☰

E-assessment privacy statement

Chartered Accountants Ireland (the “Institute”)respects candidates’ right to privacy. This statement (published on our website) sets out the Institute's policy for safeguarding information disclosed to us. Any personal information voluntarily provided to the Institute will be treated with the highest standards of security and confidentiality, in strict accordance with applicable data protection rules, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the General Data Protection Regulation (the “GDPR”).

The Institute is committed to meeting its obligations as a Data Controller within the meaning of the GDPR. This commitment is described in the Institute’s general Privacy Statement and extends to the personal data processed on behalf of candidates undertaking exams through the E-Assessment platform.

Where the Institute requests personal information - such as candidate name and address - from which you can be individually identified, this will only be done for specific purposes ( e.g. registration). In every case, candidates will be informed of the intended use of their information before it us collected.

This document provides information to candidates and their training firms on the data privacy practices employed by the Institute in the managing candidate data throughout the E-Assessment process.

Definitions

Reference	Definition
Candidate	An individual presenting for any formal exam or assessment.
Data	Data is information, which is stored electronically, on a computer or in certain paper-based filing systems.
Data Controllers	Data Controllers are the people or organisations who determine the purposes for which, and the manner in which any personal data is processed. They are responsible for establishing practices and policies in line with the relevant laws and regulations. The Institute is the data controller of all personal data used in the business for the Institute’s own commercial purposes.
Data Processors	Data Processors include any person or organisation that processes personal data on the Institute’s behalf and on Institute instructions. Employees of data controllers are excluded from this definition, but it could include suppliers which handle personal data on the Institute’s behalf.
Data Processing Agreements (DPA)	A Data Processing Agreement is a legally binding document that outlines the responsibilities and liabilities of data controllers and processors regarding the handling of personal data.
Data subjects	Data subjects include all living individuals about whom the Institute holds personal data (including candidates). All data subjects have legal rights in relation to their personal information.
Education Department and Education team	The Education & Training Department (ETD) is responsible for managing the education, training, and assessment of students. Any references to the “Education Department” or “Education Team” within this Privacy Statement refer to the internal team responsible for carrying out these processes within the organisation. Contact details for queries related to Education activities are provided in the relevant section of this document.
E-assessments	E-assessments, also known as electronic assessment, refer to the use of information technology in various types of assessments. It encompasses a range of activities such as online assessments, electronic marking, and computer aided testing.
E-assessment platform	Is the software used to host the examinations. This is provided by two vendors, ProctorU and Cirrus. Detailed in Section 9.
Examinations and Appeals Regulations	These regulations are the Examination and Appeals Regulations of the Institute of Chartered Accountants in Ireland.
Legitimate Interests Assessment ("LIA")	A Legitimate Interest Assessment is a process for organisations to carry out a risk assessment in order to analyse and evaluate the justification for processing personal data based on Legitimate Interests as the lawful basis under GDPR.
Personal data	Personal data is data relating to a living individual who can be identified from the data in conjunction with other information that is in or is likely to come into the Institute’s possession. Examples of Personal Data include name, address, date of birth, telephone number, email address, membership number and so on.
Processing of personal data	Processing of personal data is any activity that involves the use of the data. The Institute requires this information to understand candidates’ needs and provide candidates with a better service.
Reasonable Accommodation	Reasonable Accommodation is where the Institute can facilitate access to exams by candidates who would have difficulty in accessing the examination or communicating what they know to an examiner because of a physical, visual, hearing and/or learning difficulty.
Sensitive Personal Data (special category data)	Sensitive Personal Data relates to specific categories of data such as data relating to a person’s racial origin; political opinions or religious or other beliefs; physical or mental health; sexual life; criminal convictions or the alleged commission of an offence and trade union membership. The Institute may collect sensitive personal data, such as limited health data in the event that specialised services are required.
Standard Contractual Clauses (SCCs)	Standard Contractual Clauses (SCCs) are a set of contractual terms approved by the European Commission that organisations use to legally transfer personal data from the European Economic Area (EEA) to countries outside the EEA that do not have an adequacy decision under GDPR.
Transfer Impact Assessment (TIA)	A TIA assessment ensures that the destination country provides an essentially equivalent level of protection to that guaranteed under EU data protection laws.

Obligations of the Institute as Data Controller

Data Controllers processing personal data must comply with the Data Protection principles of good practice. These provide that personal data must be:

Obtained and processed lawfully and fairly.
Collected and kept only for specified, explicit and legitimate purposes and not be used or disclosed in a manner incompatible with those purposes for which it was given to you initially
Protected against unauthorised access, alteration, disclosure or destruction, or unlawful processing.
Accurate, complete and where necessary, kept up to date.
Adequate, relevant and not excessive in relation to the purpose for which they were collected.
Not kept for longer than is necessary.

E-assessment

The Institute introduced an online assessment platform for all candidates commencing from November 2019.

This platform allows candidates to take their exams from any suitable location and frees them from the requirement of attending centralised exam halls. Furthermore, for certain examinations, such as the Law exam, candidates can book a time that is suitable to them.

In order to ensure that the exams are fair and that all candidates follow the Examinations and Appeals Regulations, the E-Assessment platform incorporates human proctors who supervise each individual candidate while they take their exams.

This platform provides a number of benefits to the Institute’s candidates and their training firms:

It provides greater flexibility to candidates in respect of where they can take their exams.
It removes the stress and risks involved in getting to centralised locations for exact start times.
Candidates can now take their exams from the locations where they feel most comfortable.
Candidates with special needs can be accommodated better through E-Assessment, with tools such as e-readers, text size change and additional time offered. These candidates can also take their exams in a less stressful environment.
Complaints, extenuating circumstances or issues which arise during the exam can be investigated more definitively as there is a record of the whole exam experience; and
With accounting increasingly making use of technology, the Institute has introduced industry leading technology.

Candidates undertaking Institute examinations are subject to the Examination and Appeals Regulations.

Legal basis for processing

In recent years the Institute has identified a number of legitimate interests that require it migrates from paper-based examinations to online assessment. These legitimate interests include:

An increasing requirement for Reasonable Accommodation.
Ensuring fairness as all exams will be presented in the same manner and can be formatted and edited by the candidate. Previously, Reasonable Accommodation candidates had the advantage of being able to carry out this formatting and editing while other candidates’ scripts were handwritten.

As a result of these factors, the Institute developed the E-Assessment platform which all candidates use to sit their exams. In order to provide these exams, the Institute uses certain data provided to them by the candidates at registration and also collects additional data while the candidate is taking their exam. This data will be held for no longer than is necessary to carry out the exam processing and in exceptional cases to investigate issues that may arise.

Legitimate Interest Assessment

The Institute has carried out a Legitimate Interests Assessment ("LIA") to determine if we can process Personal Data on the legal basis of our legitimate interests (Article 6(1)(f) of the GDPR).

A Legitimate Interests Assessment requires us to:

Identify our legitimate interests in processing personal data;
Demonstrate that the processing is necessary to achieve the legitimate interests; and
Consider carefully the Institute's right to process Personal Data for the purposes of providing access to online examinations to candidates.

We have concluded that:

While each candidate's right to privacy is significant and important, the Institute's responsibility to process the online examinations requests efficiently and in a timely manner outweighs a candidate's privacy right in these particular circumstances. The following is relevant to this conclusion:

The Institute has a legitimate interest in processing your Personal Data in order to make your examinations available to you online.
The processing is necessary because there is no less intrusive way of providing the examinations online.
The Personal Data processed is limited to the minimum amount necessary to achieve the purpose of making determinations about your identification and providing access to the exam.

The Institute has carried out a Legitimate Interest Assessment (“LIA”) in order to ensure that the privacy and data protection rights of Candidates are balanced with the requirement to process their data by the Institute. This analysis has led the Institute to conclude that it has a legitimate interest in processing candidate data in order to provide its examination function.

Types of information the Institute collects

The following personal data is collected by the Institute and retained for the purpose of carrying out the E-Assessment exams:

Candidate number
Name
Email address
Contact phone number
Country of residence
Photograph of the candidate
Video and audio recording of the exam session
Flags indicating non-conformance with exam rules

IP Address from which exams are taken
Browser and Operating System of the laptop
Cookies are placed on the candidate’s laptop
Exam script
Exam grade
Log files containing records of systems access
Image of Identification Document
A unique identifier which denotes a candidate and each specific exam
Exam adjustments arising from Reasonable Accommodation

How the Institute obtains candidate personal data

Information pertaining to a candidate’s identity is collected during the Institute’s candidate registration process and is updated if and when a candidate updates their personal details in the candidate portal. The data identified above at Section 7 is required to be provided in line with the Examinations and Appeals Regulations in order for candidates to complete E-Assessment exams. Failure to provide this data may result in a candidate being unable to take their exam.

Images, video recording, non-conformance flags, IP address, personal computer detail information and log data is recorded during the process of undertaking the exam.

Exam script, grade and any adjustments made to the exam are collected in configuring the exam for candidates, while candidates undertake the exam and when the exam is marked.

No information relating to health or reasons for Reasonable Accommodation is provided to or retained by third parties.

Use of personal data

Personal data is collected in order to ensure a fair examination system where all Institute candidates adhere equally to the Examinations and Appeals Regulations. The E-Assessment platform is delivered by two vendors, namely:

Cirrus Assessment: provide the assessment platform itself.
Meazure Learning (ProctorU): ensure candidates’ compliance with the Examinations and Appeals Regulations.

The Institute has minimised the data collected to that which is required to run a fair examinations system.

Please see more information in relation to categories of personal data in scope, purposes and legal bases of processing in the table below.

Purpose of processing	Categories of personal data processed	Lawful basis under GDPR	Data retention
1. Data is collected in order to confirm the identity of the candidate	Candidate name and candidate number Country of residence Photograph	Necessary for the purposes of the Institute’s legitimate interests in promoting the proper and efficient administration of the Institute’s business, where such interests are not overridden by candidates’ fundamental rights (per Art. 6 (1)(f) GDPR)	One year after a candidate completes their examinations with the Institute
	Image of identification document		Seven business days after exam takes place
2. Data is collected to contact candidates in the event they get disconnected during the exam	Name and email address of candidate Contact phone number	Necessary for the purposes of the Institute’s legitimate interests in promoting the proper and efficient administration of the Institute’s business, where such interests are not overridden by candidates’ fundamental rights (per Art. 6 (1)(f) GDPR)	One year after a candidate completes their examinations with the Institute
3. Data is collected to ensure that candidates follow the Examinations and Appeals Regulations	Video and audio recording of the exam session	Necessary for the purposes of the Institute’s legitimate interests in promoting the proper and efficient administration of the Institute’s business, where such interests are not overridden by candidates’ fundamental rights (per Art. 6 (1)(f) GDPR)	20 business days after the exam takes place
	Flags indicating non-conformance with exam rules IP Address from which exams are taken		One year after a candidate completes their examinations with the Institute
4. Data is collected in order to run the examinations and ensure candidates meet the Institute’s required standard	Exam script Exam adjustments arising from Reasonable Accommodation Exam grade A unique identifier which denotes a candidate and each specific exam	Necessary for the purposes of the Institute’s legitimate interests in promoting the proper and efficient administration of the Institute’s business, where such interests are not overridden by candidates’ fundamental rights (per Art. 6 (1)(f) GDPR)	Up to 90 days after the exam takes place, depending on the type of exam, to allow for the appeals process, if necessary
5. Data is collected to understand the platforms used by candidates and to ensure the E-Assessment system continues to meet their evolving technical needs	Personal computer browser & Operating System Cookies are placed on the candidate’s personal computer	Necessary for the purposes of the Institute’s legitimate interests in promoting the proper and efficient administration of the Institute’s business, where such interests are not overridden by candidates’ fundamental rights (per Art. 6 (1)(f) GDPR)	Every 30 days

For Interim Assessments such as FAE AFR and CAP1 and CAP2 main exams (CAP1-Law for Accountants ROI/NI, Finance, Management Accounting, Financial Accounting, Taxation I ROI/NI) and (CAP2 – Auditing and Assurance, Financial Reporting, SFMA and Taxation II ROI/NI), multiple choice or objective test questions, the assessment system will mark the questions based on whether they have been answered correctly or not.

Other examinations are marked by human markers who access exam scripts and mark the questions according to the marking standard specified by the Institute. The Institute has evaluated this processing and believes that it does not make any decisions based solely on automatic processing, as envisaged by Article 22 of the GDPR, as the paper is verified prior to the candidate sitting the exam, regular testing and reviewing of all exam papers is carried out before the examinations and on the day of the examinations to ensure all processing accurately.

Retention of personal data

Personal data is retained only for so long as it is needed to support the education and examination of the Institute’s candidates.

Data retention timeframes are detailed in the table shown above (Section 9: ‘Use of Personal Data’).

The following data is stored on a candidate’s personal computer and is not deleted, unless by a user:

Cookies on the candidate’s personal computer to ensure the effective operation of the examination software.

The following data is collected and anonymised so that it does not identify the candidate (the data allows the vendors to generally track the types of systems their user’s use and ensure that their platform continues to meet their user’s needs):

Browser and Operating System of the candidate’s personal computer.

The retention periods outlined in Section 9 will normally apply to the examinations process.

However, where a breach of the Examinations and Appeals Regulations is suspected, or where a candidate makes an application under the extenuating circumstance process, then the Institute will retain the data for as long as it takes to complete an investigation and if necessary, until an appeal completes, including any referral for judicial action.

In such circumstances, the Institute will download the candidate’s data to their internal computer systems and remove it from the Meazure Learning (ProctorU) and Cirrus Assessment systems. Once any such examination review process has completed, the Institute will then delete the data from its own systems.

Disclosure of personal data

The Institute may share candidate personal data with selected third parties including:

Business partners, suppliers and subcontractors for the performance of any contract the Institute enters into with the candidate.
Analytics and search engine providers that assist the Institute in the improvement and optimisation of the Institute’s site.
The Institute may share candidate data with their employer and regulatory bodies.

In the event that the Institute merges with any other organisation, in which case the Institute may disclose candidate personal data with the prospective organisation.

All third parties with whom candidates’ personal data is shared will enter into a Data Processing Agreement (DPA) with the Institute. This means the third party processor will process and handle candidate data with the same high level data protection standards as the Institute.

In circumstances where a breach of the Examinations and Appeals Regulations is suspected, the video recording of the exam may be shared with the Examination Committee as part of the investigation. Video recordings will only be kept beyond the initial retention period if there is a suspected breach however the recording will be deleted when the process is closed.

International transfers

The Institute may transfer any personal data it holds to a country outside the European Economic Area (“EEA”) and the United Kingdom (“UK”), provided that one of the following conditions applies:

The country to which the personal data are transferred ensures an adequate level of protection and appropriate safeguards in place for the data subjects' rights and freedoms.
The data subject has given their consent.
The transfer is necessary for one of the reasons set out in the relevant Data Protection Laws and Regulations, including the performance of a contract between the Institute and the data subject, or for Institute legal/statutory obligations.
The transfer is legally required for the establishment, exercise, or defence of legal claims.
The transfer is authorised by the relevant data protection authority where the Institute has adduced adequate safeguards with respect to the protection of the data subjects' privacy, their fundamental rights and freedoms, and the exercise of their rights.
Personal data the Institute hold may also be processed by staff operating outside the EEA and UK who work for the Institute or for one of the Institute’s suppliers. That staff maybe engaged in, among other things, the fulfilment of contracts with the data subject, the processing of payment details and the provision of support services.

In order to provide the E-Assessment service, the Institute has partnered with leading proctoring and examinations platform providers. These processors are contracted by the Institute to meet its data privacy standards and audited annually to ensure these standards are met.

The following information is stored by Meazure Learning (ProctorU) in the United States:

Candidate number
Name
Email address
Contact phone number
Image of Identification Document
Photograph of the candidate
Exam adjustments arising from Reasonable Accommodation

IP address from which exams are taken
Browser and Operating System of the personal computer
Country of residence
Video and audio recording of the exam session
Flags indicating non-conformance with exam rules
A unique identifier which denotes a candidate and each specific exam

Data transfers outside of the EEA and UK may occur but the Institute will seek to ensure that the data is protected at all times. For data leaving the EU the Institute will analyse the data protection practices of the receiving countries to determine their level of data protection. Some countries will have an adequacy decision with the EU.

An adequacy decision is a formal determination by the EU that a non-EU country provides an equivalent level of data protection, allowing for the free flow of personal data between the EU and that country.

Additional measures

For transfers outside of the EEA and UK, there may not be an adequacy decision in place to allow for this transfer to take place so the Institute will put in place additional safeguards by way of a Standard Contractual Clause (“SCC”). Each 3rd party applicable will enter into a SCC with the Institute to ensure candidate data is protected at all times.

For data transfers from the EU to the US, Data Controllers and processors can sign up to the EU-U.S. Data Protection Framework (“DPF”). The DPF principles are designed to ensure the protection of personal data transferred from the EU to the U.S.

The Institute may transfer some personal data to the following 3rd parties outside of the EEA and UK:

Meazure Learnings (ProctorU) – company is based in the USA. ProctorU’s personnel and contractors can also be located in the following countries where remote data processing might take place.
- USA - ProctorU has signed up to the EU-US DPF and has also adopted Standard Contractual Clauses (SCC) to ensure appropriate safeguards are in place for any possible data transfers out of the EEA and NI.
- The Philippines - Signed SCC
- Columbia – Signed SCC
- Panama - Signed SCC
- India – Signed SCC
- Alaska - Signed SCC

All ProctorU personnel and processors receive relevant data protection training to ensure they carry out their data processing in accordance with the GDPR.

Transfer impact assessment (TIA)

Prior to authorising the execution of the SCCs and the transfer of the personal data outside of the EEA and UK pursuant to the SCCs, the Institute will conduct a “transfer impact assessment” (“TIA”).

This assessment ensures that the designation country provides essentially equivalent level of protection that guaranteed under EU data protection laws. Where necessary, the Institute implements additional technical and/or organisational measures to safeguard the personal data.

Data security

The Institute will process all personal data it holds in accordance with its IT Security Policy.

The Institute has put in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. Personal data will only be transferred to a data processor if they agree to comply with those procedures and policies, or if they put in place adequate measures.

Unfortunately, the transmission of information via the internet is not completely secure. Although the Institute will do its best to protect candidates’ personal data, the Institute cannot guarantee the security of data transmitted to its site; any transmission is at candidates’ own risk. Once the Institute has received candidate information, it will use strict procedures and security features to try to prevent unauthorised access.

The Institute website may, from time to time, contain links to and from the websites of its partner networks, advertisers and affiliates. If candidates follow a link to any of these websites, please note that these websites have their own privacy policies and that the Institute do not accept any responsibility or liability for these policies. Please check these policies before submitting any personal data to these websites.

Candidates’ rights in relation to their personal data

Data subjects have the following rights, in certain circumstances, under Articles 12-22 of the GDPR:

The right to be informed about what personal data is collected about candidates and how it is used.
The right of access to the personal data controlled by the Institute.
The right to correct any inaccuracies in the personal data.
In some instances, subject to the Examinations and Appeals Regulations and in accordance with the need to provide fair examinations to all Institute Candidates, there is the right to erasure of personal data (also known as the “Right to be Forgotten”)
The right to restrict the processing of the personal data.
The right to object to the processing of candidate personal data in certain circumstances, this includes data subject’s right to opt-out of receiving marketing communications from the Institute.
The right not to be subject to automated decision making and profiling in certain circumstances. This right does not apply if the processing is based on explicit consent.
There is the right to data portability of the personal data you provided to the Institute and where the Institute process candidate personal data based on consent or for the performance of a contract.

How candidates can exercise their privacy rights

Candidates can exercise any of the listed rights above by contacting the Institute’s Privacy Manager at the details listed in Section 17.

Candidates also have the right to lodge a complaint about the Institute’s processing of candidates’ personal data with the relevant supervisory authority in accordance with Article 77 GDPR, details as follows:

Republic of Ireland

Telephone: 1890 252 231

Email: info@dataprotection.ie

Address:
Data Protection Commission,
6 Pembroke Row,
Dublin 2,
D02 X963, Ireland.

Northern Ireland

Telephone: 028-9027-8757

Email: ni@ico.org.uk

Address:
Information Commissioner’s Office,
10^th Floor Causeway Tower,
9 James Street South,
Belfast,
BT7 2JB

Details on the Institute’s Data Privacy Complaints Procedures can be found on our privacy complaints page at . All questions in relation to this privacy statement can be directed to the Privacy Manager at the details in Section 17.

Requests for access to copies of exam scripts will only be available after the exam results are released and for a period of time afterwards, as per the Institute Data Retention Schedules.

Please note that the Institute does not provide copies of auto scored exam scripts.

Updates to this statement

The Institute reserves the right in its sole discretion to amend this statement at any time (for example, to comply with changes in laws or regulations, Institute practices, procedures and organisational structures, requirements imposed or recommended by supervisory authorities or otherwise). Changes to this statement will be communicated by the Institute where legally required to do so.

Contacting the Institute

Data subjects can contact the Institute in relation to the use of candidate personal data in the processing of E-Assessment examinations or to request assistance in enforcing privacy rights by contacting the Institute Privacy Manager, whose contact details are as follows:

Email: privacy@charteredaccountants.ie

Address:
Privacy Manager,
Chartered Accountants Ireland,
Chartered Accountants House,
47-49 Pearse Street, Dublin 2. D02 YN40.

Students

Current students