DPA case Deliberação/2021/622 – Complaint Upheld (Portugal, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Portuguese Data Protection Authority upheld a complaint against applications used for online student evaluations that monitored students excessively. This case raises concerns about privacy in educational technology.
What happened
A complaint was upheld regarding the use of monitoring applications that collected extensive personal data from students.
Who was affected
Students who were subjected to monitoring by the applications during online evaluations.
What the authority found
The authority found that the applications violated privacy rules by not adequately protecting student data.
Why this matters
This case highlights the need for educational institutions to carefully consider privacy when using technology for assessments. It serves as a reminder to balance security and student rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Portuguese DPA (CNPD) received a complaint against the use of two applications ("Respondus Lockdown Browser" and "Respondus Monitor"), that were meant to be used for online evaluations to students. Those applications were used by an unknown party (allegedly an educational institution) and developed by Respondus Inc., an American company. Respondus and the controller had carried out a data processing agreement, that was part of the licensing contract. Both applications could be integrated with learning platforms. "Respondus Lockdown Browser" is used to block the computer of the students, so they could not access any other application, while "Respondus Monitor" is used to monitor them. Blocking the computer means that the students could not access any other application nor use any of the functions of the computer. Only the application was shown full-screen. "Respondus Monitor", a proctoring application, used the camera and video analysis techniques in order to monitor students. It also took photos of the students, including themselves and their IDs, and images of the surroundings. It also had a facial detection check system. Monitoring is carried out every second through three vectors: *facial, movement and light detection of the student and their surroundings *obtaining information from the device (keyboard activity, mouse activity, hardware modifications) to identify patterns * analysis of the students' interaction with the exam, including time counting and answer changing, as well as comparing answers between students Even if the application records video, sound recording is deactivated by default, although can be activated by the institution. Videos are processed afterwards and put through a facial recognition and detection system to determine if the student stayed in the same place and whether there were other persons around, to detect if the same person started and ended the exam. The application also monitored all the information from the device, includin
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Deliberação/2021/622 in PT
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
11 May 2021
Authority
Commission Nationale pour la Protection des Données
GDPRhub ID
gdprhub-3659About this data
Cite as: Cookie Fines. DPA case Deliberação/2021/622 - Portugal (2021). Retrieved from cookiefines.eu
Last updated: