Online Testing and Data Protection Requirements
Online testing platforms that rely on proctoring operate in one of the most sensitive areas of data protection law: a single examination session can involve identity data, video footage, screen content and often biometric data such as face or voice samples. Georgian legislation frames this relationship clearly: the provision on video monitoring expressly lists examination and testing purposes among the permitted aims, yet the permission is conditional — monitoring must be an adequate and proportionate means of achieving the processing purpose. The organiser and the platform are, as a rule, controllers: purpose, scope, security measures and rights-protection mechanisms are their statutory obligations.
Principles of Data Processing in the Testing Context
The fundamental principles apply at every stage of an online examination. Data must be processed lawfully, fairly, transparently and without violating the subject's dignity; collection is allowed only for specific, clearly defined and legitimate purposes, and incompatible further processing is prohibited. Processing must be limited to what is necessary and proportionate to the aim — directly limiting how much material a proctoring system may capture, store and analyse.
Accuracy requires that data be genuine and precise, and that inaccurate data be corrected, erased or destroyed without unjustified delay; fact-based data must be distinguished from personal assessments. Once the purpose has been achieved, recordings and identification data must be deleted, destroyed or depersonalised, unless storage is prescribed by law or a subordinate normative act adopted on its basis. The security obligation adds technical and organisational measures against unauthorised or unlawful processing, accidental loss and damage.
Where data collected during a test is later processed for a different purpose without consent or a statutory basis, the controller must weigh the connection between the purposes, the relationship with the data subject, the subject's reasonable expectations, the involvement of special categories of data, the consequences and the security measures — and must be able to demonstrate compliance.
Biometric Data in Proctoring
Facial recognition and voice analysis, on which many platforms' verification modules rely, constitute processing of biometric data, regulated strictly. Biometric data may be processed only where necessary for carrying out an activity, security, protection of property and prevention of the disclosure of secret information, and where those purposes cannot be achieved by other means or only with disproportionately great effort. For a private examination organiser the decisive test remains necessity and the absence of a less intrusive alternative.
The procedural requirement is equally explicit: before processing, the controller must define in writing the purpose and scope of biometric processing, the storage period, the storage and destruction rules, and the rights-protection mechanisms. In practice, this document must exist before the examination and be comprehensible to candidates.
Video Monitoring for Examination Purposes
The video monitoring provision applies directly to the testing sector: the law allows video monitoring for, among other purposes, examinations and testing, provided it is an adequate and proportionate means of achieving the processing purpose. Proportionality depends on the context: a qualification-granting state examination and a low-stakes internal test present different risks, and where a more limited instrument suffices, continuous surveillance may fail the test. The controller must define in writing the purpose, scope and duration of monitoring, the retention period of the recording, the rules for access, storage and destruction, and the rights-protection mechanisms.
The system and recordings must be protected against unlawful interference, and each instance of access must be logged — with the time and username enabling identification of the accessor. Video monitoring is impermissible in changing rooms, hygiene areas and any space where the subject has a reasonable expectation of privacy, as well as where it contradicts generally recognised moral norms; in online proctoring, extending the camera to such parts of a candidate's home exceeds the legitimate interest. Candidates must also be informed before the examination, with the controller's name and contacts.
Legal Protection and Complaint Routes
Where a candidate believes that data in the testing process was processed in violation of the rights and procedures provided by law, three routes are available: the State Audit Service, the court, or a superior administrative body. Before the State Audit Service, the data subject may request a decision on blocking the data pending completion of the consideration — an effective interim measure where the violation concerns further use of the data. A decision of the service may in turn be appealed to the court under the conditions and deadlines of Georgian legislation. Isolated procedural breaches are often addressed through a superior administrative body; systemic problems require consideration by the audit service.
Frequently Asked Questions
Is video monitoring of an examination lawful?
Yes — the law lists examination and testing purposes among the permitted aims of video monitoring, provided it is an adequate and proportionate means; the organiser must substantiate proportionality for the specific format.
When may biometric data be used in an online exam?
Only where necessary for the activity, security, protection of property or secret information, and the purpose cannot be achieved by other means or only with disproportionately great effort; the purpose, scope, retention and destruction rules must be defined in writing beforehand.
May a proctoring camera survey the entire room?
No. Video monitoring is prohibited in changing rooms, hygiene areas and any space with a reasonable expectation of privacy; the camera is limited to the examination space.
How do I defend my rights if the platform violated the law?
Apply to the State Audit Service, the court or a superior administrative body; during consideration by the service, blocking of the data may also be requested.
How We Help on Legal.ge
The specialists on Legal.ge assist organisers and candidates alike: we audit platforms for compliance, prepare the written definitions for biometric data and video monitoring, assess proportionality and represent data subjects at every stage of complaint proceedings. Contact us — checking the framework before launch costs far less than remedying a violation afterwards.