Do online exams violate personal data?

* Photo: UNICEF

Click to read the article in Turkish

"In trying to prevent students from cheating in online exams, universities violate both their privacy and the Law on Protection of Personal Data. They force the students to use a second camera or add-ons. It is not clarified where this data will be stored. If it will be stored in a server abroad, the explicit consent of the student is necessary."

From İstanbul University to Kocaeli University, higher education institutions across Turkey hold their exams online due to coronavirus outbreak.

However, students are uncomfortable with the conditions imposed by universities. They say these impositions violate their personal rights.

Most recently, İstanbul Technical University (İTÜ) has required the students to use a browser add-on called "Witwiser" while taking an online exam. The add-on requests authorization to "read and change data" in all web pages, "to view the notifications received," to change the copied and pasted data," and "to save the content on the screen."

'Students' explicit consent needs to be taken'

Hasan Selçuk Turan, the Chair of İstanbul Bar's Commission on Protection of Personal Data, says that such conditions enforced by universities are contrary to the Law on the Protection of Personal Data.

According to Turan, if the video recording will be done during the exam, the explicit consent of the student who will take the exam is necessary:

"Just as they are obligated to give education to students, universities are also obligated to inspect the quality of this education or whether the student has received it or not. It is what an institution of education is all about.

"However, as universities tend to hold online exams amid coronavirus outbreak, this has started to cause violations of rights on the part of students. Schools usually ask the students to use more than one camera.

"The computer that you use records you en face and you put your mobile phone behind or next to you so that it will record your hands, your face and the room. It started with the Medipol University, the university requested that the students ensure the camera record the entire room.

'Data shall not be transferred abroad'

"What is important here is the principle of proportionality. However, as far as I can see, the practices are not proportional. Legal norms are trampled upon.

"It is not a plausible solution seeking for universities to say 'I will make it convenient for you and let you take your exams at home' and violate the students' privacy in the meanwhile. The unproportional use of the camera aside, another problem is that universities hold these exams on online conference applications such as Zoom.

"Zoom transfers data abroad as well. Its servers are not in Turkey. According to the Article 9 of the Law on the Protection of Personal Data, one shall not transfer personal data abroad without consent. Again, as per the Article 4, one shall not record any piece of data in unproportionally.

"The Protection of Personal Data Institution previously made a statement that the use of servers abroad would mean a violation of the law. Recording videos on Zoom is also against the related Presidential decree.

"The only way to allow the transfer of data abroad is to take the explicit consent of the person whose data will be transferred. Except for this, it is not possible to transfer data abroad without explicit consent.

"At this point, another issue is about who will have this data. It is about the safety of the data. We do not know who do what with our data.

'It is methodologically wrong'

"For instance, the İstanbul Technical Universirt (İTÜ) required its students to use an add-on called 'Witwizer.' I made research into it ans saw the domain was taken by a company named OBSS on February 20. It is not clear what the add-on or the company is about because there is no detailed explanation on its website and everything is in English.

"It is not clear where the add-on will send the data. It is not certain whether it will keep the data in Turkey or send it abroad. Its use is not in Turkish, either. Making the students of Turkey to take an exam with a program operating in English is methodologically wrong.

"It is not good in any way at all. You cannot use anything as long as the transfer of data abroad remains a problem."

'You cannot impose'

"Can the explicit consent of students be taken at this point? No. When you tell the students that you will not allow them to take the exam, they will have to give explicit consent.

"In fact, one of the conditions for explicit consent is free will. I mean, the person needs to be free in choosing it or not. There is no freedom. As there is no freedom, there is no consent, either. So, it means that you force the person. The consent given by him or her does not mean anything. You cannot say 'We took consent' for the consent that you took by force.

"Yes, maybe they do not put a gun on students' heads to take their consent, but they put diploma. You will either take it or cannot graduate.

"If what you intend to do is to inspect the exam and if you consider it that important, then you should not be holding an online exam in the first place. You will invite your students, ensure that they sit by keeping their distance and hold the exam in an open area.

'They violate personal rights'

"So, all in all, the two fundamental problems of online exams are the transfer of data abroad and the principle of proportionality. If these are fulfilled, if data are kept inside the country and students are treated proportionally, then, yes, the exams can be held. But, in their current state, universities violate students' personal data while trying to prevent their from cheating.

"It is the same thing as saying the following before a normal exam: 'I suspect that you will cheat. So, I will first look into your underwear, maybe you have hidden the cheating papers there.' When you hear it, you want to say 'No way.' But it is still similar to this." (HA/SD)