Online Exams Privacy

Griffith College privacy statement for learners undertaking examinations and assessments in 2021/22 in relation to Online Examinations and Online Proctoring.

Published on 7th January 2022.

Griffith College takes our responsibilities under applicable data protection law, including the General Data Protection Regulation and implementing legislation very seriously. The College is committed to protecting the privacy and security of your personal data.

The purpose of this notice is to inform you of the data relating to you that we may collect and use in connection with your studies, examinations and assessments while undertaking a programme with the College and the uses we may make of such data, including disclosures to third parties.

Griffith College is the controller of this personal data. If you have any questions about our use of your personal data, please contact us at [email protected].

For the purposes of addressing the necessary changes to our examination process during the COVID-19 pandemic and thereafter, Griffith College has decided to introduce Online Examinations.

The decision to use online proctoring has been taken after careful consideration of the need to allow learners to progress with their programme of study while at all times respecting and supporting the national strategy to address COVID-19.

As part of this initiative and to ensure the integrity of the examination process, we have also decided on the implementation of Online Proctoring to conduct invigilation of the learners while sitting exams remotely.

Our online examinations are currently delivered by two vendors, (i) BetterExaminations, who deliver the assessments online; and (ii) Proctorio, who provide an automated online invigilation system to ensure learners’ compliance with the Quality and Qualifications Ireland (QQI) award standards.

Griffith College remains as the party responsible for processing your personal data (the 'controller') within the meaning of the General Data Protection Regulation (‘GDPR’).

When taking an examination online, your data will be collected by the assessment delivery application (BetterExaminations) and by the online invigilation application (Proctorio).

By using the online examination platform (BetterExaminations) and the online proctoring tool (Proctorio) the following personal data will be processed:

a) name (first, initials and last name);
b) your learner number and exam number
c) your @student.griffith.ie email address;
d) your contact phone or mobile number
e) image of your student card; only in exceptional circumstances, e.g. where learner card is not available on the day, should alternative photo ID be used (passport or driving license)
f) picture (taken through the learners’ webcam);
g) video and audio recordings of the learner and his/her surroundings while taking the exam, recorded by the webcam of learners’ device;
h) on‐screen activities while making the exam;
i) keystrokes and mouse movements while making the exam;
j) the IP address of the computer network to which the device is connected;
k) your system information (browser, cpu, ram, internet connection)
l) any URLs viewed by you during our exams
m) learners’ answers to the exam questions.

The following data is collected to allow you (as the test taker/exam candidate) to log into the system and to confirm your identity (Category A):

  • Your name, learner number and exam number
  • Image of a valid identification document bearing your photograph, specifically your student card to minimise the personal data captured. Only in the case of this not being available on the day can you use alternative identification (namely, a valid driving licence, passport or Garda Identification (National Age Card)) (‘ID Document‘)
  • Video recordings of you (as the test taker/exam candidate) verifying your identity by showing the ID Document

In addition, the following data is collected to ensure that you (as the test taker/exam candidate) follow our Learner Regulations (Category B):

  • Video and audio recordings of you while taking our exams
  • Recordings of your on-screen activities during our exams
  • Flags indicating suspected non-conformance by you with our Learner Regulations
  • Your IP Address (last octet removed)
  • Your system information (browser, cpu, ram, internet connection)
  • Any URLs or other desktop documents opened and viewed by you during our exams

The following data is collected if, during the online examination, you require support for technical difficulties while using Proctorio services (Category C):

  • Your name and your @student.griffith.ie email address
  • Your contact phone or mobile number
  • Your IP Address (last octet removed)
  • Your system information (browser, cpu, ram, internet connection)
  • Content of your support request text.

The following data is collected in order to run the examinations: (Category D):

  • Your exam script(s)
  • Your exam grades
  • Any adjustments of your exams arising from reasonable accommodation as defined in the Learner Regulations
  • Your exam number

We will only use your personal data in the following circumstances:

  • Where we need to perform the contract we have entered into with you
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests

The table below describes the legal basis that applies to our purposes for processing your personal data. Depending on the circumstances, more than one legal basis may apply:

Purpose for processing

Categories of personal data

Legal basis for processing

Verify your identity as the test taker/exam candidate, to ensure compliance by you with our Learner Regulations, for any investigations and appeals and to contact and liaise with you in order to provide assistance during the online exams

A, B, C

Performance of a contract with you;

Necessary for our legitimate interests for running and maintaining our academic standards, performance of our examination function and ensuring compliance with our Learner Regulations.

To run online examinations and ensure that you (as the test taker/exam candidate) undertake the examinations in accordance with our Learner Regulations

D

Performance of a contract with you;

Necessary for our legitimate interests for running and maintaining our academic standards, performance of our examination function and ensuring compliance with our Learner Regulations

Personal data will only be used for the following purposes:

  • Authentication. After taking the exam it will be checked if the learner can be identified as the individual that partook in the exam session;
  • Fraud control:
    • Prior to the exam, Griffith College will define and communicate what will be specifically detected as fraudulent behaviour by the proctoring tool and how this behaviour will be treated;
    • After taking the exam, it will be checked that the learner complied with the applicable rules and did not use any unauthorised sources outside of the scope of the exam.
  • Time frame control. After taking the exam, it will be checked whether the learner has completed the exam within the applicable time frame.

We process your personal data on the basis of 'legitimate interest' (article 6.1 (f) GDPR), during the exceptional situation of COVID-19.

This means that the processing is necessary for the purposes of the legitimate interests pursued by Griffith College and that the learners’ rights and freedoms are adequately protected.

As Griffith College has decided to use online monitoring for remote exams, it is necessary that in conducting these it can:

  • verify the identity of the learner taking the exam;
  • establish that no fraud was committed while the exam was being carried out;
  • confirm that the exam was completed within the given time frame.

The personal data collected during a remote exam with online proctoring will be evaluated with the use of an automated system and will be viewed only by authorised employees of the Griffith College who, by virtue of their position as a lecturer or staff member have a role in the processing of your personal data for the above purposes and for whom it is necessary to have access to the personal data if non-conformance with Learner Regulations is suspected.

Proctorio does not have access to your data, since all data in the system has been encrypted using an unshared key stored with BetterExaminations and can only be unlocked by authorised users of Griffith College.

All examinations are marked by human markers who access exam scripts and mark the questions according to the marking standards.

The online invigilation system will flag activities that could indicate suspected non-conformance with Learner Regulations. Where an activity is flagged this is be reviewed manually by an authorised member of Griffith College staff.

Based on the above, we believe that we will not be making any decisions based solely on automatic processing. However, we will notify you in writing if there are any changes in this regard.

In the context of this Privacy Statement, your personal data will not be shared with any third parties other than BetterExaminations, Proctorio and their sub-processors, unless Griffith College is obliged to do so by law or a court order.

The agreements that Griffith College has made with BetterExaminations and Proctorio also apply to the (third) parties engaged by the two companies (sub-processors) to provide their services.

Any Categories A, C and D data is stored by BetterExaminations in Ireland.

Any Categories A and B data recorded by Proctorio during the examination are stored on Microsoft Azure in the Netherlands. Proctorio utilizes zero-knowledge encryption, which means they have zero access to the encrypted data on their own servers.  Zero‐knowledge technology is applied to scramble personal data during transfer and in storage with end‐to‐end protection of every piece of information that leaves a learners’ computer during an exam. This means that Proctorio does not know anything about the data stored in their servers.

This means that your personal data cannot be identified by Proctorio. This unique design allows nothing to leave your computer until after it is encrypted. Data never becomes unencrypted until it is unlocked by an authorised Griffith College staff member. It is not just end-to-end encryption, it is a zero-knowledge system.

Any Category C data recorded by Proctorio is stored in the Netherlands. Appropriate safeguards (namely standard contractual clauses under Article 46 of the GDPR) have been put in place to protect your personal data.

Our lecturers, exam markers and moderators will also have access to exam scripts for marking purposes.

No, your personal data will not be transferred to countries outside the European Union.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, and/or altered or disclosed. In addition, we limit access to your personal data to those staff members and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Your personal data will be stored in the Proctorio severs for six months and will be automatically deleted after this period of time. In case of any objection from the learners’ side, individual data (in formation in respect of PDF with suspicious behaviour) will be stored during the official period of handling the objection.

The retention period applicable to the exam papers stored within BetterExaminations servers is six months. Prior to BetterExaminations deleting all scripts and data from their systems, your script and relevant data will be downloaded by Griffith College will be retained by Griffith College for two years post your graduation, in line with our current examination retention policy document.

With regard to the personal data that Griffith College collects and processes for the purposes of authentication, fraud control and time frame control, the following procedure applies:

The review of the exam session is carried out as soon as possible after the exam has been completed.
If no identity fraud or exam fraud is suspected, the personal data that has been collected through the system provider Proctorio will be retained for six months  [A2] after administering the exam.
If there is suspicion of identity fraud or exam fraud, the personal data that has been collected through the system provider Proctorio will be retained for the period necessary to take a decision on the legitimacy of the result of an examination.

It is necessary to retain the personal data for clarifying the suspicion of fraud. Suspicion of fraud is based on whether the test taker violates any of the rules communicated concerning fraudulent behaviour during the exam.

Type of Data

Retention Period

Examination scripts

In line with the college’s records retention schedule, currently 2 years post-graduation.

Video and audio recordings of you taking our exam

Recordings of your on-screen activities during our exams

Flags indicating suspected non-conformance by you with our Learner Regulations

Your IP Address (last octet removed)

Your System Information (browser, cpu, ram, internet connection)

Any URLs viewed by you during the exams

Six months following the date of the examination or in the case where an investigation into non-conformance with the Learner Regulations is initiated, 1 month from the date that an appeal can be filed against the investigation’s findings or from the date of the decision of the appeal (whichever is the later)

Images of ID Document

Video recordings of you verifying your identity by showing the ID Document

Six months following the date of the examination or in the case where an investigation into non-conformance with the Learner Regulations is initiated, 1 month from the date that an appeal can be filed against the investigation’s findings or from the date of the decision of the appeal (whichever is the later)

Your name, learner number, exam number and exam grades

Any adjustments of your exams arising from Reasonable Accommodation

Indefinite by Griffith College

In summary, we will only retain your personal data for as long as necessary to fulfil the purposes we collected it for. The retention periods above will normally apply to the examination process. However, we may retain your personal data for a longer period in the event of a complaint, appeal or investigation where a breach of our Learner Regulations is suspected or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

On the basis of the current GDPR, you have the right ‐ subject to certain conditions ‐ to access the personal data that we process, to correct your personal data if it contains factual inaccuracies, to have your personal data deleted, to limit the processing of your personal data, and to object to the processing of your personal data.

If you wish to exercise any of these privacy rights, or you have any queries or complaints in connection with our processing of your personal data, you can contact us at [email protected]

You also have the right to lodge a complaint with the Irish Data Protection Commission if you are not happy with the way we have used your information or addressed your rights. Details of how to lodge a complaint can be found online.

We reserve the right to update this online examination privacy notice at any time and we will provide you with a new privacy notice update via Moodle when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.

If you have any questions about this privacy notice, please contact [email protected].