Additional Privacy Info
Respondus Monitor is a companion product for LockDown Browser that enables students to record themselves with a webcam and microphone during an online exam. The recordings and other data from the exam session are processed automatically; summary information is provided to the instructor, such as if the student left the video frame during the exam session.
Respondus Monitor is an enterprise application accessed from within the institution's Learning Management System (LMS). Respondus Monitor uses a plugin to interact with the LMS's application programming interfaces (APIs). Respondus Monitor doesn't require users (e.g. instructors, students) to create an account since the APIs include "single sign-on" capabilities for authentication purposes. The APIs pass the username to the Respondus Monitor server, which then gets stored on the Respondus server. The legal ground for processing your username for this purpose is based on Respondus' legitimate need to perform the requirements of the contract.
In GDPR terms, the Respondus Monitor service is a "processor" of your personal information; the licensing institution (e.g. university) is the "controller" of the personal information gathered and processed. This means we provide the technology for storing and analyzing the data, but the licensing institution (e.g. instructors; administrators) control the actual use of the data.
A variety of data are automatically processed during an exam session that uses Respondus Monitor. The webcam recording itself goes through an automated "post-processing" step that utilizes facial detection and facial recognition technology to determine: whether the student remained in the video frame, if multiple people appear in the video frame, if the person in the video frame differs from the person who started the exam, and the position of the user's face relative to the webcam recording device. A "biometric signature" of the user is generated and used temporarily in this post-processing step, but the signature is NOT stored on the Respondus Monitor server.
Respondus Monitor processes other data from the exam session, such as: the date and time the user starts and completes an exam session; the time that each exam question is answered; how much time is spent on each exam question; if/when an answer to an exam question is changed; the quality of the user's internet connection during the exam session (including the time and duration of any internet disconnections); mouse, keyboard and screen activity; the quality of the video recording (in terms of lighting, contrast, movement); and the quality of the audio recording, among other data.
Respondus Monitor continually tracks the applications and processes that are running on the computing device during an exam session.
User data may be aggregated, and then individual user data may be compared to the aggregated data to look for patterns or anomalies, such as whether a user spent an unusually long time answering a question relative to other users.
Summary information for each exam session is made available to the instructor, including a "timeline" where important events are noted (e.g. when an exam question was answered; when an internet disconnection occurred; when multiple people appeared in the video frame). Aggregated data is also provided to the instructor (e.g. the average length of time users spent on an exam question; the average time spent on the entire assessment; the average date/time that users started the exam session).
An overall value is generated for an exam session that helps the instructor determine the risk that exam violations have occurred. Again, these analytics are generated automatically by the Respondus Monitor application.
The legal ground for processing the above-mentioned data is based on Respondus' legitimate need to perform the requirements of the contract.
Depending on the exam settings selected by the instructor, students may be required to show an identification card to the webcam, from which a photo will be taken. The photo image is securely transmitted to the Respondus Monitor server using https, and then stored on the server in encrypted format. Respondus does no further processing or analysis of this data. The legal ground for storing a photo of the identification card is performance of a contract.
Respondus Monitor uses APIs from the LMS to display other personal information, such as grades, within the Respondus Monitor application. This information is obtained in real-time from the LMS (using APIs) and isn't processed or stored by Respondus Monitor.
The default data retention period for Respondus Monitor is five years. Upon request, licensing institutions can change the data retention period (e.g. one year). If an institution terminates its license for Respondus Monitor, the institution may request that user data be deleted immediately; alternatively, the data will be retained according to the data retention period, which allows an institution to access that data again if they restore their Respondus Monitor license. The legal ground for storing a user's exam session data on our servers is performance of a contract.