On February 23, 2024, the Information and Privacy Commissioner of Ontario (IPC) published its investigation report on McMaster University's use of Respondus exam proctoring software after receiving a complaint.

Background to the investigation

In particular, the IPC explained that the Respondus Monitor analyzes audio and video of students during the exam to scan for possible cheating, raising concerns over the collection of sensitive personal information through the use of artificial intelligence (AI) and biometric information.

Findings of the IPC

The IPC found that, although the collection of personal information necessary for the operation of the software is authorized pursuant to Section 38(2) of the Freedom of Information and Protection of Privacy Act (the Act), the University did not provide adequate notice for its collection as required by Section 39(2) of the Act, and the use of students' personal information through the software was not in compliance with Section 41(1) of the Act.

Furthermore, the IPC found that the contractual arrangement between the University and Respondus did not adequately protect all of the personal information collected and allowed Respondus to use the information for system improvement purposes without the consent of students, thereby contravening Section 41(1) of the Act.

Outcomes

Consequently, the IPC provided a list of recommendations for the University to bring itself into compliance with the Act and implored it to adopt additional safeguards around its use of AI.

You can read the investigation report here.