evidoria

← Back to browse

Good practice Imported

Universidad Internacional de Valencia's Mandatory Facial-Recognition Exam Proctoring — AEPD's €650,000 Cautionary Fine

Spain · Valencia · See the Spain profile · See the Valencia profile

Evidence: Descriptive / self-reported · Ask Evidence Copilot about this practice

Spain's AEPD fined Universidad Internacional de Valencia €650,000 after it forced online-exam takers to use AI facial-recognition and room-scanning software with no real opt-out. The 2026 ruling found consent invalid since refusal meant exclusion from evaluation.

€650,000
Total AEPD fine against VIU (2026 ruling)
€300,000
Portion of the fine for unlawful biometric data processing
€350,000
Portion of the fine for a disproportionate monitoring system
€192,000
Parallel AEPD fine against Universidad Europea de Valencia for the same practice
Universidad Internacional de Valencia's Mandatory Facial-Recognition Exam Proctoring — AEPD's €650,000 Cautionary Fine Universidad Internacional de Valencia's Mandatory Facial-Recognition Exam Proctoring — AEPD's €650,000 Cautionary Fine

Details

Promoter
Universidad Internacional de Valencia (VIU)
Period
2023–2026
Region (NUTS)
ES52
Keywords
higher education, exam proctoring, facial recognition, biometric data, data protection

Context

VIU, a large private distance-learning university, required students sitting online exams to run proctoring software known as 'APP1': facial-recognition identity checks, continuous webcam monitoring, and in some cases a second camera scanning the room. On 24 March 2023 a students'-rights foundation filed a complaint with Spain's data-protection authority, the AEPD, challenging the monitoring regime.

Results

The AEPD ruled that student consent was invalid because refusing meant being barred from taking the exam, so consent was not genuinely free under the GDPR. The fine totalled €650,000: €300,000 for processing biometric data without a valid legal basis, and €350,000 for a monitoring system judged unnecessary and disproportionate. A second Valencian university, Universidad Europea de Valencia, received a parallel, smaller AEPD sanction of €192,000 for the same practice.

Implementation
Indicative cost
Medium (€50k–€500k)
Time to results
Medium (1–3 years)
Staffing & skills
university online-exams administration

Conditions for success

  • a documented lawful basis for biometric processing beyond consent given under duress
  • a prior data-protection impact assessment (DPIA)
  • a genuine non-biometric alternative for students who object

Common failure modes

  • consent obtained under duress (refusal barred students from the exam)
  • no DPIA or proportionality assessment conducted before rollout

Commonly funded by

Own resources / municipal budget

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Attachments

Similar practices you may find useful