Reykjavík University – Complaint Upheld (Iceland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Reykjavík University was found to have legally monitored online exams during the COVID-19 pandemic. A student complained about forced consent and privacy issues, but the Icelandic DPA confirmed the university's actions were lawful. This case shows that universities can rely on legitimate interests to monitor exams, provided they offer alternatives.
What happened
A student complained about online exam monitoring, but the Icelandic DPA upheld the university's actions as lawful.
Who was affected
Students taking online exams monitored by Reykjavík University.
What the authority found
The Icelandic DPA found the university's monitoring lawful under GDPR's legitimate interest basis, as students had the option to take exams in person.
Why this matters
This decision highlights that educational institutions can monitor online exams under legitimate interests, especially when alternative options are provided. It emphasizes the importance of transparency and offering choices to students.
GDPR Articles Cited
A student filed a complaint with the Icelandic DPA (Persónuvernd) against Reykjavík University regarding the online monitoring of an examination which was taken at home on Zoom due to the COVID19 pandemic. The student claimed that it had been forced to consent to the online monitoring, and that their objection to the monitoring had not been taken into account, that they had not received sufficient information regarding the processing and security of their personal data in this context (including if other students could record the session), and that it was possible that personal data related to their spouse’s remote health care consultation could have been filtered into the audio recordings. The university, in their defense, stated that they had a legitimate interest to monitor the examination in order to ensure its integrity, and that the student had been given the option to take the exam in person, but that this option was declined. The University also clarified that the option for attendees to record the session was disables, and that audio-recordings only took place during the beginning of the session during the attendance roll call, and that afterwards during the actual exam, only video recordings were made, and students were told to turn off their microphones. The Icelandic DPA dismissed the student’s claim regarding the alleged forced consent to the online monitoring of the exam and the disregard for their objection, confirming that the student had indeed been given the option of taking the examination in person at the campus. Furthermore, it explained that in any case, consent could not be a valid legal basis for this processing, since it could not be freely given in this context due to the nature of the relationship between the University and the student. However, it confirmed the university’s position with regard to its legitimate interest in monitoring the examination, and hence held that the processing was lawful under Article 6(1)(f) GDPR. Regarding th
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Reykjavík University in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Reykjavík University - Iceland (2022). Retrieved from cookiefines.eu
Last updated: