OLG Ruling: Biometric Surveillance in Online Exams is Unlawful

The Thuringian Higher Regional Court (OLG) ruled on Monday that the online surveillance of students during digital exams using biometric facial recognition ("Proctoring") is unlawful (File No.: 3 U 885/24). With this ruling in the 2nd instance, the judges clarify that the practices that many universities introduced during the Corona pandemic for fraud prevention represent a deep and impermissible intrusion into the fundamental rights of those affected.

Specifically, the processing of biometric data, used for facial recognition and thus for identifying examinees, violates Article 9 of the General Data Protection Regulation (GDPR). According to this, such particularly sensitive bodily information may only be processed in exceptional cases and, above all, only with the explicit, voluntary, and informed consent of the affected person.

The court found that the defendant university did not meet these requirements. Important reason: Students generally had no real choice but to participate in the online exams if they wanted to continue their studies. Student Jennifer Kretzschmar, who sued the University of Erfurt in this case and was supported by the GFF and the student organization FZS, was therefore awarded damages. The judges thus acknowledge the violation of rights suffered and the associated fears and uncertainties regarding the use and storage of her sensitive data.

"Big Brother has no teaching assignment"

At the center of the proceedings was the application Wiseflow, which the University of Erfurt used for digital supervision. This software also monitored students via facial recognition. The aim was to ensure that the same person was in front of the monitor for the entire duration of the exam. The OLG particularly objected to the fact that Wiseflow also forwarded the collected biometric data to the external cloud service provider Amazon Web Services (AWS). This transfer, classified as clearly unlawful, significantly exacerbated data protection concerns.

The GFF emphasizes the need to draw a clear distinction between supervision and spying. It calls on universities to respect the fundamental rights of their students. GFF lawyer David Werdermann praises the OLG's statement: "Big Brother has no teaching assignment." The ruling underscores that the digital surveillance practices of many universities unduly restrict students' informational self-determination and right to privacy.

The neologism Proctoring refers to the supervision of exams and tests to verify the identity of participants and prevent cheating. For this purpose, software is often used, not just for online exams. According to an expert opinion commissioned by the GFF, students are typically forced to install applications whose functionality resembles spyware.

The plaintiff emphasized that the surveillance software used caused her severe anxiety. The decision is therefore not only a legal success but also a confirmation of the feeling of many students that their fundamental rights have been violated.

Urgent application in NRW was unsuccessful

With its decision, the OLG overturned the decision of the previous instance. The Erfurt Regional Court had initially dismissed the lawsuit in November 2024. According to the GFF, the ruling has a signaling effect far beyond the education sector, as it reaffirms the strict requirements of the GDPR for the processing of biometric data in a digital environment. It serves as an important benchmark for all areas where technologies for biometric surveillance – for example, in the workplace or in other public or private environments – are to be used.

Together with a student from the FernUniversität Hagen, the GFF also filed an urgent application with the Higher Administrative Court (OVG) of North Rhine-Westphalia. The aim was that an exam scheduled for March 2021 should not be recorded but at most observed via video transmission. However, the Münster judges rejected the urgent application. This decision was not based on a detailed examination of the legal situation but only on a balancing of consequences. The OVG explicitly stated: The "legality of the recording and storage" could not be clarified in the urgent proceedings.

(wpl)