In a preliminary victory in the continuing fight against privacy-invasive software that “watches” students taking tests remotely, a French administrative court outside Paris suspended a university’s use of the e-proctoring platform TestWe, which monitors students through facial recognition and algorithmic analysis.

TestWe software, much like Proctorio, Examsoft, and other proctoring apps we’ve called out for intrusive monitoring of exam takers, constantly tracks students’ eye movements and their surroundings using video and sound analysis. The court in Montreuil, France, ruled that such “permanent surveillance of bodies and sounds” is unreasonable and excessive for the purpose preventing cheating.

Proctoring apps came roaring on the scene during the COVID-19 pandemic when closed schools switched to remote learning. Proctoring software makers promised schools a way to continue to administer and control high-stakes tests to students at home—by surveilling them, tracking their keystrokes, checking if their eyes moved away from the screen, and watching to see if they navigated away from the test, all through their computers.

There’s a lot wrong with these apps. They invade students’ privacy, exacerbate existing inequities in educational outcomes, and can never fully match the control schools are used to enforcing in the test hall. And they are faulty: ProctorU, one of the largest remote proctoring companies, recently stopped selling fully-automated proctoring services because too few administrators and teachers were reviewing the results to determine whether or not a flagged violation was actually a violation. Although many students have gone back to in-person learning, remote proctoring is still in use, and we don’t believe it is going away anytime soon.

The TestWe case is one of the first we’ve seen in Europe challenging proctoring software. It’s a good sign on two fronts. It shows that concerns about what some have called “legitimized spyware” are shared by students and digital rights defenders around the world. And like students here in the U.S., they’re challenging the use of these invasive apps, which can collect facial images, keystrokes, eye movements, background images, and sounds, as well as personal information like addresses, phone numbers, and birthdates, and rate students as suspicious for moving their eyes away from their screens for too long.

It also shows courts are beginning to recognize that technologies enabling 360-degree, wall-to-wall, and biometric surveillance of students in their private settings, like their own living rooms or bedrooms, are an illegal, over-the-top method to combat cheating. In a U.S. case challenging the use of monitoring technology at Cleveland State University, a federal court in Ohio last year ruled that one of the more invasive proctoring techniques—the “room scan”—was unconstitutional because it provides a window into our homes, private spaces protected from government intrusion by the Fourth Amendment. Under the Fourth Amendment, government institutions like a state-run school would generally need a warrant to search inside someone’s home.

The TestWe case arose after the Distance Learning Institute—University of Paris 8, where all classes are remote, started using it for examinations. It automatically checks their identities at the beginning and during the test. It requires that all firewalls and antivirus apps are deactivated. The classic version of the app photographs students every three seconds. The images are analyzed, and any “suspicious behavior” is reported to the platform.

EID student Jodi-Marie Masley, an American attorney studying at the school, took a stand against this intrusive technology. “I couldn’t believe they were spying on us on top of all the stress of taking exams,” she said. She was the original plaintiff in the lawsuit. We learned about the case from Paris-based digital rights group La Quadrature du Net (LQDN), which made successful legal arguments to the court on behalf of the students, saying TestWe’s software didn’t meet the standards established by the EU’s General Data Protection Regulation (GDPR) for processing people’s personal data.

Under the GDPR, processing of personal data must be authorized by law, have a legitimate purpose, and be proportional to its purpose. LQDN argued that TestWe’s software had no lawful basis among those provided for by the GDPR and was disproportionate to the intended purpose, i.e. the proctoring of a remote exams.

As reported by LQDN, the court zeroed in on the proportionality issue, finding that there were serious doubts about whether TestWe complies with the GDPR’s data minimization requirement, which mandates that entities accessing personal data can only collect what is needed for the specified purpose. In a preliminary ruling, the court suspended the use of TestWe. The win, though preliminary, is significant and shows that European courts recognize that algorithmic surveillance systems lack proportionality.

“It is rather good news that the judge is open to this argument: this means the scope of the student information and data TestWe collects and processes is far too large and disproportionate for the stated purpose. In short, just because the data exists or is available does not mean it is legal to use it for any purposes,” LQDN said in a blog post about the ruling.

“The administrative court of Montreuil sent a clear warning to all other universities and schools,” LQDN said. “This is the real value of the TestWe ruling: the proportionality of this kind of permanent algorithmic surveillance is now seriously questioned.

The opinion, in French, is here.

While this ruling was a clear win, the fight against the way the EID used TestWe isn’t over. The court’s preliminary ruling held that there is serious doubt that the app is legal. LQDN still must convince the court to definitively rule that the app is illegal, and its use should be permanently suspended, a process that will take several months.