investigationOngoing
Data State Inspectorate (DVI) — Riga Stradins University (RSU)
July 1, 2020 · Latvia
After an on-site inspection the DVI examined RSU's use of the Respondus Monitor remote-proctoring tool, which processes biometric data by comparing the student's live webcam image with their ID photo, finding the university accepted the vendor's processing terms without ensuring GDPR compliance.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.