Supervising online exams

... and other privacy issues at WUR

Photo: Anne Reinke

Think privacy is something that doesn’t concern you? For some WUR staff, it is highly relevant. They have had to deal with privacy issues mainly because of their job but sometimes because they inadvertently shared sensitive information. A story about keeping tabs on students doing online exams, an app that can track staff around the clock and a mistake with OneDrive.

Exams are increasingly being taken online because of Covid measures. To prevent fraud, the university records the view of the student’s room when the student does the exam. That has prompted quite a few questions from students about privacy. How does this ‘online proctoring’ work and what privacy aspects are involved?

A lot of exams have gone online since the first lockdown started in March. To enable invigilation in these circumstances, WUR uses an ‘online proctoring’ service. This involved the invigilation software supplier making some 28,500 video recordings in the past few months of students doing their exams. Video checkers then went through those recordings to spot unusual behaviour or objects, for example a student sending text messages, or books lying around.

WUR was familiar with this exam procedure as it was already being used for invigilating international MSc students. But now it was being applied on a much bigger scale for a much wider group of students, explains Tim van Loon, privacy officer for Education & Student Affairs (ESA), among others. Tim’s job is to make sure the online proctoring complies with privacy legislation.


Of the 28,500 recordings made of students at home in the past few months, 1500 situations were tagged as ‘suspicious’. WUR was able to ascertain fraud in 10 cases. In a further 64 cases, WUR issued an official warning: there was suspicion of fraud but it could not be proven.

Tim van Loon is not the only person who has to deal with urgent privacy issues. Read about the experiences of the following WUR employees:

Lecturer Jana Verboom shared her OneDrive with her students by mistake

‘In theory, my students had access to grade lists and thesis assessments’

Adviser Bas Bongers was involved in the introduction of an app that tracks scientists at work in the field

‘The data is only used in emergency situations’

Project manager Eric de Kluijver has taken action to make the labs GDPR-proof

‘Farmers’ name and address details are sacred for us’


The online proctoring industry has yet to reach maturity. The online proctoring system used by Erasmus University in Rotterdam had glitches and in early September, the Erasmus School of Law declared 99 exam assessments invalid because filming had not continued throughout the exam. Fifteen students had their degrees withdrawn.

How does online proctoring operate in practice?

Tim: “Before the online exam, the candidate has to walk around the room with their laptop so we can check there aren’t any crib sheets hanging on the wall or other people in the room. Video and audio recordings are made of that tour of the room and of the exam itself. That means WUR is looking inside students’ private rooms. People started asking questions, as you can imagine. Who sees the recordings? How long are they kept for? Are those recordings only used for invigilation?

These questions raised by students are only logical. We advise candidates to move anything they don’t want to be seen out of view. In the FAQs on online proctoring on the Internet, we also explain that we only use the recordings for detecting fraud and that the recordings are deleted after a set period (the retention period). In other words, the recordings can’t be used for other purposes or kept for longer than is strictly necessary.”

Video recordings are made of the exams, which lets WUR look inside students’ private rooms

Who assesses those recordings?

“You can track down cases of fraud by looking at keystrokes, open windows and the length of time a window is open, measured using the webcam. An invigilator can assess whether the situation deviates from the exam regulations. WUR deliberately chose to use human invigilators rather than artificial intelligence, for example. The invigilator goes through the images afterwards and checks the recordings purely for forbidden objects or actions during the exam, for example using a smartphone when you are not supposed to, sending text messages, books that aren’t allowed, having websites open or using a second laptop or a crib sheet. So the invigilator checks whether fraud-related activities might have taken place. I say ‘might have’ with good reason because the next step is for the examiner and eventually the Examining Board to determine whether fraud actually occurred. If a candidate doesn’t agree with that decision, they can appeal against it.”

Photo: Anne Reinke

Photo: Anne Reinke

What does the online proctoring mean for your work as a privacy officer?

“The past six months have been hectic. We have been working with the digital exams team at ESA to see what the implications were of this large-scale proctoring. We had no choice but to use online proctoring as it wouldn’t have been possible to organize alternatives quickly enough for examining the students. As a privacy officer, I focused on safeguarding privacy, making sure the privacy agreements with the supplier were tightened up, drawing up a privacy statement, adding to the FAQs and answering students’ questions.”

We are always asking ourselves what risks students run and what risks WUR runs. What measures can we take to protect data and privacy to the maximum extent? How can we stay within the law? The privacy legislation, the General Data Protection Regulation (GDPR), sets out a lot of rules but there are still many grey areas where we have to weigh up whether the use of a particular instrument is legitimate and proportionate. The role of the privacy officer is to check that daily practice complies with the privacy laws such as the GDPR and to promote this approach.”