This document describes the processing of student personal data by European University Cyprus (EUC or the University) in the context for the purposes of online teaching and learning. All such processing is undertaken by the University in compliance with the requirements of the General Data Protection Regulation (the GDPR). This document concerns:
- Students who enroll in Distance Learning programs of study (Distance Learning Students). Distance Learning Students will participate in all their courses and may take all their examinations through the online platforms used by EUC for this purpose, as EUC will determine.
- Students who enroll in programs of study normally requiring their physical presence at University premises (Conventional Students). Conventional Students may be required by the University to attend online classes and take online examinations, as the University will deem appropriate (for example, as part of EUC policy for integrating digital technologies in its conventional programs -such as the policy for Digital Enhanced Learning-, or due to a decision by the University to adopt a “blended learning” approach, combining conventional and online teaching and learning methods, or due to extraordinary circumstances, such as during a pandemic).
- In addition, this document refers to other special circumstances in which the University, for reasons of better application of health protocols or due to circumstances beyond its control, may apply a dual way of offering its Conventional courses. In this case, the enrolled students in a course will be able to attend it: a) either live with physical presence, b) or remotely through simultaneous online retransmission of the course for those who cannot attend physically.
Personal data refers to information about any student that is collected, recorded or otherwise processed by EUC via any of the online platforms used by EUC for online learning and teaching purposes. These platforms are:
- Learning Management Systems Moodle and Blackboard, including Blackboard Collaborate (“LMS”), which are used for lectures, seminars and other presentations by teaching staff, other sessions between teaching staff and students, including presentations by students (all of the above together referred to as “Sessions”), the submission of coursework by students and the conduct of oral and written online examinations.
- Respondus Lockdown Browser (“Respondus”), which is used for the supervision of written online examinations.
Blackboard and Respondus are provided by US corporations (Blackboard Inc. and Respondus, Inc., respectively). Data recorded via any of these platforms may be stored using cloud services within or outside the EU. Adequate protection of the relevant data is ensured through the Data Processing Agreement and Standard Contractual Clauses signed between EUC and these corporations as required by the GDPR.
The use of these online platforms involves the processing of student personal data for the following purposes:
- Student log-in details, for the purpose of identifying students who participate in Sessions and examinations and recording their attendance, as well as to enable them to submit coursework or presentations.
- Student coursework, presentations and responses to oral or written examinations, submitted or recorded via the relevant online platform, for the purpose of teaching staff having access to, assessing and grading the above.
- Student voice and image, recorded during a Session, when students activate the camera of the device they use to join such Session, so that they can be seen and heard by their instructor and other students. Activation of the camera by the students during Sessions is not mandatory, except when the students themselves are making a presentation to the professor and/or other students for the purposes of their course. Students can otherwise participate in Sessions and submit inquiries or respond to questions via written text, without activating their camera, unless they choose to do so. The recording of the students’ voice and image during a presentation, or if they choose at any other time to activate their camera, will be part of the audiovisual recording of the relevant Session and will thus be available to the instructor (for use, where appropriate, for student assessment and/or course management purposes) and to all students of the class (for use for learning purposes during their studies, for a period of up to 6 months).
- Student voice and image recorded during an oral online examination. The recording, via the students’ camera, which must be activated, will be available to the instructor of the course for student assessment and grading purposes, to examiner(s) appointed by the University for the purpose of ensuring fairness in assessing the students, and to the Cyprus Agency of Quality Assurance and Accreditation in Higher Education (Q.A.A.) for accreditation and quality assurance purposes pursuant to the competences of the CY.Q.A.A. under applicable law.
- Student image, sound and other data recorded during a written online examination, for the purposes of supervision and checking compliance with the rules of conduct during the examination. Sound and images from the students’ camera, which must be activated, will be recorded via Respondus. In addition, via the Respondus software, the images from the students’ camera and other data, such as keyboard use and mouse movements by the students, will be processed to record matters such as whether there was any change in the person taking the examination, whether there was any other person in the room, whether the person taking the examination left their seat during the examination and how much time was spent on each question. Respondus will also assign to each student a grade as an indication of the likelihood that they have not complied with the examination rules and guidelines. Note that any decision on whether a student has actually not complied with the examination rules and guidelines is in no circumstances taken automatically by Respondus; such a decision can only be taken by the instructor of the course, who will have access to all the above-mentioned data and will also be able to discuss the matter with the student concerned. The audiovisual recording of the examination will also be available to any examiner(s) appointed by the University for the purpose of ensuring fairness in assessing the students and to the CY.Q.A.A. for accreditation and quality assurance purposes pursuant to the competences of the CY.Q.A.A. under applicable law.
- Student grades and examination results, for the purpose of notifying these to the students.
- All of the above-mentioned data and recordings will be available to and may be processed by authorised personnel of the Department of Information Systems and Operations of the University, for the purposes of dealing with any technical issues and for system management and maintenance purposes and/or by other authorised personnel of the University for accreditation and quality assurance purposes or when necessary for the performance of their duties.
- All data recorded for the purpose of ensuring fairness in assessing the students during the exams will be retained for a period of 2 months and then deleted.
Legal basis for GDPR purposes
The processing of the personal data in the manner described above is necessary for:
- in the case of Distance Learning Students, the provision by the University of the educational services it has agreed to provide to them, i.e. their participation in the courses of Distance Learning programs of study they have enrolled in and taking online examinations for the relevant degree;
- in the case of Conventional Students, the provision by the University of the educational services it has agreed to provide to them when the University considers that it is appropriate for them to participate in online sessions and/or examinations, for example:
- when due to extraordinary circumstances, such as during a pandemic or other events giving rise to health or safety issues, the University is unable to provide its services with the physical presence of students at University premises; or
- in the event that the University decides to adopt a “blended learning” approach which combines conventional and online teaching and learning methods; or
- as part of EUC policies for integrating digital technologies in its conventional programs, such as the policy for Digital Enhanced Learning;
- the legitimate interest of the University to comply with the guidelines and other requirements of the CY.Q.A.A. for accreditation and quality assurance purposes;
- the legitimate interest of the University to ensure proper record keeping and administration of its programs of study and services, proper management and maintenance of its systems and resolution of any technical issues;
- the legitimate interest of the University to provide to all students access to appropriate learning material concerning their courses and/or program of study, including audiovisual recordings of relevant Sessions.
Processing of the image and voice of students which is recorded when students choose to activate their camera during a Session (e.g. to ask or answer a question or make a comment orally, instead of by written text) is based on the consent of students, which is evidenced by the activation of their camera or microphone.
Note that EUC may collect, record and process personal data concerning Distance Learning and Conventional Students by other means and/or for other purposes, e.g. through the student enrollment application form and/or to confirm the payment of tuition fees. Information on such processing by the University is available in the University’s Privacy Notice – GDPR at https://euc.ac.cy/en/privacy-notice-gdpr/
Students may exercise any of the rights granted to them by the GDPR (e.g. to access and obtain copies of their data, to request rectification or erasure of their data or to object to specific processing or ask for its restriction) by contacting the University’s Data Protection Officer at firstname.lastname@example.org