Not a vulnerabilityNothing is exploited and the software works as sold. The objection is to what it observes and to what remains of it, not to a defect.
What it is
During an examination the software watches through the camera and the microphone and over the screen: face position, gaze direction, a second face in the frame, sound in the room, windows opened, typing rhythm. From that it derives flags or a score for each student. The recording and the derived judgement are stored, reviewed by staff or by the supplier, and kept after the examination has been graded. An identity step by face comparison often precedes it.
Why it is a separate entry
The student sits at home and cannot decline without failing the course. What is recorded includes the room, the people in it and the sounds of a household. A score derived from body movement is a judgement about a person that the person has to argue against, produced by a system that does not explain itself, and where a face is compared the processing is biometric identification.
How it arises
a supplier product with flagging enabled as delivered
recordings kept for the appeal period for every student rather than for the flagged ones
the identity step performed by face comparison because the alternative requires staff
flags treated as evidence rather than as a prompt for a human to look
Not to be confused with
Recording a website session is Session recording. Recognising everyone who passes a camera is Recognition of every passer-by, where the setting is a public space. This entry is about a compulsory examination: the observation concerns one identified student, it produces a judgement about that student, and it outlives the result.
How to establish it
After the mark is final, records about individual students still exist: the recording, the derived flags, or a score. Establish it from the institution's retention schedule for this system, from the supplier's export, or from a student's access request that returns their own flags, and distinguish the three.
method document-comparisonQoD 85
Requirements on the measurement
ask what remains per student after grading, distinguishing recording, flags and score
ask which of the three the student can see, and whether they were told about the score at the time
record whether the identity step compares a face, and against which source
record whether an alternative to the software was offered, in the same period, and what it cost the student
What would refute it
by handNothing per student survives grading except the mark itself.finding falls
by handA human invigilator watched live and nothing was recorded or scored.finding falls
by handOnly sessions a human flagged are kept, with a stated ground and an end date.weakens
by handA genuine alternative was available in the same period, without a penalty and without a separate fee.The compulsion argument then falls. The observation itself still has to be necessary for the purpose.weakens
Where this plugs into existing processes
The one question that surfaces itThe exam is graded. What still exists about a student nobody flagged?
In a DPIA, verify this
Verify what remains per student after grading, recording, flags and score separately, instead of the supplier's statement that data is deleted after the exam.
As a procurement clause
After grading, nothing per student remains beyond the mark, except sessions flagged by a human with a stated ground and an end date.
With a complaint, hand over
The retention schedule for this system, the student's own flags from an access request, and the answer about whether an alternative was offered.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
Legal framing
eu-gdpr-5-1-c
eu-gdpr-5-1-e
eu-gdpr-22
eu-gdpr-9-1
Objections, and the answer
“The student agreed to the examination conditions.”
Agreeing under threat of not graduating is not free consent, which is why examinations run on a public task or a contract and have to satisfy necessity instead.
“The system does not decide, a person does.”
Where that person sees only the flags the system produced, the system did the selecting. What has to be shown is what the reviewer had in front of them besides the score.
“The camera image is deleted immediately.”
Then the flags derived from it are the record, and the question moves to them. Ask what remains, not what is deleted.
“Fraud has to be prevented.”
It does, and that is a purpose. It does not settle the interval, the room, the retention or the score, each of which is a separate choice that can be made differently.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0039: Exam supervision by behavioural scoring. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0039
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0039, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.