May 2, 2024
|
5 min read
Who Is Liable When Proctoring Goes Wrong? Lessons From Global Legislation and Cases
Courts and regulators across Canada, the EU, and the United States have consistently found that organizations deploying proctoring tools bear liability for how participant data is handled, not the software vendors they use. CASL, GDPR, BIPA, and the Cleveland State Fourth Amendment case all point to the same conclusion: the organization collecting data is the accountable party. This post examines each case and framework and explains what organizations need to do to reduce their exposure.
When a proctoring tool violates a participant's privacy, who is responsible? The software vendor? The organization that deployed it? Both?
Recent legislation and court decisions from Canada, the UK, and the United States have answered this question with increasing clarity: the liability rests with the organization running the testing, not the software provider. For anyone deploying online proctoring, this is not an abstract legal point. It is a direct operational risk.
The Core Issue
Organizations that deliver online training and testing have a legitimate need to confirm who is taking their assessments and that participants are engaging in good faith. Meeting that need often requires collecting sensitive personal data: ID images, biometric verification, session recordings, and audio. The question of who bears legal responsibility for how that data is handled has been answered by courts and regulators in ways that most organizations have not fully reckoned with.
The consistent finding across multiple jurisdictions is that the data-collecting organization, not the software vendor, is the accountable party.
CASL: The Canadian Perspective
Canada's Anti-Spam Legislation was created in 2014 to reinforce best practices in electronic communications and combat spam and related cyber threats. Among its provisions, CASL requires organizations to obtain consent and written acknowledgement before using invasive computer programs, and to provide users with assistance in removing such programs afterwards.
Under CASL, software is considered invasive if it interferes with the user's control of their computer system by opening programs, printing, or accessing files without their knowledge, or if it changes system settings, preferences, or commands without their knowledge.
Online proctoring tools that block restricted sites, monitor web use, require camera access, or install browser extensions clearly fall within this definition. And most proctoring plugins do not provide uninstall assistance, remaining active by design after the session ends to reduce support overhead for the vendor.
The risk for organizations: CASL violations carry regulatory penalties of up to $10 million per violation. If your proctoring system leaves you liable to CASL noncompliance, that exposure belongs to you, not your vendor.
GDPR: The Global Standard That Places Liability on the Data Owner
The EU's General Data Protection Regulation has established a universal standard for data privacy that reaches any organization handling the personal data of EU residents, regardless of where that organization is based.
Under GDPR, the organization running the testing is the data controller, while the proctoring tool is the data processor. Fines for inappropriate collection, storage, transfer, or deletion of personal data fall on the data controller, not the data processor.
Ireland's Data Protection Commission made this distinction explicit in a judgment against Slane Credit Union Limited, stating that processors cannot be used by controllers as a legislative safety net, and that it is essential that due diligence is carried out to ensure the protection of personal data.
GDPR fines can reach 20 million euros or 4% of a company's total worldwide annual revenue, whichever is higher. The liability for how a proctoring vendor handles learner data belongs to the organization that chose to deploy it.
BIPA: The Illinois Warning
American organizations are increasingly coming under regulatory scrutiny for proctoring practices. Illinois' Biometric Information Privacy Act is one of the most consequential examples.
BIPA places liability on organizations when biometric data is collected or used in a way that violates participant privacy, including failing to secure written consent and failing to publish a retention schedule outlining when data will be permanently destroyed.
Two landmark cases illustrate how serious this exposure can be.
BNSF Railway Co. was subject to a $228 million jury verdict for scanning the fingerprints of truck drivers without consent. The case was eventually settled for $75 million. The third-party vendor that provided the scanning technology was not implicated in the charges.
White Castle System Inc. faced a separate BIPA lawsuit in which the Illinois Supreme Court ruled that claims accrue with each individual finger scan, exposing the restaurant chain to a potential liability in the billions of dollars. White Castle ultimately settled for approximately $10 million. Again, the vendor supplying the technology was not the party held accountable.
The pattern across both cases is consistent: the organization that deployed the biometric technology bore the liability. The software vendor did not.
Cleveland State: A Fourth Amendment Violation
In 2022, a federal court found that Cleveland State University's remote testing requirement of a room scan constituted unreasonable search and seizure in violation of students' Fourth Amendment rights.
Cleveland State used two separate proctoring providers to facilitate these scans. Both were named in the decision. Neither was fined. The university bore the consequences.
This case illustrates two important points. First, the room scan requirement itself was the violation, regardless of which vendor implemented it. Second, choosing a proctoring tool that conducts room scans does not transfer the legal risk to the vendor. The organization that required the scan is the one that faces the consequences when that requirement is found to violate participant rights.
What This Means for Online Training and Testing Providers
These cases are not outliers. They reflect a consistent and accelerating trend in privacy legislation globally: organizations are responsible for the actions of any third-party software, plugins, or services they deploy. Vendor liability does not substitute for organizational accountability.
For organizations delivering online training and testing, this has direct implications for vendor selection. The question is not just whether a proctoring tool works. The question is whether deploying it creates liability for your organization under CASL, GDPR, BIPA, or other applicable legislation.
The steps that reduce that liability are straightforward: choose a vendor with documented privacy practices, confirm that data handling complies with the legislation applicable to your jurisdiction and your learners' jurisdictions, require clear data deletion timelines, and ensure that any software deployed on learner devices complies with consent and removal requirements.
How Integrity Advocate Approaches This
Integrity Advocate is designed to reduce the compliance exposure that comes with deploying a proctoring tool, not to add to it.
No installation is required in most cases, which eliminates CASL's invasive software provisions entirely for the majority of deployments. Data is collected only for its stated purpose and deleted by default within 24 hours of session completion. Consent is obtained before any data collection begins. Data is stored in GDPR-designated jurisdictions. Room scans are optional rather than mandatory, and can be enabled or disabled based on the organization's assessment of their necessity and proportionality.
These are not policy commitments. They are architectural decisions built into how the platform works.
{{post-cta}}
Keep reading
Is Your Proctoring Solution a Security and Privacy Threat?
August 27, 2023
|
5 min read
The US Department of Education's Privacy Technical Assistance Center has documented how data breaches and malware attacks have affected education systems across every sector. Most online proctoring services require browser extensions or plugins that create exactly the kind of installation-based malware vector that security researchers flag as high risk. This post examines the threat, what organizations should require from their proctoring vendors, and why a no-installation approach eliminates the risk at the source.
The US Department of Education's Privacy Technical Assistance Center published a presentation titled Security Threats: Education Systems in the Crosshairs, in which security advisor Mike Tassey documented how data breaches, hacks, and privacy incidents have affected organizations across virtually every sector, from NASA and Citigroup to local school systems.
The warning is directly relevant to any organization using online proctoring. The data that proctoring services collect, including names, government-issued ID, biometric images, and session recordings, is exactly the kind of information that makes education systems a target.
The Threat Landscape Has Changed
Cyber-theft has become fully commoditized. There is an active black market for personal data, and an underground economy where over two million pieces of malware are built and sold every year. This malware is designed to gather precisely the kind of information proctoring platforms collect: Social Security numbers, addresses, birth dates, and identity credentials.
Tassey specifically noted that children's identities are particularly valued by data thieves because they are, in his words, fresh. A child's identity may go undetected for years before the theft is discovered, making it a high-value target for long-term fraud.
The alarming part is how malware typically gets onto devices. It is not usually through pirated software or poor security settings. It enters through plugins and browser extensions that users install themselves, often for legitimate purposes. The installation is the vector.
Why Proctoring Plugins Create Specific Risk
Most online proctoring services require users to install browser extensions or plugins to enable monitoring. Each of these installations represents an opportunity for malware to enter the device, either during the initial installation or through a subsequent update, without the user's knowledge or permission.
Tassey's research notes that on average there are one to five bugs for every 1,000 lines of code. For organizations that have not completed independent code reviews of the proctoring software they deploy, those bugs represent an unexamined attack surface. Malware can be introduced into code updates without detection, meaning a plugin that was clean at installation may not remain so.
At minimum, organizations should be instructing learners to disable or uninstall proctoring plugins and extensions immediately after use. The risk does not end when the exam does.
What a Code Review Should Cover
Organizations that require learners to install proctoring software should conduct, or require their vendor to provide evidence of, a code review that addresses:
- Potential malware embedded in the plugin or extension code
- Errors or vulnerabilities that could be exploited by third parties
- Whether the software receives automatic updates, and what review process governs those updates
- What data the software transmits, to where, and under what conditions
If a vendor cannot provide clear answers to these questions, the software should not be deployed on learner devices.
The Case for No-Installation Proctoring
The most effective way to eliminate installation-based security risk is to remove the installation requirement entirely. Integrity Advocate's platform is browser-based and requires no plugin, extension, or application installation in most cases. There is nothing to install, nothing running in the background after the session ends, and no update mechanism that could introduce malware without the user's knowledge.
For use cases that do require a lockdown browser, Integrity Advocate's solution uses fully open source code, does not accept automatic updates after installation, and does not transmit data beyond what is required for the session. The code is publicly available for inspection.
The US Department of Education's guidance on protecting student privacy points to the same principle: the safest data handling approach minimizes what is collected, minimizes how long it is retained, and minimizes the software footprint on learner devices.
{{post-cta}}
Can Claims of GDPR Compliance by Proctoring Companies Be Trusted?
September 20, 2023
|
5 min read
Many proctoring companies claim GDPR compliance, but those claims are largely self-reported and rest on frameworks that have already been legally challenged. The EU-US Privacy Shield was invalidated in 2020, and its replacement relies on self-certification that does not resolve the underlying conflict between the US Patriot Act and GDPR's prohibition on non-consensual data disclosure. This post examines why US-based data storage creates a structural GDPR problem, what the DPF self-certification actually involves, and why Integrity Advocate's Canadian infrastructure and Privacy by Design architecture represent a substantively different approach.
Many online proctoring companies claim GDPR compliance. It is worth asking what that claim actually means, and whether it can be verified.
The short answer is that GDPR compliance claims are largely self-reported. There is no mandatory third-party verification process that a company must pass before making the claim. For organizations choosing a proctoring vendor on the basis of GDPR compliance, this creates a significant due diligence gap.
The US Patriot Act Problem
Many proctoring companies are registered in the United States or store data within US jurisdiction. This creates a direct conflict with GDPR that no privacy policy can resolve.
Data protection laws across the EU prohibit the disclosure of personal data without a data subject's consent or knowledge. The US Patriot Act gives the US government the ability to compel data disclosure from US-based companies or companies storing data on US infrastructure, without that consent and without notifying the individual.
A proctoring company that stores learner data on US servers and claims GDPR compliance is operating under two conflicting legal obligations. When those obligations conflict, US law governs US-based companies. The GDPR claim does not change that.
The Privacy Shield Failure
Many US-based organizations attempted to address this conflict by certifying under the EU-US Privacy Shield program, which was designed to provide a legal mechanism for transatlantic data transfers that satisfied GDPR requirements.
On July 16, 2020, Europe's top court invalidated the EU-US Privacy Shield, finding that the transfer mechanism did not ensure compliance with the level of protection required by EU law. The certification that many companies had pointed to as evidence of GDPR compliance was rendered invalid overnight.
The EU-US Data Privacy Framework: A Replacement With Familiar Weaknesses
Following the 2020 decision, negotiations between the EU and the US produced a new framework. On July 13, 2023, the US Department of Commerce launched the Data Privacy Framework program, intended to allow eligible US companies to self-certify their participation in the EU-US Data Privacy Framework.
The mechanism for self-certification is a short questionnaire and a fee to the US International Trade Administration, ranging from $375 to $4,875 USD depending on the company's revenue.
Critics have already noted that the new framework faces the same fundamental shortcomings as its Privacy Shield predecessor, including the unresolved tension between US surveillance law and EU privacy rights. Self-certification through a paid questionnaire does not resolve the underlying Patriot Act conflict.
What Meaningful GDPR Compliance Actually Requires
For a proctoring vendor's GDPR compliance claim to be substantive rather than self-reported, it needs to rest on something more than a certification program that can be obtained by filling out a form and paying a fee.
The most reliable indicator is where the data actually lives. If learner data is stored outside US jurisdiction, on infrastructure not subject to US government compelled disclosure, the conflict between the Patriot Act and GDPR does not arise.
Integrity Advocate's GDPR compliance is grounded in the same Privacy by Design architecture that underpins GDPR itself. All data is hosted in GDPR-designated jurisdictions, out of reach of governments with compelled data access authority. Integrity Advocate collects only what is necessary to confirm a learner's identity and compliance with exam rules, most of which is automatically deleted within 24 hours of session completion.
This is not a self-certification. It is an architectural position.
Questions to Ask Your Proctoring Vendor
Before accepting a GDPR compliance claim at face value, organizations should be able to answer the following:
- Where is learner data physically stored, and in which legal jurisdiction?
- Is the vendor registered in the United States or storing data on US infrastructure?
- Is the GDPR compliance claim based on self-certification, third-party audit, or architectural design?
- Has the vendor's compliance been reviewed independently, or is it self-reported?
- What happens to learner data if the vendor receives a government data request?
If the answers are not clearly documented, the GDPR compliance claim deserves further scrutiny.
{{post-cta}}
Is Your Online Proctoring Platform BIPA Compliant? What Illinois Organizations Need to Know
January 1, 2020
|
5 min read
BIPA sets strict standards for how organizations must collect, store, and use biometric data in Illinois, and online proctoring platforms fall squarely within its scope. This guide breaks down what BIPA requires, where proctoring platforms create compliance risk, and how Integrity Advocate is designed to support your obligations, from informed consent and data deletion to zero commercial use of biometric data.
If your organization uses online proctoring and operates in Illinois, or serves Illinois residents, the Biometric Information Privacy Act applies to you. And unlike most privacy legislation, BIPA has teeth. Private individuals can sue directly, without needing to prove actual harm, and statutory damages start at $1,000 per negligent violation and $5,000 per intentional one.
This is not a checkbox compliance exercise. It is a legal and reputational risk that organizations need to address before they deploy any technology that touches biometric data.
This guide explains what BIPA requires, how it applies to online proctoring specifically, and how Integrity Advocate is built to support your organization's compliance obligations.
What Is BIPA?
The Biometric Information Privacy Act is an Illinois state law that establishes standards for how companies must collect, store, use, and disclose biometric information. It was enacted in 2008 and remains one of the strictest biometric privacy laws in the United States.
BIPA covers any information based on an individual's biometric identifiers, including:
- Retina and iris scans
- Fingerprints
- Voiceprints
- Face geometry and facial recognition data
- Hand geometry
For online proctoring, the most relevant category is facial geometry. Any platform that uses facial recognition or AI-based facial monitoring to verify identity or flag behavior is collecting biometric data under BIPA's definition.
What BIPA Requires
BIPA places four core obligations on organizations that collect biometric data:
1. Written Policy and Retention Schedule
Organizations must have a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric data. Data must not be retained beyond the purpose for which it was collected, or beyond three years, whichever comes first.
2. Informed Written Consent
Before collecting biometric data, organizations must inform individuals in writing that biometric data is being collected, state the specific purpose and length of time for which it will be used, and obtain a written release. Consent cannot be buried in general terms and conditions.
3. No Commercial Benefit from Biometric Data
Organizations are prohibited from selling, leasing, trading, or otherwise profiting from an individual's biometric data. This applies to vendors and service providers as well.
4. Data Security Standards
Biometric data must be stored, transmitted, and protected using the same standard of care as other sensitive and confidential information, and in a manner consistent with the reasonable standard of care within the organization's industry.
Why Online Proctoring Is a BIPA Risk Area
Most online proctoring platforms collect biometric data as a core function. Facial recognition for identity verification, AI monitoring of facial expressions and eye movement, and behavioral biometric analysis all fall within BIPA's scope when delivered to Illinois residents.
The risk isn't hypothetical. Courts have consistently ruled that BIPA applies broadly, and class action litigation against organizations using biometric technology without proper consent frameworks has resulted in significant settlements.
The question isn't whether your proctoring platform uses biometric data. It almost certainly does. The question is whether it handles that data in a way that protects your organization.
How Integrity Advocate Supports BIPA Compliance
Integrity Advocate's identity verification and proctoring services are designed with biometric privacy obligations in mind.
Informed consent is built into the process. Test takers are informed of what data is collected, why it is collected, and how it will be used before any session begins. Consent is obtained as a documented step in the onboarding process, not assumed through general terms.
Data is not sold or used for commercial benefit. Integrity Advocate does not sell, lease, or repurpose biometric or session data for any secondary use. Data collected during a proctoring session is used solely for the purpose of that assessment.
Sensitive data is deleted promptly. Facial images and identity verification data are deleted within 24 hours of session completion, unless retention is required for a specific dispute resolution purpose. This supports compliance with BIPA's retention requirements.
Security standards are robust. Integrity Advocate uses 256-bit encryption in transit and at rest, stores data on AWS infrastructure in Montreal by default, and has maintained zero data breaches across 12+ years of operation.
Human review replaces over-reliance on facial AI. Rather than making automated decisions based on facial monitoring alone, every flagged session is reviewed by a trained person before any outcome is recorded. This reduces the risk of inaccurate findings and limits the extent to which facial geometry data drives decisions.
BIPA Is Part of a Broader Privacy Picture
BIPA is one of several privacy frameworks that organizations using online proctoring need to consider. Depending on where your test takers are located, GDPR, PIPEDA, FERPA, and other state-level legislation may also apply. Integrity Advocate is built to operate across jurisdictions, with privacy-first architecture that supports compliance across multiple frameworks simultaneously.
The Risk of Getting This Wrong
BIPA litigation is active and growing. Organizations that collect biometric data without proper consent frameworks, retain it beyond its purpose, or work with vendors who repurpose it commercially are exposed. Statutory damages per violation, multiplied across a class of test takers, add up quickly.
Choosing a proctoring partner that takes biometric privacy seriously is not just a compliance decision. It is a risk management decision.
{{post-cta}}
Frequently asked questions
Find answers to the most commonly asked questions from our clients.
In most jurisdictions, the organization deploying the proctoring tool is considered the data controller and bears primary liability for how participant data is collected, stored, and handled. The software vendor is typically considered the data processor. Courts and regulators in Canada, the EU, and the United States have consistently found that organizations cannot use third-party vendors as a liability shield.
Canada's Anti-Spam Legislation requires organizations to obtain consent before deploying invasive computer programs and to provide assistance in removing them afterwards. Online proctoring tools that monitor web use, require camera access, block restricted sites, or install browser extensions meet CASL's definition of invasive software. Organizations that deploy non-compliant proctoring tools face penalties of up to $10 million per violation.
Two cases illustrate the scale of BIPA exposure. BNSF Railway Co. received a $228 million jury verdict for collecting truck driver fingerprints without consent, later settled for $75 million. White Castle System Inc. faced potential liability in the billions after the Illinois Supreme Court ruled that BIPA claims accrue with each individual finger scan, ultimately settling for approximately $10 million. In both cases, the third-party vendors supplying the biometric technology were not implicated. The organizations that deployed it bore the consequences. For testing organizations collecting biometric data from participants, the liability structure is identical.
Under GDPR, the organization running the testing is the data controller and bears primary liability for how personal data is handled. The proctoring tool is the data processor. Ireland's Data Protection Commission has explicitly stated that processors cannot be used by controllers as a legislative safety net. GDPR fines of up to 20 million euros or 4% of global annual revenue fall on the data controller.