Spain bans facial recognition for online exams
The Spanish Data Protection Agency (AEPD) has ruled that universities may no longer use facial recognition systems to monitor students during online exams.
In its resolution, the Agency determined that automatic facial recognition for exam supervision is not legally justified under current EU data protection law. Because facial images are a form of biometric data—a special category of sensitive information—their processing is permitted only in exceptional circumstances where the need clearly outweighs the privacy risks. According to the AEPD, universities do not meet that threshold.
The case originated from a complaint against the Valencian International University (UIV), which required students to undergo remote monitoring through facial recognition software and dual-camera surveillance. The system continuously captured and analysed students’ facial features using artificial intelligence to verify their identity throughout the exam.
It also recorded their computer screens, detected running programs, and used a second camera to scan their surroundings for other people or unauthorised materials. The university claimed that all data were pseudonymised and quickly deleted, but it nevertheless conceded that the process carried a high risk to students’ rights and freedoms.
The Agency emphasised that if facial recognition is ever to be used for academic supervision in the future, it will require clear, specific regulation defining when and how such technology may be deployed, and under what guarantees.
Writer: Marc Cervera
Publication: 4imag