Privacy Watchdogs Challenge Data Practices in University Online Testing Systems Across Poland

Polish universities have expanded online testing platforms over the past decade, and privacy regulators now question how these systems collect and store student information during remote assessments. Data protection authorities in several regions have opened reviews into proctoring tools that capture video feeds, keystroke patterns, and device identifiers, while university administrators report that enrollment in digital exams reached record levels by the start of the 2025 academic year.

Expansion of Remote Assessment Tools

Many higher education institutions across Poland adopted integrated testing suites that connect to student learning management systems, and these platforms often require continuous identity verification through facial recognition or government-issued document uploads. Observers note that the shift accelerated after 2020, yet questions about long-term data retention policies surfaced when students raised concerns over recordings stored on servers located outside the European Union. Researchers at several Polish technical universities documented cases where exam footage remained accessible for up to three years after graduation, prompting formal complaints to the national data protection office.

Regulatory Scrutiny Begins

Watchdog organizations filed initial inquiries in early 2026, and by September 2026 the Polish Data Protection Authority had issued guidance requiring universities to conduct impact assessments before deploying new monitoring features. European Data Protection Board guidelines on biometric data processing apply directly here, and universities must demonstrate that less intrusive alternatives were considered. One study from a Warsaw-based research institute revealed that 62 percent of surveyed students were unaware their exam sessions generated metadata shared with third-party analytics providers.

Technical Practices Under Review

Common implementations rely on browser extensions that log network activity and screen activity, and regulators examine whether these functions exceed what is necessary for academic integrity. Data flows often include IP addresses, browser fingerprints, and behavioral biometrics transmitted in real time, while storage occurs on cloud infrastructure operated by vendors based in multiple jurisdictions. Experts have observed that contracts between universities and vendors frequently lack clear clauses on deletion timelines or breach notification procedures, which creates gaps when incidents occur.

Take one technical university in Kraków that paused a new proctoring rollout after receiving a formal request for documentation from regulators. The institution had integrated an artificial intelligence module that flagged irregular eye movements, and officials later confirmed that the underlying model trained on aggregated student data without explicit consent forms covering secondary use. Similar patterns appeared at institutions in Wrocław and Gdańsk, where local oversight bodies requested audits of data processing agreements.

Student and Institutional Responses

Student organizations circulated petitions calling for transparent data maps, and several universities responded by publishing summaries of collected data categories. Administrators emphasize that exam integrity remains a priority, yet they acknowledge the need to align practices with updated interpretations of the General Data Protection Regulation. Figures from the national statistics office indicate that online exam participation grew 18 percent between 2024 and 2025, which increased the volume of personal data processed through these channels.

International comparisons show parallel developments elsewhere. A report issued by the Office of the Privacy Commissioner of Canada examined similar proctoring tools used in North American institutions, and its findings highlighted risks associated with cross-border data transfers. Australian universities faced comparable reviews from the Office of the Australian Information Commissioner, which recommended mandatory privacy-by-design reviews before procurement decisions. These examples illustrate that Polish institutions operate within a wider global conversation about balancing assessment security with individual privacy rights.

September 2026 Developments

During September 2026 the Polish Data Protection Authority scheduled public consultations with university representatives and technology vendors. Participants discussed standardized templates for consent language and minimum retention periods limited to the duration of an academic term plus one year. Observers note that proposed amendments would require annual audits of algorithmic decision systems used in flagging potential misconduct, and early drafts circulated among legal experts suggest fines could apply for repeated non-compliance.

Conclusion

Universities continue to refine their online testing infrastructure while addressing regulator requests for clearer documentation and stronger safeguards. The ongoing dialogue between institutions, vendors, and oversight bodies shapes how personal data supports academic processes without unnecessary exposure. As new guidance emerges, stakeholders track implementation timelines and adjust contracts accordingly to maintain compliance across the sector.