Data Protection and Student Records

General orientation, not legal advice. Requirements differ substantially by jurisdiction and change; take advice on your own position. The data map should treat employee activity tracking as a useful comparison: employee activity tracking and student proctoring both require purpose limitation, role-based access and defined deletion.

Proctoring involves systematic monitoring of individuals in their homes at scale, which in most regimes places it toward the higher end of regulatory attention.

The basis for processing

Consent is generally unsuitable for the reasons in its own note: it cannot be freely given where refusal costs the qualification.

Institutions usually rely on public task, legitimate interests or contractual necessity, depending on jurisdiction and institutional type.

Whichever is chosen must be documented before deployment, and the documentation should address why the measure is necessary rather than merely useful.

The impact assessment

Most regimes require a formal assessment for systematic monitoring of this kind.

It should be done before procurement rather than after, because its findings may change the specification.

And it should be a real analysis: what is collected, why each element is necessary, what less intrusive alternatives were considered and why they were rejected.

An assessment that concludes the chosen product is fine, written after the contract, is a record of a decision rather than an assessment.

Necessity, element by element

Ask of each capture: is this necessary for the stated purpose.

Room scan — necessary, or is a desk view sufficient?

Audio — necessary, or is video sufficient?

Biometric matching — necessary, or is a human document check sufficient?

Screen recording — necessary, or is lockdown sufficient?

Institutions that do this exercise usually switch several things off, which improves both compliance and student experience.

Transparency

Students must be told what happens, in terms they can understand, before it happens.

A privacy notice buried in terms of service does not meet this in most readings.

The plain-language page described in the notice note is the practical form of the obligation.

Rights that apply

Access: a student can request their recording.

Rectification and erasure, subject to the institution's retention basis.

Objection, where legitimate interests is the basis, which requires a considered response rather than a refusal.

And rights around automated decisions, which the automated flagging note covers and which are directly engaged if no human reviews before a case.

The supplier relationship

The supplier is a processor and the institution is usually the controller, which means the institution answers for what the supplier does.

Contract terms matter: subprocessors, transfers, security, deletion, audit rights.

And the institution should know where the data is and who at the supplier can reach it.

Incidents

A breach involving video of students' homes is a serious incident with short notification deadlines in most regimes.

Know the deadline, know who declares, and know how you would identify affected individuals.

Rehearse it once.

What to check

What is your lawful basis, and is it written down?

Was an impact assessment done before procurement?

Has anybody tested each captured element against necessity?

And could you respond to a student's access request for their own recording within the statutory period?

The point

Test each captured element against necessity separately: room scan, audio, biometrics, screen recording.

Institutions that do this exercise usually switch several things off, which improves compliance and student experience at once.

Worth stating

Ask of each capture whether it is necessary for the stated purpose, and document why less intrusive alternatives were rejected.

A privacy notice buried in terms of service does not meet the transparency obligation in most readings.

Also worth knowing

The supplier is a processor and the institution usually the controller, which means the institution answers for what the supplier does.

Contract terms on subprocessors, transfers, security, deletion and audit rights are the practical expression of that.

And finally

Know the breach notification deadline, who declares, and how you would identify affected individuals.

A breach involving video of students' homes is a serious incident with short deadlines in most regimes.

Summary

Test each captured element against necessity separately. Institutions that do this usually switch several things off and improve both compliance and student experience.

In summary

Systematic monitoring of individuals in their homes sits toward the higher end of regulatory attention in most regimes.

The impact assessment belongs before procurement, because its findings may change the specification. For wider institutional context, consult the World Wide Web Consortium.