Reykjavík University – Complaint Upheld (Iceland, 2022)

A student filed a complaint with the Icelandic DPA (Persónuvernd) against Reykjavík University regarding the online monitoring of an examination which was taken at home on Zoom due to the COVID19 pandemic. The student claimed that it had been forced to consent to the online monitoring, and that their objection to the monitoring had not been taken into account, that they had not received sufficient information regarding the processing and security of their personal data in this context (including if other students could record the session), and that it was possible that personal data related to their spouse’s remote health care consultation could have been filtered into the audio recordings. The university, in their defense, stated that they had a legitimate interest to monitor the examination in order to ensure its integrity, and that the student had been given the option to take the exam in person, but that this option was declined. The University also clarified that the option for attendees to record the session was disables, and that audio-recordings only took place during the beginning of the session during the attendance roll call, and that afterwards during the actual exam, only video recordings were made, and students were told to turn off their microphones. The Icelandic DPA dismissed the student’s claim regarding the alleged forced consent to the online monitoring of the exam and the disregard for their objection, confirming that the student had indeed been given the option of taking the examination in person at the campus. Furthermore, it explained that in any case, consent could not be a valid legal basis for this processing, since it could not be freely given in this context due to the nature of the relationship between the University and the student. However, it confirmed the university’s position with regard to its legitimate interest in monitoring the examination, and hence held that the processing was lawful under Article 6(1)(f) GDPR. Regarding the student’s claim related to the potential exposure of their spouse’s medical data within the recordings, the DPA held that the complaint did not include a power of attorney from the student's spouse, and therefore only claims related to the student’s own personal data would be considered. Additionally, the DPA noted that in any case, due to the fact that audio recordings only took place during the roll call at the beginning of the Zoom session, and not throughout the examination itself, it was unlikely that their spouse’s medical data were captured in the recordings. As to the security of the personal data, the DPA held that the university had implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk in the processing under Article 32 GDPR. The DPA took into account, inter alia, that a GDPR compliant processing agreement existed for the hosting of Zoom calls (which included restricted access to system administrators with strong passwords), that meeting data streams were encrypted, that the option for other attendees to record sessions was disabled, that recordings were deleted after 30 days, and that access to these recordings were only available to the heads of departments on the grounds of a reasonable suspicion that cheating occurred in an examination. However, the DPA found that the university had not fulfilled its responsibility to properly inform the students subjected to the online monitoring as to the legal basis, purposes, security measures, and the student's data protection rights related to this processing. Therefore, the DPA held that this processing was unlawful under Article 5(1)(a) GDPR since it was not carried out in a transparent form, without providing the students the information required under Article 13 GDPR. Therefore, it issued a reprimand against the university on this point, and ordered them to adequately comply with this obligation in the future.