DPIA Summary — Gater

Online proctoring that uses biometrics is a "high risk" processing activity under GDPR Article 35 and ÚOOÚ's 2021 list of processing requiring a DPIA. This page is a public summary; the full DPIA is held by our DPO and available to supervisory authorities on request.

1. Nature of processing

Identification: Face enrolment, ID document OCR, periodic face-to-enrolment match during the exam.
Behavioural monitoring: Camera & microphone activity, screen focus, dual-camera frames, network telemetry.
Decision support: AI-assisted flagging of anomalies, surfaced to a human reviewer.

2. Necessity & proportionality

Universities have a legitimate interest and statutory duty (Act 111/1998 Sb. §49) to ensure fair admissions. Remote proctoring removes the geographic and disability barrier of compulsory in-person testing. Less-intrusive alternatives (browser-only invigilation) were considered and rejected because they do not reliably detect identity substitution. Candidates may opt for in-person alternatives offered by the institution.

3. Risks to data subjects

Risk	Mitigation
False rejection causing exam disqualification	Human review of every flag; appeal procedure via institution
Re-identification from biometric template leak	Embeddings encrypted with pgsodium secretbox; never transmitted to client; deleted on erasure
Discrimination (face recognition bias)	Multiple liveness modalities; manual fallback path; performance monitored across demographics
Surveillance creep	Capture limited to exam duration; recordings auto-purged per retention policy; no behavioural profiling outside exams
Function creep into law-enforcement use	Contractual ban in DPA; biometric data inaccessible to bulk export

4. Safeguards

Explicit Art.9(2)(a) consent collected at session start via a separable consent gate.
Encryption at rest (AES-256 / XSalsa20-Poly1305) and in transit (TLS 1.2+).
Strict role-based access control with audit log on every privileged action.
Retention: face embedding deleted on account erasure; snapshots 60 days default, configurable per institution.
Right to a human reviewer; right to an in-person alternative.

5. Residual risk

After mitigations the residual risk is assessed as low–moderate. We do not consider prior consultation with ÚOOÚ under Art.36 to be required, but will reassess after each significant change (new biometric modality, new AI grader, change of subprocessor).

6. Review cadence