Update Friday, 19 February, 1.41pm: A university spokesperson comments that, as far as EUR is concerned, the takeover of ProctorExam has no consequences for the protection of personal data stored by the company. “The takeover of ProctorExam by Turnitin does not mean a change in the services provided by ProctorExam to the EUR, nor for the protection of personal data by ProctorExam. As a university, we hold privacy of our students in high esteem and ensure this also with all our suppliers.”
Since the takeover, the board of directors has been expanded, too, from one to three persons. Jane Fogarty and George Mazzotta have joined the Dutch founder, Daniel Haven, on the board. According to ProctorExam, the company was not acquired by Turnitin’s American headquarters, but rather by a British entity of Turnitin, which now owns the shares.
ProctorExam has its seat in Amsterdam and was founded by Haven in 2014. According to Het Financiëele Dagblad, the company had only two employees in 2019. Due to the tremendous growth the company experienced during the coronavirus crisis, it now has about 27 employees.
Many Dutch universities opted for ProctorExam’s software at the beginning of the coronavirus crisis because it outperformed its competitors in a privacy assessment, an analysis universities are required to perform to check whether software suppliers meet the provisions of the General Data Protection Regulation (GDPR). One of the reasons why ProctorExam performed so well in those assessments was because, unlike some of its competitors, the company was not American-owned.
Outdated assumptions
This assessment will have to be conducted again, says IT lawyer Arnoud Engelfriet. “It is now based on outdated assumptions. Whether the American takeover will result in a different outcome remains to be seen. American companies are allowed to have a controlling interest in Dutch companies that process personal data. The main question to be answered is whether any data will be going to America. That hasn’t been allowed since the Schrems-II Decree.” In July 2020, the Schrems-II Decree stipulated that personal data are no longer allowed to be transmitted to the United States, because their privacy cannot be guaranteed there.
In a written response, ProctorExam stated that it is ‘always in favour of thoroughly assessing the impact on privacy and data protection’. “In itself, the takeover does not constitute a ground for a new assessment, since no changes will be made to the personal data flows. All contractual agreements will remain unamended, as well.”
‘In itself, the takeover does not constitute a ground for a new assessment, since no changes will be made to the personal data flows’
'Data will remain in the EU'
In the case of ProctorExam, students’ data and live-streamed video images are only being stored in the European Union. If that continues to be the case, Engelfriet says there probably will not be any issues.
“If the data are stored at a Dutch subsidiary located in Europe, the parent company cannot access them at will. The FBI has certain powers in terms of companies with American connections. Suppose the parent company were to be ordered to provide the data, but they’re on a server in the Netherlands. In such cases, the parent company would have to ask the Dutch Managing Director for permission. However, he is not allowed to grant that permission under the GDPR. Moreover, lots of students would sue the universities, after which the company would lose all its clients. Needless to say, that wouldn’t be in ProctorExam’s best interest.”
British entity
For its part, the company has confirmed that this is what the procedure is like. “ProctorExam has been formally acquired by a British entity of Turnitin. Since ProctorExam is a European company and will continue to be so, ProctorExam is not subject to American law. In addition, acceding to such a request or decision is subject to certain rules, which ProctorExam will naturally continue to comply with, regardless of its new shareholder. The fact that we now have a ‘foreign’ shareholder will not affect ProctorExam’s current privacy policy. After all, the data will continue to be where they are. Furthermore, the American Cloud Act (under which the American government may submit a request for inspection) does not directly apply to ProctorExam. Nor would an American shareholder be able to transmit such a request, from a legal point of view. After all, the GDPR stipulates that such a decision or request must be based on an international agreement, and there is no such thing at present.”
Uncomfortable
From a formal point of view, then, the situation does not seem too worrisome, except for universities having to reperform their assessments. “I can imagine that this makes universities feel uncomfortable,” says Engelfriet. “Generally, there is a provision allowing parties to a contract to terminate the contract if a company gets new owners.” However, there is a problem: most of the other online proctoring companies out there are American-owned, as well. “Maybe universities should simply stop using that horrible online proctoring,” says Engelfriet.
ProctorExam’s software has been the subject of a heated debate at Erasmus University these last few months. Many students have complained about technical problems when using the software, and Erasmus University has recently begun to require students to use a two-camera set-up when sitting online proctored exams, since using one camera only would make it too easy for them to cheat.
