Students will no longer face facial recognition during online tests. The Spanish Data Protection Agency (AEPD) has published a resolution in which it analyses the use of automatic facial recognition technologies to prevent fraud in online assessments. Its conclusion is that, as biometric data are a special category of data and, therefore, may only be processed in exceptional cases in which the risk of manipulating such sensitive data is justified, universities are not legitimised to do so.

The Agency does not rule out the possibility that facial recognition may be done in the future, but for that, it will be necessary to develop specific regulations that determine “in which cases, conditions and under what guarantees this biometric processing may be carried out.”

The resolution originates from a complaint lodged with the AEPD against the Valencian International University (UIV) due to the imposition of a remote examination facial recognition monitoring system.

“This system involved, mandatorily and without valid alternatives for the students, the use of biometric facial recognition technologies and double camera (360 monitoring) with the declared purpose of preventing fraud and impersonation in online academic assessments. The software used a facial recognition system through artificial intelligence (AI) by which images were captured and analysed in real time to continuously verify the identity of the students during the examinations,” states the Agency.

Biometric data analysis might curb personal freedom

The UIV system used continuous verification based on biometric data (facial patterns generated and deleted every few seconds). It also included monitoring of the examinee’s desktop (screenshot capture, programme detection, connected peripherals, etc.), as well as monitoring of the student’s surroundings through a second camera, with which the presence of other persons or unauthorised objects was analysed using AI.

The UIV claimed that the facial recognition data processed “were pseudonymised and deleted rapidly.” Nonetheless, the University itself admitted that the processing entailed a very high risk of impact on the rights and freedoms of the persons affected.

This is the latest example of a conflict between the two basic principles of privacy and security, as the proliferation of facial recognition technology brings the inherent conflict into focus.

Rise and fall of facial recognition during exams

Examination surveillance systems using facial recognition became fashionable during the pandemic. Many universities, especially American and Asian ones, opted for these methods to continue with the academic year. Spain was not immune to this trend. The International University of La Rioja was one of the first to jump on the bandwagon, and the AEPD already issued a warning in 2021 specifying that “the need to process personal data by these means is not justified” and urged the institution to adopt “corrective measures aimed at preventing the planned processing from constituting a possible breach of data protection legislation.”

The published resolution follows that line of argumentation, the same that has led other institutions, such as the National University of Distance Education (UNED), to discard the use of these technologies.

“When planning non-presential solutions for exams, UNED should always be guided by the precautionary principle,” the University argued.