SMOWL data protection

Data protection serves a twofold purpose for organizations: complying with privacy regulations and protecting the brand’s reputation by taking care of customers’ and users’ sensitive information.

At Smowltech, responsibility, protection and transparency are the pillars of our work. These three principles guide the design of SMOWL, our proctoring solution, and every improvement we make to it.

With each development, we aim to:

• Offer an effective, unobtrusive online assessment solution that only processes the data that is strictly necessary.
• Comply with European and Spanish data protection regulations.

What is data protection?

Data protection is the set of rules and measures that ensure personal data is processed lawfully, fairly and securely. Under the GDPR, personal data is any information relating to an identified or identifiable natural person.

Its goal is to safeguard people’s fundamental rights and freedoms, especially their right to privacy. It comes with specific rights: access, rectification, erasure, restriction of processing, objection and data portability.

What is our data protection protocol?

Technical and legal requirements must meet the needs of both customers (universities, training centers and companies) and users (students and employees). Our protocol rests on seven pillars.

1. We comply with the law

SMOWL complies with the two key regulations that apply to our activity:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, the General Data Protection Regulation (GDPR).
• Spain’s Organic Law 3/2018 of December 5 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

Both regulations protect citizens’ personal information.

2. We conduct an impact assessment

In line with Article 35 of the GDPR, we have carried out a data protection impact assessment (DPIA) of the platform, validated by our data protection officer. We also monitor the risks associated with the data processed during proctoring.

3. We have appointed a data protection officer

Our data protection officer (DPO) performs the tasks set out in the GDPR: advising the company, monitoring compliance and acting as the point of contact for the supervisory authority and for data subjects.

4. We are transparent

We meet the information requirements of Articles 12 and 13 of the GDPR with our customers and, when necessary, with the users of the solution.

We explain what data we process, for what purpose and how our system works. All of this information is available in our privacy policy.

5. We protect users’ rights

We start from the premise that technology must respect the principles of lawfulness, necessity, proportionality and data minimization set out in the regulation.

Within this framework, each customer institution acts as the data controller and Smowltech as the data processor: the institution decides how SMOWL is used and how long data is kept, and Smowltech applies what has been agreed with it.

6. We keep a record of processing activities

This record lists the purpose, the categories of data and the retention period of the data processed. To limit exposure, SMOWL links the user’s data to a pseudonymized code rather than to their name or email address.

Unless the institution sets a different period, proctoring evidence remains available for 12 months. It is then blocked for an additional period and then permanently deleted.

7. We reinforce security

Our infrastructure is hosted by Amazon Web Services (AWS) in the Ireland region, within the European Union, and no data is transferred outside the EU. Smowltech is also ISO 27001 certified and holds the basic-category certification of Spain’s National Security Framework (ENS), both of which involve regular external audits.

In the event of a personal data breach, notification is made within the 72-hour period set by the GDPR.

We comply with everything and everyone

With SMOWL, we achieve three goals at the same time:

• Providing an educational solution for online assessments.
• Delivering a positive user experience.
• Ensuring regulatory compliance and transparency.

Our data protection and privacy protocol balances these three points to provide a solution that is effective for the institution and easy for the student, while complying with the law.

And we do this with the different types of proctoring that SMOWL offers.

Webcam monitoring

SMOWL does not record continuous video: it captures periodic images during the activity. These images are used for user authentication, that is, to check with artificial intelligence that the person in front of the camera is the same person who started the test.

This is a one-to-one comparison (authentication), not a one-to-many identification: the system never compares the person with other identities.

The features extracted from the image to authenticate the person are biometric data under the GDPR. When authentication relies on biometric data, it requires the user’s explicit consent (Article 9(2)(a) of the GDPR) and the biometric template is deleted once authentication is complete.

When the institution asks for a photo of an ID document, SMOWL can automatically mask the document’s data, such as the name, address or number, and keep visible only the photo and layout needed for the check.

Finally, the system flags incidents but never makes decisions: it is always the institution that reviews the evidence and decides.

Computer monitoring

With Computer Monitoring, through the SMOWL CM tool, we analyze the user’s activity on their computer only for the duration of the test: programs used, web browsing, commands and screenshots. Monitoring stops automatically when the exam ends.

Audio capture

Depending on the configuration chosen by the institution, SMOWL can analyze audio during the test. If it detects a voice or an unusual sound, it records it as a possible incident for the institution to evaluate. That decision is never ours to make.

Conclusion

Technology is advancing rapidly and can sometimes conflict with people’s rights and the protection of their data. That is why constant vigilance is needed so that new digital tools and fundamental rights can coexist in harmony.

This oversight depends on people: developers, legislators and data protection officers, who create advanced tools and, at the same time, the mechanisms that ensure rights are respected.

Human responsibility is, and will remain, essential to close the gaps that technical innovation sometimes leaves.

Want to know how SMOWL adapts to your institution’s data protection requirements? Request a free demo.