It is legal to process students' personal data in digital tools when necessary in order to conduct teaching and examination. Whether personal data processing is necessary must be determined in each individual case. Generally, however, students' personal data should be processed in similar ways as in normal teaching situations.
The judgement must be based on these premises:
- If necessary, the University may broadcast students and lecturers live in teaching situations if the purpose is to conduct teaching.
- If necessary, the University may record teaching if the recording is used as a basis for education.
- If necessary, the University may broadcast an examination or an obligatory course component live.
- If necessary, the University may record an examination or an obligatory course component if the purpose of the recording is to form basis for examination.
- Nevertheless, the University may not record students if the purpose of the recording is to form basis for assessment of the use of unauthorised aids or if other misleading conduct has taken place during the examination.
Please consider that a recording is considered a public record if it is stored at the University and is regarded as submitted here or established here. When a student hands in a public record to their lecturer for assessment, it is then regarded as "submitted to the authority or due public official". The same applies if lectures or examinations are recorded. These recordings are considered submitted or established records, according to the freedom of the press act, and are hence regarded as public records that can be accessed by members of the public.
What about personal data processing when teaching remotely?
Generally, the same principles must apply for personal data processing when teaching remotely as in regular teaching. Personal data processing must be a premise to conduct teaching or be used for the teaching itself.
Processing of lecturers' personal data in teaching situations
Processing of lecturers' personal data when teaching remotely takes place with legal support as this is regarded as the employee's assignment according to the employment agreement. This is regardless if teaching is streamed live or recorded.
For students who wish to record a teaching session, the Rules for recording, photography and filming of teaching situations (only in Swedish)apply also to online teaching. This rule states, in brief, that no recording or photography is allowed by students in teaching situations, but that the lecturer has the right to agree on exceptions to this rule. The lecturer should ensure that all other participating students can ask questions and interact in the education in such a way that their personal data is not processed by the recording student, for instance by allowing anonymous questions. If this is not possible, no recordings by any student can be allowed by the teaching lecturer.
Processing of students' personal data
The University processes students' personal data in teaching situations on the legal basis of public interest combined with the requirements in the Higher Education Act that universities must conduct teaching. The University cannot use consent as legal basis for processing personal data in teaching situations since consent in these circumstances is not based on free will as students are regarded to be in a state of dependence on the University. The Swedish Data Protection Authority's approach is that consent cannot be used if another legal basis exists (such as public interest), which prohibits the University from processing students' personal data based on consent.
If the purpose of the processing is for education – regardless of the processing takes place through live broadcasting or recording – and the processing constitutes a premise for implementing teaching, the processing is hence allowed.
It is legal to broadcast a lecture or other educational session live for those who would otherwise have participated in person. In addition, the personal data processing that takes place through students participating with audio and video in such a live broadcasted teaching component is also legal. The above is based on the legal basis of public interest together with the requirement in the Higher Education Act that universities are to conduct teaching.
If there are teaching components in which recordings normally take place as a part of education, this can also take place in online teaching. For instance, this could be a situation in which a recording forms the basis for students' own reflection or for discussions with other students or lecturers. The contents of the recording are hence regarded as a part of the teaching. Before recording, please remind your students to place themselves in a neutral place in their homes to reduce any encroachments into their privacy. Any recordings must be stored and deleted in accordance with the applicable document management plan.
It is important to inform students that personal data processing takes place through the digital connection (refer to umu.se/gdpr) and remember to inform them if anything is stored. It is also appropriate to provide students with an opportunity to ask questions outside of the lecture (this is particularly important if the lecture is recorded). Sensitive personal data or confidential information must not be shared or be entered into Zoom, Skype or Teams.
What needs to be considered for remote examination?
Generally, the same attitude is to be implemented regarding personal data processing when examination takes place remotely as with regular forms of examination. If the purpose of a recording is to form basis for examination or documentation of an obligatory course component, a recording is allowed. If students at a normal written examination are expected to identify themselves and be supervised by an invigilator, this identification may also take place remotely. If, however, the purpose of the recording is to form basis for assessing if misleading conduct has taken place, a recording is not allowed.
When students are being assessed, the University processes the students' personal data based on the legal basis of public interest. Since examination is considered an exercise of official authority, the legal basis of vital interests or consent from students do not apply in examinations.
Broadcasting examinations and obligatory course components live
To identify and supervise students using web cameras can, in certain cases, be allowed if it is regarded as necessary, but it cannot take place if the form of examination does not usually require identification using an ID card or similar (e.g. unsupervised examinations or home exams).
In digital forms of examination, it may be necessary to both identify and supervise the student during an ongoing exam. It is important to inform students that personal data processing takes place through the digital connection (refer to umu.se/gdpr) and inform them that nothing is stored. Please be advised that it is not legal to record an examination that is streamed live even if this is possible, neither by the University nor by one of the participating students.
Public interest acts as a legal basis providing the University with the right to process students' personal data when the University requires that students identify themselves by showing an ID. Nevertheless, a requirement to show identification must not take place if the form of examination does not normally require identification using an ID (e.g. unsupervised examinations such as home exams). If identification during a digital examination is to take place by showing an identification, this involves a risk of the participants seeing other participants' personal identity number. Identification using an ID must hence take place in such a way that other participants cannot see the personal identity number or other unique data. Instead, identification can take place using name lists with photographs, for instance.
Surveillance of an examination in Zoom, for instance, can be organised in an equivalent way to a written examination without the need to record a student. This means that the lecturer or other invigilator supervises the students' written examination in real time through the digital connection. The number of people supervising the examination may need to be adapted to the individual situation, not least given the technical limitations with breakout rooms, for instance. The university must be regarded to have legal support for this type of supervision in the Higher Education Act and the General Data Protection Regulation with reference to public interest.
Recording examinations and obligatory course components
Recording students in their homes is regarded as such an encroachment on their privacy that explicit support in the law is required for the university, as an authority, to have such a right. Since there is no such legal support for recording students in situations of examination in the purpose of preventing or form basis for assessing if cheating or other misleading conduct has taken place, it is the interpretation of the data protection officer that such a recording, even online, goes against the General Data Protection Regulation.
Oral examinations and obligatory course components premise that they have the characteristics of assessing an individual. This means that they may need to be documented in a suitable way. If a recording is intended to gather necessary documentation to form the basis for examination or assessment of the obligatory course component, the recording is allowed. This could be a situation in which a recording forms the basis for students' own reflection or for discussions with other students or lecturers, which is also allowed.
In corresponding cases, a recording of students during an oral examination or other obligatory course component remotely is also allowed. Before recording, please remind your students to place themselves in a neutral place in their homes to reduce encroachments into their privacy.
Any recordings must be stored and deleted in accordance with the applicable document management plan.