Online Examination Privacy Policy
The Irish Taxation Institute trading as “Irish Tax Institute” (Institute, our, us or we) is committed to protecting the privacy and security of your personal data.
This privacy notice describes how we collect and use the personal data of individuals who complete or take our examinations that are delivered and invigilated online (also referred to in this notice as ‘you‘ or the ‘test taker/exam candidate).
This notice, together with our General Data Protection Notice (external), sets out how and why we use your personal data.
DATA CONTROLLER
The Institute is a “data controller” which means that we are responsible for deciding how we hold and use personal data about you.
HOW IS YOUR PERSONAL DATA COLLECTED?
When taking an examination online, your data will be collected by the assessment delivery application and by the online invigilation application.
WHAT DATA WILL WE COLLECT FROM YOU DURING AN ONLINE EXAMINATION
Personal data is collected to ensure a fair examination system where all Institute students adhere equally to the Student Regulations as may be updated from time to time). Online examinations are currently delivered by (i) Cirrus Assessment, who deliver the assessments online in which the anti-plagiarism software provided by Turnitin will be integrated; and (ii) Proctorio, who provide an automated online invigilation system to ensure students’ compliance with the Student Regulations.
The following data is collected to allow you (as the test taker/exam candidate) to log into the system and to confirm your identity (Category A):
- Your name, student number and candidate number
- Image of a valid identification document bearing your photograph (namely, a valid driving licence, passport or Garda Identification (National Age Card)) (‘ID Document‘)
- Video recordings of you (as the test taker/exam candidate) verifying your identity by showing the ID Document
In addition, the following data is collected to ensure that you (as the test taker/exam candidate) follow our Student Regulations (Category B):
- Video and audio recordings of you while taking our exams
- Recordings of your on-screen activities during our exams
- Flags indicating suspected non-conformance by you with our Student Regulations
- Your IP Address (last octet removed)
- Your System Information (browser, cpu, ram, internet connection)
- Any URLs viewed by you during our exams
The following data is collected if, during the online examination, you require support for technical difficulties while using Proctorio services (Category C):
- Your name and email address
- Your contact phone or mobile number
- Your IP Address (last octet removed)
- Your System Information (browser, cpu, ram, internet connection)
- Content of your email
The following data is collected in order to run the examinations: (Category D):
- Your exam scripts
- Your exam grades
- Any adjustments of your exams arising from Reasonable Accommodation as defined in section 5 of the Student Regulations
- Your candidate number
THE PURPOSE AND LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA
We will only use your personal data in the following circumstances:
- Where we need to perform the contract we have entered into with you
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
The table below describes the legal basis that applies to our purposes for processing your personal data. Depending on the circumstances, more than one legal basis may apply:
| Purpose for processing | Categories of personal data | Legal basis for processing |
| Verify your identity as the test taker/exam candidate, to ensure compliance by you with our Student Regulations, for any investigations and appeals and to contact and liaise with you in order to provide assistance during the online exams | A, B, C | Performance of a contract with you;
Necessary for our legitimate interests for running and maintaining our business, performance of our examination function and ensuring compliance with our Student Regulations. |
| To run online examinations and ensure that you (as the test taker/exam candidate) undertake the examinations in accordance with our Student Regulations | D | Performance of a contract with you;
Necessary for our legitimate interests for running and maintaining our business, performance of our examination function and ensuring compliance with our Student Regulations |
AUTOMATED DECISION-MAKING
Examinations are marked by human markers who access exam scripts and mark the questions according to the marking standard specified by the Institute.
The online invigilation system will flag activities that could indicate suspected non-conformance with Student Regulations and in particular sections 10A and 11A. However, no automated decisions will be made based on these flags.
Based on the above, we believe that we will not be making any decisions based solely on automatic processing. However, we will notify you in writing if there are any changes in this regard.
DATA SHARING & INTERNATIONAL TRANSFERS
We will share your personal data with third party service providers including Cirrus Assessment, Turnitin and Proctorio and their approved sub-processors or with other parties where required by law.
Any Categories A, C and D data is stored by Cirrus Assessment in Amazon Web Services (AWS) hosting environments in Ireland.
Any Categories A and B data recorded by Proctorio during the examination are stored on Microsoft Azure in the Netherlands and/or Germany. Proctorio utilizes zero-knowledge encryption, which means they have zero access to the encrypted data on their own servers. Proctorio does not know anything about the data stored in their servers. This unique design allows nothing to leave your computer until after it is encrypted. Data never becomes unencrypted until it is unlocked by an authorized Institute official. It is not just end-to-end encryption, it is a zero-knowledge system.
Any Category C data recorded by Proctorio is stored in the United States of America. Appropriate safeguards (namely standard contractual clauses under Article 46 of the GDPR) have been put in place to protect your personal data. Please contact us if you want to access or obtain a copy of these agreements.
Any Categories C and D data processed by Turnitin or its third party providers for software functionality, engineering, security or customer support purposes is stored in the United States of America, Ukraine and India. Appropriate safeguards (namely standard contractual clauses under Article 46 of the GDPR) have been put in place to protect your personal data. Please contact us if you want to access or obtain a copy of these agreements. Any Categories C and D data may also be processed by Turnitin in the UK for engineering or customer support purposes which is subject to an adequacy decision by the EU who has deemed that the UK provides adequate protection for the privacy rights of individuals.
We may share your personal data with your employers where they are paying your membership fees or course or examination fees to advise them of your examination results and of any contraventions by you of our Student Regulations (such as plagiarism or personation) and confirming with them (as well as ensuring) your compliance with our Student Regulations as well as providing them with any personal data or documents containing personal data that may indicate contravention of such regulations.
Our external exam markers and moderators will also have access to (anonymous) exam scripts for marking purposes.
DATA SECURITY
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
DATA RETENTION
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for. The retention periods below will normally apply to the examination process. However, we may retain your personal data for a longer period in the event of a complaint, appeal or investigation where a breach of our Student Regulations is suspected or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.
| Type of Data | Retention Period |
| Examination scripts | 1 month from the date that recheck results are issued |
| Video and audio recordings of you taking our exam
Recordings of your on-screen activities during our exams Flags indicating suspected non-conformance by you with our Student Regulations Your IP Address (last octet removed) Your System Information (browser, cpu, ram, internet connection) Any URLs viewed by you during the exams |
Whichever is the later, (i) 6 weeks following the date of the examination or (ii) in the case where an investigation into non-conformance with the Student Regulations is initiated, 1 month from the date that an appeal can be filed against the investigation’s findings or from the date of the decision of the appeal (whichever is the later)
|
| Images of the ID Document
Video recordings of you verifying your identity by showing the ID Document |
Whichever is the later, (i) 6 weeks following the date of the examination or (ii) in the case where an investigation into non-conformance with the Student Regulations is initiated, 1 month from the date that an appeal can be filed against the investigation’s findings or from the date of the decision of the appeal (whichever is the later) |
| Your name, student number, candidate number and exam grades
Records of module grades, Assessment sub-committee grids recheck grades, student transcript/results and conferring records etc. |
Indefinite |
Once any such examination review process has been completed, subject to the above, the Institute will delete (where applicable) the relevant data from its own systems.
Your Legal Rights
Under certain circumstances, by law you have the right to:
- Request access to your personal data.
- Request correction of the personal data that we hold about you.
- Request erasure of your personal data.
- Object to processing of your personal data.
- Request the restriction of processing of your personal data.
- Request the transfer of your personal data to another party.
Please click on link to find out more about these rights.
If you want to exercise any of the above rights, please contact Martin Carney in writing at Irish Tax Institute, South Block, Longboat Quay, Grand Canal Harbour, Dublin 2, or contact us by email us at dataprivacy@taxinstitute.ie. If you wish to access your personal details you can use our Request Form.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you and Response Time to Request
We may need to request specific information from you to help us confirm your identity and ensure your right to access the data (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We will respond to your request in writing, or orally if requested, as soon as practicable and in any event within one month of receipt of your request. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
DATA PRIVACY CONTACT
If you have any questions about this event privacy notice or how we handle your personal data, please contact Martin Carney at dataprivacy@taxinstitute.ie. You have the right to make a complaint at any time to the Data Protection Commission (DPC), the Irish supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the DPC, so please contact us in the first instance.
CHANGES TO THIS ONLINE EXAMINATION PRIVACY NOTICE
We reserve the right to update this online examination privacy notice at any time and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.
ANY QUERIES?
If you have any questions about this privacy notice, please contact Martin Carney at dataprivacy@taxinstitute.ie.
Last Updated: October 2023