instructs the UvA to offer and examine degree programs. As part of this, article 9 paragraph 1 of the WHW gives the board of the UvA the authority to adopt teaching and examination regulations. In addition, the examination method is regulated and, moreover, as previously considered, the Examination Board is authorized in special cases to organize the examinations in a different way. This means that the examination and the power to regulate the way in which this is done is provided for by law. It can be deduced from the facts and circumstances that have already been discussed above in the context of the assessment against the GDPR and that have been regarded as plausible, that the infringement is necessary in a democratic society, partly in connection with the Covid-19 measures. progress of (also economically relevant) higher education. On the basis of those facts and circumstances, the infringement can also be considered proportionate.
3.4.3 CSR et al also argue that the requirements of Articles 10 to 13 of the Constitution (concerning the right to protection of privacy, the inviolability of the body, the right of residence or the secrecy of correspondence) have not been met. . However, they have not explained in concrete terms what an assessment of these fundamental rights and the possibility of restrictions on them would add to the above.
Completion
3.5.1 In their fourth and final ground of appeal, CSR et al. argue that the decision of the UvA Board of 11 May 2020 is insufficiently defined and limited, so that it cannot be upheld. According to that decision, the deployment of Proctorio is possible during the Covid-19 crisis, while this should concern the period in which it is not possible to take exams in UvA buildings. After all, Covid-19 could well be permanently present in society, according to CSR et al.
3.5.2 In these proceedings, the issue is whether there is sufficient reason to grant the injunction claimed by CSR et al. by way of provisional injunction. That was not the case at the time of the delivery of the contested judgment, and that is still not the case today. After all, the closure of the universities as of March 15, 2020 was still in full force at the time of the judgment. There is now some easing of the measures, but mass visits to university buildings for examinations are still out of the question. The need for the special method of examination was and still is. The mere circumstance that the text of the Decree can be interpreted broadly does not change that. If the need for online examinations is no longer required, a completely different debate will arise than is currently being held.
3.5.3 Insofar as CSR et al. have intended to demand that all online examinations be banned, there are also no sufficient grounds for this. The mere fact that the UvA has access to the IP address of students through online exams is not sufficient for this. It has not been shown that UvA uses this IP address other than out of technical necessity. The fact that students have to use a specific web browser for the online exam is also insufficient for this. In this regard, CSR et al. have also not requested that the use of other web browsers be made possible.
3.5.4 All in all, the conclusion is that there are insufficient grounds for granting the claim. The appeal of CSR et al. fails.
3.5.5 The failure of the appeal on the part of CSR et al means that the UvA has no interest in discussing the appeal on its part. After all, that only serves to obtain a decision in which CSR et al.'s claim is declared inadmissible, which decision would not serve the interests of the UvA better than with a confirmation of the rejection of CSR et al.'s claim.
3.5.6 The conclusion is that the grievances fail on appeal in principle and that the UvA therefore no longer has an interest in discussing its incidental grievances. The verdict from which appeal will be affirmed. As the unsuccessful parties, CSR et al. will be ordered to pay the costs of the appeal in principle. A cost order in the cross-appeal will not be made in the absence of necessity for that appeal.
4 Decision
The court:
confirms the verdict from which appeal;
orders CSR et al. jointly and severally to pay the costs of the appeal proceedings, estimated to date on the part of the UvA at €760 in disbursements and €2,228 for salary, and €163 for nasalaris, plus €85 for nasalaris and the costs of the writ of service if this judgment is served, to be increased by the statutory interest if the costs order has not been paid within fourteen days after this judgment or the subsequent costs become due;
declares the order for costs to be immediately enforceable.
This judgment was given by mrs. D. Kingma, E. M. Polak and H. Struik and pronounced in public by the role councilor on 1 June 2021.
