Court Rules University's AI Facial Recognition in Online Exams Unlawful Without Consent
A German appeals court ruled that the University of Erfurt's use of facial recognition software to monitor students taking online exams without explicit consent violated privacy rights. The court awarded the plaintiff 200 euros in damages but noted that the processing of biometric data in online exams is not inherently unlawful if proper consent is obtained.
What happened
The University of Erfurt deployed facial recognition proctoring software during online exams conducted during the COVID-19 pandemic to prevent cheating.
A student filed a complaint with civil court support from the civil rights organization Gesellschaft für Freiheitsrechte, contending that the facial recognition system violated privacy rights.
The Landgericht Erfurt dismissed the case in October of the prior year, but the student appealed to the Oberlandesgericht.
Reported impact
The Oberlandesgericht ruled that the university's processing of the student's biometric data without explicit consent was unlawful in the specific case.
The court awarded the student 200 euros in damages, although she had sought 1,000 euros.
Index analysis
The court stated that the processing of biometric data in online exams is not generally unlawful, but was unlawful in this case because the student had not given explicit consent for processing her biometric data.
The civil rights organization argued that the software constituted a disproportionate intrusion into student privacy.
Governance controls
The University of Erfurt stated it had already remedied the identified deficiencies in processing biometric data before the ruling.
The university announced that online remote exams would no longer be conducted starting in the winter semester, with all pandemic-era online exams to be discontinued by April 2026, to be replaced with in-person examinations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.