Full title: Instruction of 20th April 2020 from the University of Granada’s Secretary’s Office on the application of data protecion regulations in the use of digital tools.
On 14th March 2020 a State of Alarm was declared in Spain by Royal Decree 463/2020, as a consequence of the international pandemic caused by Covid-19. Following that declaration, the Government adopted a series of measures to contain the pandemic in the field of education and training consisting, on the one hand, of the suspension of all on-campus or face-to-face activity in all educational centres at all stages, levels, cycles years or courses, including universities; and, on the other hand, the continuing of educational provision in distance and on-line modes (Art. 9 of Royal Decree 463/2020). The State of Alarm has been extended until 26th April 2020 and further extensions are possible.
In the light of the extension of the State of Alarm, the Rectors of the Association of Andalusian Public Universities and the Andalusian Regional Ministry for the Economy, Knowledge, Enterprises and Universities reached agreement on 2nd April 2020, in which they decided to maintain off-campus teaching and learning for the remainder of the academic year 2019-20, also covering assessment, if the State of Alarm were to continue until the dates established for final assessment. This agreement has in turn led to the drafting of a Contingency Plan which lays down the specific procedures for off-campus teaching and learning and, where appropriate, off-campus assessment.
The implementation of this Contingency Plan, which is exceptional and temporary in nature, requires regulations to be suspended in some cases, in favour of those established in the Plan, in other cases a change in the way in which regulations are normally applied or, in others, a flexible interpretation of existing regulations. The Plan will expire when the State of Alarm is lifted, and permission is given to continue face-to-face, on-campus teaching activities.
In this context, the University of Granada, in order to fulfil its role as a public service in higher education, has necessarily had to adapt its teaching function to remote, off-campus mode, and to offer the members of the university community the most appropriate digital tools to that effect.
The use of digital tools implies the processing of personal data, and the University of Granada, as the entity responsible, is obliged to guarantee the security of the processing of that information in order to comply with the principles laid down in the European Regulation on Data Protection. The use of tools not foreseen in these Instructions which do not fulfil the recommended security requirements may lead to security risks and/or non-compliance with data protection regulations.
These instructions are established in the context of the exceptional circumstances derived from the declaration of the State of Alarm, and thus do not derive from prior planning, but rather from the Contingency Plan. Thus, these emergency circumstances imply the adoption of a general decision authorizing the use of certain digital tools necessary and useful for the fulfilment of the University’s remote teaching obligations. This does not prevent progress being made in the meantime in the improvement of mechanisms to ensure the security of information and the processing of personal data, in order to ensure the compatibility of digital tools and procedures with regulations governing data protection.
Accordingly, the following measures are established.
ONE
The use of the various digital tools provided to the members of the University community for teaching sessions or professional meetings implies the processing of personal data. These tools are the following:
- G-Suite: The processing of personal data by Google as directly responsible for processing or by companies to which Google transfers data for subsequent processing, is covered by the US-EU Privacy Shield, held by Google, which also holds Spanish National Security Scheme certification (ENS).
Members of the University community must access G-Suite services via their @go.ugr.es account
- Adobe Connect: Also hold the Privacy Shield and ENS certification.
- SALVE (currently based on Zoom): Zoom also holds the Privacy Shield. Its use is recommended for cases when sensitive data are not being handled, in accordance with Article 9.2 of the General Data Protection Regulation, and Article 9 of Spanish Organic Law 3/2018, on the Protection of Personal Data and the guarantee of digital rights. Use of this tool is limited to meetings of collegiate bodies and professional meetings other than classes and sessions devoted to assessment.
- JITSI: An open source tool to which access is permitted through https://meet.jit.si, since the provider 8x8 INC holds the US-EU Privacy Shield.
This set of digital tools provided to the University community may vary in time during this emergency period; information regarding changes will be notified via the covid19.ugr.es website.
TWO.
The aforementioned tools must be used in accordance with the recommendations established by the Rector’s Office for the Digital University
THREE.
Recording of videoconference sessions.
In general, the use of Google Meet is recommended for the recording of videoconference sessions. The use of SALVE is also recommended for the uses indicated in point ONE above. In both cases, recordings will be stored in Google Drive.
- 1.To record a class attended by students and taught by videoconference, it is compulsory to fulfil the following guidelines:
- Under no circumstances shall students distribute the links to access the meeting to third parties.
- Settings should ensure that recorded material can only be reproduced, but not downloaded.
- At the beginning of the recording, the following text must be read to inform students of the conditions under which the recording is carried out:
“You are hereby notified of the conditions of use of the videoconference application which is about to be used:
The session is going to be recorded in order to allow students to access the content of the class at a later stage.
You are recommended to switch off the camera on your device if you do not wish to be seen by the other participants.
It is forbidden to capture and/or to record, reproduce or disseminate part or all the content of the session, by any means or device. Any unauthorized act will constitute a violation of the applicable regulations, and as such may result in legal liability.”
- 2. Assessment sessions by videoconference will be recorded in all cases, in order to guarantee students’ rights and teaching staff’s obligation to retain records of assessment exercises, as established in University of Granada Assessment Policy and Regulations, and point four of these instructions.
To this end, the following guidelines must be applied:
- Under no circumstances shall students distribute the links to access the meeting to third parties.
- Settings should ensure that recorded material can only be reproduced, but not downloaded.
- At the beginning of the recording, the following text must be read to inform students of the conditions under which the recording is carried out:
“You are hereby notified of the conditions of use of the videoconference application which is about to be used:
The session is going to be recorded in order to guarantee students’ rights under University of Granada Assessment Policy and Regulations, and to fulfil the teaching staff’s obligation to retain records of assessment exercises established in the same regulations.
Both the camera and the microphone must be switched on.
It is forbidden to capture and/or to record, reproduce or disseminate part or all the content of the session, by any means or device. Any unauthorized act will constitute a violation of the applicable regulations, and as such may result in legal liability.”
- 3. Meetings of collegiate bodies held by videoconference may be recorded in accordance with their respective regulations, or by agreements reached by the body itself, given the exceptional circumstances. Settings should ensure that recorded material can only be reproduced, but not downloaded.
Members of the collegiate body must be notified of the recording at the beginning of the session, by reading the following text:
"This session is going to be recorded in order to enable members of this body or other parties with accredited legitimate interest, to access the content of the session at a later stage. Attendees who are not members of the body should switch off their camera if they do not wish to be seen by other participants. Individual members of the body and guest attendees are forbidden to capture and/or to record, reproduce or disseminate part or all the content of the session, by any means or device. Any unauthorized act will constitute a violation of the applicable regulations, and as such may result in legal liability. You are hereby duly informed.”
- 4. Videoconference sessions for meetings other than classes, assessment or meetings of collegiate bodies may be recorded only under the following conditions:
- Settings should ensure that recorded material can only be reproduced, but not downloaded.
- At the beginning of the recording, the following text must be read:
“You are notified of the following:
- The session is going to be recorded in order to enable attendees to access the content of the session at a later stage.
- Attendees are forbidden to capture and/or to record, reproduce or disseminate part or all the content of the session, by any means or device. Any unauthorized act will constitute a violation of the applicable regulations, and as such may result in legal liability.
- If no explicit objection is voiced, it will be understood that all attendees have given their unequivocal consent.
- Should any attendee object to the recording of the session, they should mute their microphone and switch off their camera, and may interact via the chat function”.
- 5. The use of any other tool is subject compliance with the General Data Protection Regulation on the part of the licensees; the recommendation is to use only external providers with ENS conformity certification.
FOUR.
Guaranteeing correct processing of data in remote assessment.
In order to ensure the security of information and processing of personal data, the following regulations are established for remote assessment:
- The author of each activity should be identified and evidence of all assessment activities be retained.
- The PRADO institutional platform shall be used for remote assessment, Google Meet for videoconferencing and Google Drive for the storage of recorded sessions and large files. Members of the University community must access G-Suite services via their @go.ugr.es account.
- Should the service provided by these platforms prove defective or any other circumstance make it necessary, the use of other alternative platforms will be authorized.
- In assessment exercises held by videoconference, students must accredit their identity by showing their Spanish National Identity Card, or any other valid identity document accepted by the University of Granada.
- Assessments held by videoconference must be recorded, in order to guarantee students’ rights and teaching staff’s obligation to retain records of assessment exercises, in accordance with UGR Assessment Policy and Regulations.
