Online Testing and Data Protection Requirements
Online testing platforms that rely on proctoring operate in one of the most sensitive areas of data protection law: a single examination session can involve identity data, video footage, screen content and often biometric data such as face or voice samples. Georgian legislation frames this relationship clearly: the provision on video monitoring expressly lists examination and testing purposes among the permitted aims, yet the permission is conditional — monitoring must be an adequate and proportionate means of achieving the processing purpose. The organiser and the platform are, as a rule, controllers: purpose, scope, security measures and rights-protection mechanisms are their statutory obligations.
Principles of Data Processing in the Testing Context
The fundamental principles apply at every stage of an online examination. Data must be processed lawfully, fairly, transparently and without violating the subject's dignity; collection is allowed only for specific, clearly defined and legitimate purposes, and incompatible further processing is prohibited. Processing must be limited to what is necessary and proportionate to the aim — directly limiting how much material a proctoring system may capture, store and analyse.
Accuracy requires that data be genuine and precise, and that inaccurate data be corrected, erased or destroyed without unjustified delay; fact-based data must be distinguished from personal assessments. Once the purpose has been achieved, recordings and identification data must be deleted, destroyed or depersonalised, unless storage is prescribed by law or a subordinate normative act adopted on its basis. The security obligation adds technical and organisational measures against unauthorised or unlawful processing, accidental loss and damage.
Where data collected during a test is later processed for a different purpose without consent or a statutory basis, the controller must weigh the connection between the purposes, the relationship with the data subject, the subject's reasonable expectations, the involvement of special categories of data, the consequences and the security measures — and must be able to demonstrate compliance.
Biometric Data in Proctoring
Facial recognition and voice analysis, on which many platforms' verification modules rely, constitute processing of biometric data, regulated strictly. Biometric data may be processed only where necessary for carrying out an activity, security, protection of property and prevention of the disclosure of secret information, and where those purposes cannot be achieved by other means or only with disproportionately great effort. For a private examination organiser the decisive test remains necessity and the absence of a less intrusive alternative.
The procedural requirement is equally explicit: before processing, the controller must define in writing the purpose and scope of biometric processing, the storage period, the storage and destruction rules, and the rights-protection mechanisms. In practice, this document must exist before the examination and be comprehensible to candidates.