Uncategorized

Online Test Proctoring Raises Privacy Questions Among University Faculty, Students

By Samantha Cleaver

The University of California at Santa Barbara (UCSB) switched from in-person to online classes in March because of COVID-19.

Students were about to take quarterly final exams, and professors were given the option to use ProctorU, an online test-proctoring company.

The service was new to many faculty, Claudio Fogu, associate professor of Italian studies, told Digital Privacy News.

But Fogu and other faculty members read through ProctorU’s privacy policy and raised concerns about what data was collected, how it was used and whether students could opt out.

The privacy policy was “legitimate from a business perspective,” Fogu said, “but for us, the rules of a university have to be different.”

UCSB is not the only campus using online proctoring. An April survey by Educause of 312 organizations found that 54% of higher-education institutions were using online proctoring, while another 23% were considering it.

Among those surveyed, privacy was a chief concern for 51% of respondents. 

Companies that provide online proctoring — Examity, ProctorU, PSI Services, among others — have seen an increase in proctoring during COVID-19.

Examity, for example, has seen a 35% increase in test volume since the pandemic began, spokesman Ben Watsky told Digital Privacy News.

The quick change from in-person to online assessment has produced much anxiety, said Mollie McGill, senior director of operations and membership for the nonprofit Western Interstate Commission for Higher Education (WICHE) Cooperative for Educational Technologies.

“Students,” McGill said, “want to know, ‘Who’s watching me and what’s being done with all that data?’”

The rapid increase in the use of online proctoring has raised concerns related to the data that’s collected during test sessions and how the data is used once the test is over.

In particular, news reports about the experience have raised concerns about forcing students to choose between privacy and convenience.

The proctoring companies reached by Digital Privacy News discussed how they have responded to the concerns. 

“Students want to know, ‘Who’s watching me and what’s being done with all that data?’”

Mollie McGill, WICHE.

Online Proctoring 101

In education, online proctoring is provided three ways: live, real-time proctoring with someone who watches students take tests; automated proctoring that uses algorithms to analyze student behavior; and a method that records students taking tests and sends videos to proctors to analyze.

Online proctoring was on the rise before COVID-19 because it solved one problem for universities.

Utah State University (USU) used Proctorio, preCOVID-19, to support testing for students who could not come to campus to take exams.

The service provided flexibility for students and professors, said Chris Dayley, director of academic testing services, and added a convenient option for students who could take tests at home instead of at a testing center.

Many Similarities

Online proctoring, said Scott Foote, Examity’s chief information security officer, is not that different than in-person proctoring.

The proctor must verify the test taker, ensure they are taking the exam in an appropriate environment, watch for possible cheating and follow the rules of that particular test.

The difference between in-person and online test taking, Foote said, is that the authentication is more upfront online.

While a professor may not explicitly ask for student IDs, the same monitoring procedures are in place, he said.

Collecting Data

When Wendy Parker Smith, an MBA in healthcare management student at the online Western Governors University, took her financial management test earlier this month, she logged in to Examity.

She showed her ID to the proctor, who also checked Smith’s calculator, and asked for a 360 view of her desk. Once Smith removed a box of tissues, the test began.

“WGU works with Examity,” Smith told Digital Privacy News, “so I didn’t have a problem with it.”

The data that is collected before testing, an ID and credit-card processing by a third-party vendor, “is a very superficial level of privacy information,” said Foote. “What we collect is barely enough to authenticate the end user.”

During testing, a live proctor monitors the keyboard, screen and student to ensure no behaviors occur that could constitute cheating.

Companies can collect biometric data — facial recognition, typing patterns, mouse movement analytics — to help identify students as they take the test.

The firms also use questions that incorporate public-data records to help identify students throughout the test, said Mark Musacchio, senior vice president of education services with PSI Services.

If the student’s identification is not verified at any point — for example, if the facial recognition changes and the webcam does not recognize the student who registered at the start — the test may be paused.

“Every student has the right to refuse to be monitored.” 

Claudio Fogu, University of California at Santa Barbara.

How Long Is Data Kept?

After the test, companies keep the recording for a set amount of time.

When Dayley and his team at USU investigated how student ID data was used, they found that the information was kept long enough for faculty to review the test data.

But companies differ on how long they keep their information.

Examity, Foote said, keeps the data for one month if no flags are found that may indicate cheating behavior, and longer if there are.

ProctorU’s privacy policy states that they keep data for “as long as is necessary to provide services described.”

PSI Online also retains personal information “for as long as reasonably necessary to fulfill the purpose we collected it for.”

The three companies state, however, that they do not sell user data to third parties — though their privacy policies indicate that they may share data for a variety of reasons, both to fulfill the contracts with schools and for business purposes.

Clarifying Privacy Practices

In response to the USCB faculty concerns, ProctorU clarified its policy, said Stephanie Dille, chief marketing officer.

The company has also added a “Student Bill of Rights for Remote and Digital Work” to clarify student rights.

The clarification, Dille told Digital Privacy News, “is in response to security and privacy concerns we see every day across the higher-education market, as it continues to transition to more digital learning and assessment.”

Keeping Student Data Secure

The three companies discussed measures to keep student data secure.

“The organization that hires Examity is the data-controller,” said Foote, “Examity is the data-processor.”

PSI Services encrypts the data at rest and in transit. “We try to limit the personally identifiable information that we have to access or store,” Musacchio told Digital Privacy News.

As more testing moves online, universities must continue to assess student learning and provide important licensure and certification exams, experts say.

“Universities need to provide integrity and trust in the process,” Foote said.

Still, students and faculty should push back on doing things that make them uncomfortable, Musacchio said.

The University’s Role

Universities can also set parameters to further protect student privacy.

At UCSB, Fogu realized the university had not asked for stipulations that could protect students, like allowing them to show their IDs instead of a government ID for verification, which would provide less personal information.

In the end, however, the university also permitted students to refuse to use ProctorU.

Now, Fogu told Digital Privacy News, “Every student has the right to refuse to be monitored.” 

Samantha Cleaver is an education writer in Charlotte, N.C. 

Sources (all external links):