Court case 200.280.852/01 – Court Ruling (Netherlands, 2021)

The case concerns a civil dispute between the plaintiffs Central Student Council (CSR) at the University of Amsterdam ('UvA'), the Student Council at the Faculty of Economics and Business (FSR) of the UvA, and an individual student against the defendant, the UvA. The outbreak of Covid19 caused the Dutch government to close the universities on 16 March 2020. Due to the closure, it was not possible for the UvA to hold exams on site. After some research and testing, the UvA decided to use an online proctoring tool, essentially a monitoring software called Proctorio. This software allows the university to monitor student behaviour at home while they are taking the exam to see if the student is attempting to cheat on the exam. Proctorio is installed as a browser plugin. It continuously records the test taker's webcam, microphone, and screen. In addition, the software monitors the student's behaviour to detect unusual behaviour, such as if the student often looks away from the screen, or if there is ambient noise in the room that might indicate that someone else is in the same room with the student, or if the student types more or less than other test takers. The software also monitors the computer's internet traffic, the presence of secondary monitors. The plaintiffs took the university to court by filing a motion for a preliminary injunction with the District Court of Amsterdam. The district court ruled in favour of UVA, finding that the government's COVID-19 measures did not allow for suitable alternatives and that the surveillance had a legal basis in Article 6(1)(e) GDPR. The plaintiffs appealed to the Court of Appeals Amsterdam Court, seeking an ordinary ruling (not a preliminary injunction). Before rolling out the software in a real-world scenario, the UvA conducted three simulated tests in April 2020. In the meantime, the UvA asked its own DPO (Data Protection Officer) for advice and received a positive response. The UvA then conducted a DPIA (Data Protection Impact Assessment) to identify data protection risks and find mitigation measures. The CSR sent a letter to the UvA's Executive Board, which was described in the judgement as "unsolicited advice". In this letter, the CSR strongly opposed the use of proctoring, recommended against the use of room scanning, and recommended that the UvA provide students who cannot/would not use proctoring with alternative means of taking exams without delaying their studies. The UvA's Executive Board decided on 11 May 2020 that online proctoring would be used for exams during the Covid19 pandemic if there were no suitable alternatives. The use of online proctoring in non-pandemic situations would require a new decision by the board.