Why most remote proctoring companies don't want you to read their privacy policy

Imagine two scenarios. In the first, security cameras in a school record a student walking in the hallways and interacting with their friends. The school stores the recording as part of the student records and even shares it with other organizations.

Seems wrong, doesn’t it?

Now imagine a scenario in which security cameras record the same student bullying or harassing a younger student, with only the portion of the recording demonstrating this behavior. The recording is shared with other organizations with a responsibility to take appropriate action. Feels better, right? 

In the second example, there is a legitimate reason for the information to be shared. The student has potentially broken school rules and the school needs to collect evidence.

Remote proctoring technology is just an extension of school security cameras — so why should we treat it any differently? Is it really necessary for a client of proctoring services to be given copies of a user’s government-issued photo ID, full recordings of the user in their home, and sensitive information collected from their computer?

Before you answer, consider that many proctoring services routinely collect, intentionally and unintentionally, personal information that includes social security numbers; driver’s license and passport numbers; other personal identifiers and biometric information including genetic, physiological, behavioral, gender identity, and biological characteristics; IP addresses or device identifiers; browsing history, search history, and information about a users’ interactions with websites, applications, or advertisements; medical information including medical conditions, physical disability, and/or mental disability; drug use, political affiliations, not to mention children and spouses that may be in the same space as the person subject to the proctoring.

Yikes. 

Ever looked at the privacy policies of most identity verification and proctoring companies?

Here are four reasons you need to read them carefully (yep, these are real): 

1. “By accessing and using our Services, you consent to allow free exchange of proctoring information between [Proctoring Service Company] and your educational institution. We, or vendors on our behalf, may track the websites you visited before and after our websites as part of the traffic data described above for our internal business purposes.”

2. "If your institution has consented, we may also use third-party solutions to process selected data.”

3. "We may disclose information, including video and audio recording of your exam session, to your educational institution/certifying entity upon request. – Your information may be sold or transferred as part of that transaction."

4. "We cannot ensure or warrant the security of any information you transmit to us or store on the Services, and you do so at your own risk.”

Double yikes.

Why Privacy by Design is so important

Remember that students and workers taking online training are required to submit to proctoring. This disparity in power does not give any organization the right to violate their privacy.

And just as we expect schools to only share footage of our children with other organizations when it’s absolutely necessary, we should expect the same from online proctoring technology. 

Integrity Advocate has proven that when it comes to online proctoring software, data collection can be minimized while still ensuring the highest level of academic integrity. We only collect what is necessary to verify the learner’s identity and confirm if they have (or have not) followed the rules as determined by the learning institution. In this context, we’re similar to PayPal, serving as an intermediary for the benefit of both parties.

With the exception of a single user photo, if no rule violations are found all recordings of the user and their computer desktop are deleted within 24 hours. As a Canadian company, Integrity Advocate is outside the jurisdiction of the US government, but in the unlikely event that we are ever required to disclose user data, all that we could provide on the vast majority of users is their first and last name and their image represented as a string of code.

Based on their privacy policies, how many other online proctoring service providers can say that? 

***

Learn how our Privacy by Design architecture protects students and institutions. Book a demo today.