Search

Online Examination Privacy Policy

The Irish Taxation Institute trading as “Irish Tax Institute” (Institute, our, us or we) is committed to protecting the privacy and security of your personal data.

This privacy notice describes how we collect and use the personal data of individuals who complete or take our examinations that are delivered and invigilated online (also referred to in this notice as ‘you‘ or  the ‘test taker/exam candidate).

This notice, together with our General Data Protection Notice (external), sets out how and why we use your personal data.

DATA CONTROLLER

The Institute is a “data controller” which means that we are responsible for deciding how we hold and use personal data about you.

HOW IS YOUR PERSONAL DATA COLLECTED?

When taking an examination online, your data will be collected by the assessment delivery application and by the online invigilation application.

WHAT DATA WILL WE COLLECT FROM YOU DURING AN ONLINE EXAMINATION

Personal data is collected to ensure a fair examination system where all Institute students adhere equally to the Student Regulations  as may be updated from time to time). Online examinations are currently delivered by two vendors, (i) Cirrus Assessment, who deliver the assessments online; and (ii) Proctorio, who provide an automated online invigilation system to ensure students’ compliance with the Student Regulations.

The following data is collected to allow you (as the test taker/exam candidate) to log into the system and to confirm your identity (Category A):

  • Your name, student number and candidate number
  • Image of a valid identification document bearing your photograph (namely, a valid driving licence, passport or Garda Identification (National Age Card)) (‘ID Document‘)
  • Video recordings of you (as the test taker/exam candidate) verifying your identity by showing the ID Document

In addition, the following data is collected to ensure that you (as the test taker/ exam candidate) follow our Student Regulations (Category B):

  • Video and audio recordings of you while taking our exams
  • Recordings of your on-screen activities during our exams
  • Flags indicating suspected non-conformance by you with our Student Regulations
  • Your IP Address (last octet removed)
  • Your System Information (browser, cpu, ram, internet connection)
  • Any URLs viewed by you during our exams

The following data is collected if, during the online examination, you require support for technical difficulties while using Proctorio services (Category C):

  • Your name and email address
  • Your contact phone or mobile number

The following data is collected in order to run the examinations: (Category D):

  • Your exam scripts
  • Your exam grades
  • Any adjustments of your exams arising from Reasonable Accommodation as defined in section 5 of the Student Regulations
  • Your candidate number

THE PURPOSE AND LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

We will only use your personal data in the following circumstances:

  • Where we need to perform the contract we have entered into with you
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests

The table below describes the legal basis that applies to our purposes for processing your personal data. Depending on the circumstances, more than one legal basis may apply:

Purpose for processing Categories of personal data Legal basis for processing
Verify your identity as the test taker/exam candidate, to ensure compliance by you with our Student Regulations, for any investigations and appeals and to contact you to provide assistance during the online exams A, B, C Performance of a contract with you;

Necessary for our legitimate interests for running and maintaining our business, performance of our examination function and ensuring compliance with our Student Regulations.

To run online examinations and ensure that you (as the test taker/exam candidate) undertake the examinations in accordance with our Student Regulations D Performance of a contract with you;

Necessary for our legitimate interests for running and maintaining our business, performance of our examination function and ensuring compliance with our Student Regulations

AUTOMATED DECISION-MAKING

Examinations are marked by human markers who access exam scripts and mark the questions according to the marking standard specified by the Institute.

The online invigilation system will flag activities that could indicate suspected non-conformance with Student Regulations and in particular sections 10A and 11A. However, no automated decisions will be made based on these flags.

Based on the above, we believe that we will not be making any decisions based solely on automatic processing. However, we will notify you in writing if there are any changes in this regard.

DATA SHARING & INTERNATIONAL TRANSFERS

We will share your personal data with third party service providers including Cirrus Assessment and Proctorio and their approved sub-processors or with other parties where required by law.

Any Categories A, C and D data is stored by Cirrus Assessment in Amazon Web Services (AWS) hosting environments in Ireland.

Any Categories A and B data recorded by Proctorio during the examination are stored on Microsoft Azure in Germany. Proctorio utilizes zero-knowledge encryption, which means they have zero access to the encrypted data on their own servers. Proctorio does not know anything about the data stored in their servers. This unique design allows nothing to leave your computer until after it is encrypted. Data never becomes unencrypted until it is unlocked by an authorized Institute official. It is not just end-to-end encryption, it is a zero-knowledge system.

Any Category C data recorded by Proctorio is stored in the United States of America. Proctorio is part of the Privacy Shield which requires them to provide similar protection to personal data shared between EU and the US.

We may share your personal data with your employers where they are paying your membership fees or course or examination fees to advise them of your examination results and of any contraventions by you of our Student Regulations (such as plagiarism or personation) and confirming with them (as well as ensuring) your compliance with our Student Regulations as well as providing them with any personal data or documents containing personal data that may indicate contravention of such regulations.

DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

DATA RETENTION

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for. The retention periods below will normally apply to the examination process. However, we may retain your personal data for a longer period in the event of a complaint, appeal or investigation where a breach of our Student Regulations is suspected or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

Once any such examination review process has been completed, subject to the above, the Institute will delete (where applicable) the relevant data from its own systems.

Type of Data Retention Period
Examination scripts 1 month from the date that an application for a recheck can be made or from the date the notification of the recheck result is issued (whichever is the later)
Video and audio recordings of you taking our exam

Recordings of your on-screen activities during our exams

Flags indicating suspected non-conformance by you with our Student Regulations

Your IP Address (last octet removed)

Your System Information (browser, cpu, ram, internet connection)

Any URLs viewed by you during the exams

1 month following the date of the examination or in the case where an investigation into non-conformance with the Student Regulations is initiated, 1 month from the date that an appeal can be filed against the investigation’s findings or from the date of the decision of the appeal (whichever is the later)
Images of ID Document

Video recordings of you verifying your identity by showing the ID Document

1 month following the date of the examination or in the case where an investigation into non-conformance with the Student Regulations is initiated, 1 month from the date that an appeal can be filed against the investigation’s findings or from the date of the decision of the appeal (whichever is the later)
Your name, student number, candidate number and exam grades

Any adjustments of your exams arising from Reasonable Accommodation

Indefinite

Your Legal Rights

Under certain circumstances, by law you have the right to:

  • Request access to your personal data.
  • Request correction of the personal data that we hold about you.
  • Request erasure of your personal data.
  • Object to processing of your personal data.
  • Request the restriction of processing of your personal data.
  • Request the transfer of your personal data to another party.

Please click on link to find out more about these rights.

If you want to exercise any of the above rights, please contact Martin Carney in writing at Irish Tax Institute, South Block, Longboat Quay, Grand Canal Harbour, Dublin 2, or contact us by email us at dataprivacy@taxinstitute.ie. If you wish to access your personal details you can use our Request Form.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you and Response Time to Request

We may need to request specific information from you to help us confirm your identity and ensure your right to access the data (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We will respond to your request in writing, or orally if requested, as soon as practicable and in any event within one month of receipt of your request. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

DATA PRIVACY CONTACT

If you have any questions about this event privacy notice or how we handle your personal data, please contact Martin Carney at dataprivacy@taxinstitute.ie. You have the right to make a complaint at any time to the Data Protection Commission (DPC), the Irish supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the DPC, so please contact us in the first instance.

CHANGES TO THIS ONLINE EXAMINATION PRIVACY NOTICE

We reserve the right to update this online examination privacy notice at any time and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.

ANY QUERIES?

 If you have any questions about this privacy notice, please contact Martin Carney at dataprivacy@taxinstitute.ie.

Last Updated: June 2020