Spain's AEPD fined Universidad Internacional de Valencia €650,000 after it forced online-exam takers to use AI facial-recognition and room-scanning software with no real opt-out. The 2026 ruling found consent invalid since refusal meant exclusion from evaluation.
€650,000
Total AEPD fine against VIU (2026 ruling)
€300,000
Portion of the fine for unlawful biometric data processing
€350,000
Portion of the fine for a disproportionate monitoring system
€192,000
Parallel AEPD fine against Universidad Europea de Valencia for the same practice
Details
Promoter
Universidad Internacional de Valencia (VIU)
Period
2023–2026
Region (NUTS)
ES52
Keywords
higher education, exam proctoring, facial recognition, biometric data, data protection
Context
VIU, a large private distance-learning university, required students sitting online exams to run proctoring software known as 'APP1': facial-recognition identity checks, continuous webcam monitoring, and in some cases a second camera scanning the room. On 24 March 2023 a students'-rights foundation filed a complaint with Spain's data-protection authority, the AEPD, challenging the monitoring regime.
Results
The AEPD ruled that student consent was invalid because refusing meant being barred from taking the exam, so consent was not genuinely free under the GDPR. The fine totalled €650,000: €300,000 for processing biometric data without a valid legal basis, and €350,000 for a monitoring system judged unnecessary and disproportionate. A second Valencian university, Universidad Europea de Valencia, received a parallel, smaller AEPD sanction of €192,000 for the same practice.
Implementation
Indicative cost
Medium (€50k–€500k)
Time to results
Medium (1–3 years)
Staffing & skills
university online-exams administration
Conditions for success
a documented lawful basis for biometric processing beyond consent given under duress
a prior data-protection impact assessment (DPIA)
a genuine non-biometric alternative for students who object
Common failure modes
consent obtained under duress (refusal barred students from the exam)
no DPIA or proportionality assessment conducted before rollout
Commonly funded by
Own resources / municipal budget
Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.
Do you run this practice?
Claim it —
verified implementers get a public contact pathway and can propose corrections.
Data sources
Where this practice's information was retrieved from, and when.
