Online exams - Information on data protection pursuant to Art. 13 GDPR
1. General
Ulm University takes the protection of your personal data very seriously. This is why we inform you here about the purpose for which the University collects, stores or forwards your data in the context of online examinations. The information also tells you what rights you have with regard to your personal data.
2. Purpose, scope and legal basis of data processing
The personal data will be processed by Ulm University for the purpose of conducting online examinations in accordance with § 32 a of the Baden-Württemberg State University Act (LHG) in conjunction with the second statute amending the statute of Ulm University due to the effects of the Corona pandemic in the area of study and teaching to supplement the study and examination regulations in the summer semester 2021 of 11 May 2021 (Corona statute).
The online examination formats concerned are:
- Written and practical examinations as well as transfer examinations (e.g. examinations in open book format, assignments, etc.) to be created electronically at home (e.g. examinations created in Moodle) or uploaded there electronically via Moodle (e.g. written examinations to be downloaded and uploaded),
- Written and practical examinations without or with limited aids with video conferencing supervision or by using a software function to limit the use of software/systems/Internet sites other than those permitted in the examination,
- Oral examinations with video conferencing supervision.
The categories of persons concerned are:
- Lecturers
- Students
- Supervisors
The following categories of personal data are subject to processing in online examinations:
For students taking part in the online examination
To register for the tool used, the e-mail address and password are processed, as well as the first name and last name after registration and, optionally, the profile picture if provided voluntarily by the user.
The following data are processed for participation in an online examination:
- Identification: For the purpose of proof of identity, authentication takes place with the help of a valid student ID. This is done via an upload or via the webcam.
- Audio and video data: Audio and video data can be processed during the examination for the purpose of ensuring the personal performance of the students and to prevent cheating. For the entire duration of the online examination, data from the microphone and from a video camera of the terminal device or a video camera connected to the terminal device are processed and transmitted to the respective invigilator. No recording takes place. The room in which the examination candidates are located is not monitored, in particular there is no 360° observation.
- Any aids permitted to a limited extent for written online examinations can be used under video supervision to prevent cheating.
- Oral or practical online examinations are conducted under video supervision as a video conference. The examiner decides whether video conferencing is necessary, in the case of written online examinations, taking into account the susceptibility to cheating.
- Text data: To ensure accessibility and communication during the online examination under video conferencing supervision, especially in the event of technical problems, it is possible to use the chat and question function during an online examination. To this extent, the text entries made are processed in order to display them in the online examination and, if necessary, to record them.
- Conducting the examination: The examination documents are processed for the purpose of conducting the examination. Automated decision-making within the meaning of Art. 22 GDPR does not take place.
For the organisers of the online examination (use of Zoom)
The following personal data are processed by Connect4Video:
- Personal data (first name, last name, company, address)
- Communication data (telephone number, e-mail address, user name)
- Customer history (conference statistics, including technical data for quality assurance and troubleshooting during the storage period)
- Traffic and media data
The following additional personal data are processed by Zoom:
- User data: first name, last name, e-mail address, status - user group, authorisation
- Log data: meeting ID, title, host, start time, end time, duration, number of participants, host data centre, use of telephony/VoIP/3rd party audio/video/screensharing/recording/encryption/CRC, operating system, IP address, location, join-time, leave-time
- User profile: profile picture (optional), last name, first name, account no. (zoom), pers. meeting ID, login e-mail address, licence type, language, date / time, limitation of data centres, logout of logged-in devices
- Communication content: content of electronic communications that may contain personal data (text, audio, image and video transmissions, file transfers)
The legal basis for data processing in the context of conducting the online examination is § 32 a para. 2 sentence 3 LHG. According to this, personal data may be processed insofar as this is necessary for the proper conduct of the online examination.
The legal basis for the data processing of the proof of identity is § 32 a para. 4 LHG in conjunction with Art. 6 para. 1 subpara. 1 e, para. 2 and para. 3 GDPR. Storage of the data processed in connection with the identification beyond a technically necessary intermediate storage does not take place.
To prevent cheating, audio and video data of the students are processed via videoconference. The legal basis for the data processing is § 6 para. 1 subpara. 1 letter e, para. 2 and 3 GDPR.
Participation in the online examination under video supervision is not obligatory under examination law but instead voluntary, so that here the voluntary nature is to be assumed as a prerequisite for conducting online examinations, including the associated processing of the audio and video data to prevent acts of deception. Voluntariness is deemed to exist if the students have a genuine or free choice between two equivalent forms of examination. There is no reason to fear a disadvantage for students who do not take part in the online examination, as Ulm University offers scheduled in-person examinations (i.e. examinations within the same examination period) without supervision by a video conferencing system, see § 32a para. 1 sentence 3 LHG.
3. Storage of your data
The personal data are only stored as long as this is necessary in connection with the identification and the audio and video transmission of the processed data. Deletion therefore takes place at the latest when the purpose of the data processing ceases to exist or after the expiry of legal or official retention obligations.
Data collected via Zoom will only be stored for as long as necessary for the specified and legitimate purposes. Further processing that is not compatible with these purposes will not take place. The data will be deleted at the latest after termination of the contractual relationship between Ulm University and Connect4Video for the use of the Zoom video service, unless there is an obligation to store it under the law of the European Union or the member states.
In the case of a recording, the data on the respective host's terminal device, as well as on the servers of Ulm University used to provide the recording, will be deleted at the end of the respective semester at the latest. The examiners may request an extension of the storage period provided that no third party data is involved.
4. Recipients of your data
Your personal data will only be processed by persons involved in the examination process who are authorised to do so in connection with online examinations. Personal data processed in connection with online examinations will not be disclosed to third parties as a matter of principle. This does not apply if legal proceedings are pending.
5. Data processing by a third party
The following recipients receive your data in the context of the data processing described here:
| Recipient: | Connect4Video GmbH, Nibelungenstr. 28, 65438 Rüsselsheim |
| Third-country transfer: | he above-mentioned personal data of Connect4Video are transmitted to the service provider Connect4Video and processed on servers of the provider in Europe and Switzerland. For Switzerland as a third country, there exists an adequacy decision pursuant to Art. 45 (1), (3) of the GDPR. |
| Recipient: | Zoom Video Communications, Inc., 44 Almanden Blvd. Suite 600, San Jose, CA 95113 |
| Third-country transfer: | There exists no adequacy decision for the transfer. The transfer is based on Art. 46 para. 1 GDPR with the documentation of appropriate safeguards, in this case the standard data protection clauses (Art. 46 para. 2 letters c and d GDPR). The appropriate safeguard can be viewed here. |
6. Your rights as a data subject
You have the following rights to protect your personal data:
- to receive information about the personal data concerning you (Art. 15 GDPR),
- have inaccurate data rectified (Art. 16 GDPR),
- request the erasure or restriction of the processing of your personal data under certain conditions (Art. 17, 18 GDPR),
- object to the processing of your data (Art. 21 GDPR),
- have your data transferred to other entities designated by you (Art. 20 GDPR). Separate consent is required to do this.
You also have the right to contact the competent data protection supervisory authority if you believe that the processing of your personal data is not lawful. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für Datenschutz und Informationsfreiheit Baden-Württemberg).
Further information on this privacy policy
Ulm University reserves the right to amend this privacy policy from time to time to ensure that it always complies with the current legal requirements or to implement changes to the services in the privacy policy, e.g. when new services are introduced. The new privacy policy will then apply for a new visit to the website.
Last update of this privacy policy: 8 July 2021