Università Commerciale “Luigi Bocconi” di Milano – €200,000 Fine (Italy, 2021)

A student at the 'Luigi Bocconi' Commercial University of Milan filed a complaint to the Italian DPA (Garante) regarding possible violations of the GDPR by the academic institution. They alleged that it unlawfully requested students' consent to the processing of special categories of personal data. If they refused, students would not be able to carry out online exams. In response to a 'request for clarification' about this processing by the complainant, the university's DPO informed them it considered this processing to be necessary to carry out exams at a distance given the COVID-19 pandemic. The Italian DPA considered a range of issues in this case. First, it assessed the general conditions of lawfulness of the processing of personal data in the university environment. It held the same data protection framework applies to public and private universities. Consequently, the processing of student data aimed at issuing university qualifications could not be based on legal bases such as consent and/or contract, and the data controller was required to comply with general principles of data protection per Article 5 GDPR. It also had to guarantee and be able to demonstrate that the processing was carried out in accordance with the GDPR, and in particular take into account the principle of data protection by design and default per Article 25 GDPR. Second, the DPA considered whether the university could generally process of student data through the 'Respondus' software it used to monitor students during their exams. The software "captures the video images and the student's screen by identifying and marking with a flag the moments in which unusual and/or suspicious behaviour is detected by video recording and snapshots taken at random intervals to keep track of anomalous behaviour such as: look not turned towards the monitor, face partially absent from the photo, missing face". It then flags such behaviour for further review. The Garante held the use of such software by universities was generally acceptable in light of the COVID-19 pandemic requiring exams to be carried out remotely, but that they must ensure compliance with principles of data protection. It highlighted possible risks related to the processing of special categories of data, profiling, and international data transfers. Third, the DPA analysed whether the university complied with its transparency obligations per Articles 5(1)(a), 12 and 13 GDPR. It held all the information required by the GDPR had not been provided. The university only provided "generic information" about the processing without specific reference to the 'Respondus' software, no information about the retention of relevant data, no information about possible data transfers to the US (where the company providing the software was based), and no explanation of the logic involved in the profiling done by the software. Fourth, the DPA assessed on which legal basis the university could have based the processing of students' biometric data. The university claimed to have obtained students' consent for the processing of data through the 'Respondus' system. The DPA nonetheless held this was neither an allowable legal basis nor a "manifestation of free will" per Article 4(1)(11) GDPR given the power imbalance between students and the university (if they did not 'consent', they could not pass their exams). The processing could have only been lawful if it was "necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject" (Article 9(2)(g) GDPR), which it was not. Fifth, the DPA held that the university failed to take account of the specific risks arising from the profiling of students by the software, which took the form of different coloured flags they were tagged under depending on their movements during exams, in violation of Articles 5(1)(a) and 6 GDPR. This profiling should have been "clearly represented to the interested parties" and "necessary for the performance of a task in the public interest" per Article 6(1)(e) GDPR. Sixth, the DPA held the university failed to "adopt appropriate technical and organizational measures to implement the principles of data protection (Article 5 GDPR), such as the principles of minimization and limitation of conservation referred to in Articles. 5(1)(c) and (e) GDPR and integrating into the processing the necessary guarantees to meet the requirements of the Regulation and protect the rights and freedoms of the interested parties". Notably, it retained exam data for 5 years, which the DPA held to be disproportionate to ensure the regularity of exams. Seventh, the DPA held the university unlawfully transferred students' personal data to the US through the software, in violation of Articles 44 and 46 GDPR. This transfer was based on the Privacy Shield agreement which was struck down in 2020 by the CJEU in Schrems II. The DPA highlighted as particuarly concerning the fact that special categories of data, such as biometric data, were being transferred. Finally, the university failed to carry out proper data protection impact assessments in violation of Article 35 GDPR. Thus, the DPA fined the university a total of €200,000 for the violation of Articles. 5(1)(a), (c) and (e), 6, 9, 13, 25, 35, 44 and 46 GDPR.