Starting in April 2020, students at a university in Italy had their sensitive biometric facial data, screen activities, and video recordings captured and analyzed by the ‘Respondus’ proctoring software during remote exams. The software automatically flagged behaviors deemed suspicious and compiled automated surveillance logs on the students without a valid legal basis or proper student consent. Additionally, this personal and biometric data was transferred to servers in the United States without adequate legal safeguards, violating the students’ data privacy rights under the GDPR.