The Montreuil Administrative Court judged that the use of the testwe application would have brought excessive damage to the right to the protection of personal data.
by soazig the nevé
When does the remote monitoring of a university examination affect individual freedoms? After first controversies born during the confinement linked to the COVVI-19, the question resurfaces, brought by a collective of psychology students from the Distance Education Institute (IED) of Paris-VIII University. Supported by the La Quadrature du Net association, they attacked the establishment’s decision to use the Private Application of Online Application TestWe.
On December 14, the Montreuil administrative court (Seine-Saint-Denis) agreed to them, on the grounds that this provider would have brought an excessive attack on the right to the protection of personal data. For M e Florent Verdier, student lawyer, Testwe plans nothing less than “remote monitoring worthy of the worst authoritarian regimes”. “We must get out of demagoguery to deal with the reality of a sale for sale which does not respect the regulations and case law in force,” said the applicant who acted on behalf of the collective, Jodi-Marie Masley, lawyer by profession . IED students have a particular profile: almost all, already exercise a job and take distance courses as part of their professional development project.
The judge estimated that the use of TestWe establishes a processing of personal data by making possible “in particular the automated verification of the candidate’s identity, the continuous analysis of his filmed face, the continuous analysis of His gaze, access to all the data stored on his computer, the capture and automated analysis of the sound and visual environment “. Terms which are “likely to undermine the principle of data minimization” and can create, “in the state of the investigation, a serious doubt as to the legality of the decision” taken by the establishment.
absence of definition of the data processed
Even if the Paris-VIII University argued that it did not hear, “in practice, actually collecting these data”, it remains that it did not exhibit “which technical device [y] would do Obstacle (…) No more than it details the procedures for monitoring exams, the nature of the data collected and the adequate, relevant and limited nature of their processing, recalls the order of judgment.
Conclusion of the judge: the absence of prior definition of the data processed and the justification of this processing constitutes on the part of the establishment “an excessive damage to the right to the protection of personal data that candidates derive from the general regulations on Data protection [GDPR] “, adopted by the European Union in 2016.
You have 41.16% of this article to read. The continuation is reserved for subscribers.