German court bans AI-based biometric face verification in online exams
A German court ruled that a university's use of AI-based biometric face recognition software to verify student identity during online exams violated GDPR prohibitions on biometric data processing. The court awarded the student compensation for non-material damages, finding the automated system unlawful even though human supervisors reviewed alerts it generated.
What happened
A German university used AI-based biometric face verification software to authenticate students during online proctored exams. The system extracted biometric features from either newly created facial images or existing photographs, converting them into numerical codes, and then automatically compared random facial captures taken during exams against these reference data.
Reported impact
A student filed suit alleging unlawful processing of biometric data under GDPR. The student demanded compensation for non-material damages resulting from the unauthorized biometric data processing.
Index analysis
The Oberlandesgericht (Regional Court) Jena ruled that automated facial recognition processing constitutes biometric data processing, which is generally prohibited under GDPR Article 9. The court found both a data protection violation and compensable non-material damage, overturning the lower court's dismissal which had found no harm.
Governance controls
Automated identity verification via webcam using biometric data processing is prohibited under GDPR. Manual verification by a human supervisor after algorithmic flagging does not cure the illegality of the automated biometric processing itself.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.