Do privacy laws mean you have to delete a test result if a test-taker asks you to?

Posted by John Kleeman

We have all heard about the “right to be forgotten”, which allows individuals to ask search engines or other organizations to delete their personal data. This right was made stronger in Europe in 2018, when the General Data Protection Regulation (“GDPR”) entered into force, and is gradually becoming recognized in some form in other jurisdictions, for example in the new California privacy law, the California Consumer Privacy Act (“CCPA”).

I’m often asked questions by customers about what the situation is if test-takers ask to delete the results for tests and exams.  Let’s take an example:

  • Your organization runs a global certification program for third party candidates;
  • One of your European candidates takes an exam in your program;
  • The candidate then reaches out to you and asks for all their personal data to be deleted.

What do you need to do? Do you verify his/her identity and delete the data? Or can you hold onto it and deny the request if you have reasons why you need to – for example, if you want to enforce retake policies or you are concerned about possible cheating. Here is an answer based on typical circumstances in Europe (but please get advice from your lawyer and/or privacy adviser regarding your specific circumstances).

Under the GDPR, although as a general principle you do need to delete personal data if retaining it for a longer period cannot be justified for the purposes for which it was initially collected or another permitted lawful purpose, there are exemptions which may allow you to decline an erasure request.

For example, you may refuse to delete personal data in response to a request from an individual if retaining the data is necessary to establish, exercise or defend against legal claims. If you follow this exception, you must be comfortable that retention of the data is necessary, and you must only use the data for this purpose, but you do not need to fully delete it.

Another broader reason for refusing to delete data may arise if you articulate in advance of the candidate taking the exam that processing is performed based on the data controller’s (usually the test sponsor’s) legitimate interests. The GDPR permits processing based on legitimate interests if you balance such interests against the interests, rights and freedoms of an individual. The GDPR also specifically says that such legitimate interests may be used to prevent fraud (and this obviously includes test fraud).

If you want to be able to refuse to delete information on this basis:

  • You should first conduct and document a legitimate interests assessment which justifies the purpose of the processing, considers whether the processing is really necessary, and balances this against the individual’s interests. (See this guidance from the UK Information Commissioner for more information);
  • You should communicate to candidates in advance, for example in your privacy policy or candidate agreement, that you are processing their data based on explained legitimate interests;
  • If you then later receive a deletion request, you should carefully analyse whether notwithstanding the request you have overriding legitimate interests to retain the data;
  • If you conclude that you do have such an interest, you should only retain the data for as long as that continues to be the case and only keep the data to which the overriding legitimate interest applies. This might mean that you have to delete some data, but can keep the rest.
  • You also need to let the individual know about your decision promptly providing them with information including their right to complain to the appropriate supervisory authority if they are unhappy with your decision.

The CCPA also has some exceptions where you do not need to delete data, including where you need to retain the data to prevent fraudulent activity.

In general, you may well want to follow delete requests, but if you have good reason not to, you may not need to.

For further information, there is some useful background in the Association of Test Publishers (ATP) GDPR Compliance Guide, in other ATP publications and in Questionmark’s white paper “Responsibilities of a Data Controller When Assessing Knowledge, Skills and Abilities” obtainable at https://www.questionmark.com/wc/WP-ENUS-Data-Controller.

I hope this article helps you if this issue arises for you.

10 Reasons Why Frequent Testing Makes Sense

Posted by John Kleeman

It matters to society, organizations and individuals that test results are trustable. Tests and exams are used to make important decisions about people and each failure of test security reduces that trustworthiness.

There are several risks to test security, but two important ones are identity fraud and getting help from others. With identity fraud, someone asks a friend to take the test for them or pays a professional cheater to take the test and pretend to be them. With getting help from others, a test-taker subverts the process and gets a friend or expert to help them with the test, feeding them the right answers. In both cases, this makes the individual test result meaningless and detracts from the value and trustworthiness of the whole assessment process.

There are lots of mitigations to these risks – checking identity carefully, having well trained proctors, using forensics or other reports and using technical solutions like secure browsers – and these are very helpful. But testing more frequently can also reduce the risk: let me explain.

Suppose you just need to pass a single exam to get an important career step – certification, qualification or other important job requirement, then the incentive to cheat on that one test is large. But if you have a series of smaller tests over a period, then it’s more hassle for a test taker to conduct identity fraud or to get help from others each time. He or she would have to pay the proxy test taker several times.  And make sure the same person is available in case photos are captured. And for the expert help you also must reach out more often, and evade whatever security there is each time

There are other benefits too; here is a list of ten reasons why more frequent testing makes sense:

  1. More reliable. More frequent testing contributes to more reliable testing. A single large test is vulnerable to measurement error if a test taker is sick or has an off day, whereas that is less likely to impact frequent tests.
  2. More up to date. With technology and society changing rapidly, more frequent tests can make tests more current. For instance, some IT certification providers create “delta” tests measuring understanding of their latest releases and encourage people to take quarterly tests to ensure they remain up to date.
  3. Less test anxiety. Test anxiety can be a big challenge to some test takers (see Ten tips on reducing test anxiety for online test-takers), and more frequent tests means less is at stake for each one, and so may help test takers be less anxious.
  4. More feedback. More frequent tests give feedback to test takers on how well they are performing and allow them to identify training or continuing education to improve.
  5. More data for testing organization. In today’s world of business intelligence and analytics, there is potential for correlations and other valuable insight from the data of people’s performance in a series of tests over time.
  6. Encourages test takers to target retention of learning. We all know of people who cram for an exam and then forget it afterwards. More frequent tests encourage people to plan to learn for the longer term.
  7. Encourages spaced out learning. There is strong evidence that learning at spaced out intervals makes it more likely knowledge and skills will be retained. Periodic tests encourage revision at regular intervals and so make it more likely that learning will be remembered.
  8. Testing effect. There is also evidence that tests themselves give retrieval practice and aid retention and more frequent tests will give more such practice.
  9. More practical. With online assessment software and online proctoring, it’s very practical to test frequently, and no longer necessary to bring test takers to a central testing center for one off large tests.
  10. Harder to cheat. Finally, as described above, more frequent testing makes it harder to use identity fraud or to get help from others, which reduce cheating.

I think we’re seeing a slow paradigm shift from larger testing events that happen at a single point in time to smaller, online testing events happening periodically. What do you think?

FAQ – “Testing Out” of Training

Posted by Kristin Bernor

Let’s explore what it means to “test out”, what the business benefits include and how Questionmark enables you to do this in a simple, timely and valid manner.

“Testing out” of training saves time and money by allowing participants to forego unneeded training. It makes training more valid and respected, and so more likely to impact behavior, because it focuses training on the people who need it and further allows those that do know it, to learn additional knowledge, skills and abilities.

The key to “testing out” of training is that the test properly measures what it is you are training. If that is the case, then if someone can demonstrate by passing the test that they know it already, then they don’t need to do the training. Why testing out can sometimes be a hard sell is if the test doesn’t really measure the same outcomes as the training – so just because you pass the test, you might not in fact know the training. So, the key is to write a good test.

Online assessments are about both staying compliant with regulatory requirements AND giving business value. Assessments help ensure your workforce is competent and reduce risk, but they also give business value in improved efficiency, knowledge and customer service.

What does it mean to “test out” of training?

Many organizations create tests that allow participants to “test out” of training if they pass. Essentially, if you already know the material being taught, then you don’t need to spend time in the training. Testing them on training that is already know is a waste of time, value and resources. Directing them to training that is necessary ensures the candidate is motivated and feels they are spending their time wisely. Everyone wins!

Why is this so important? Or What are the advantages to incorporating “testing out”?

The key advantage of this approach is that you save time when people don’t have to attend the training that they don’t need. Time is money for most organizations, and saving time is an important benefit.

Suppose, for example, you have 1,000 people who need to take some training that lasts 2 hours. This is 2,000 hours of people’s time. Now, suppose you can give a 20-minute test that 25% of people pass and therefore skip the training. The total time taken is 333 hours for the test and 1,500 hours for the training, which adds up to 1,833 hours. So having one-fourth of the test takers skip the training saves 9% of the time that would have been required for everyone to attend the training.

In addition to saving time, using diagnostic tests in this way helps people who attend training courses focus their attention on areas they don’t know well and be more receptive to the training that is beneficial.

Is it appropriate to allow “testing out” of all training?

Obviously if you follow this approach, you’ll need to ensure that your tests are appropriate and sufficient – that they measure the right knowledge and skills that the training would otherwise cover.

You’ll need to check your regulations to confirm that this is permissible for you, but most regulators will see sense here.

How Questionmark can be used to “test out”

Online assessments are a consistent and cost-effective means of validating that your workforce knows the law, your procedures and your products. If you are required to document training, it’s the most reliable way of doing so. When creating and delivering assessments within Questionmark, it’s quite simple to qualify a candidate once they reach a score threshold. If they correctly answer a series of items and pass the assessment, this denotes that further training is not needed. It is imperative that the assessment accurately tests for the requisite knowledge that are part of the training objectives.

The candidate can then focus on training that is pertinent, worthwhile and beneficial to both themselves and the company. If they answer incorrectly and are unable to pass the assessment, then training is necessary until they are able to master the information and demonstrate this in a test.

How is the SAP Global Certification program going? A re-interview with SAP’s manager of global certification, part 1.

Posted by Zainab Fayaz

Back in 2016, John Kleeman, Founder and Executive Director of Questionmark interviewed Ralf Kirchgaessner, Manager of SAP Global Certification program about their use of Questionmark software in their Certification in the Cloud program and about their move to online proctoring. You can see the interview on the Questionmark blog here. We also thought readers might be interested in an update, so here is a short interview between the two on how SAP are getting on three years later:

John: Could you give us an update on where you are with the Certification in the Cloud program?

Ralf: The uptake, adoption and increase of Certification in the Cloud is tremendous! Over the years we have seen a significant increase in the volume of candidates taking exams in the cloud; the numbers doubled from 2016 to 2017 and increased almost by 60% in 2018. This means more than 50% of SAP Global Certification exams are now done remotely!

John: Are all your SAP Global Certification exams now available online in the cloud?

Ralf: Nearly so. By mid-2019 we plan on having the complete portfolio of every SAP exam available on the cloud. This is great news for our learners who have invested in a Certification in the Cloud subscription. So, we then have Certification in the Cloud not only for SAP SuccessFactors and SAP Ariba, but for all products, including SAP C/4HANA.

John: How many different languages are your exams translated into?

Ralf: This depends on the portfolio. Some of our certifications are available in English and others, such as for SAP Business One are translated in up to 20 languages.

John: How are you dealing with the fast pace of change within SAP software in a certification context? How do you ensure certifications stay up to date when the software changes?

Ralf: This is of course a challenge. In previous years, it was the case of getting certified once every few years. However, now you must keep your skills up-to-date and stay current with quarterly release cycles of our SAP Cloud solutions. Also, for people who are first timers or newly enter the SAP eco-system; it is important that they are certified on the latest quarterly release.

To help overcome this challenge, we have developed an agile approach to updating our exams; we use the Questionmark platform for those who are new to the eco-system to help them getting certified initially. We also have a very good process in place and often use the same subject matter experts when it comes to keeping up to the speed of software changes.

For already certified professionals, another way to remain up to date is through our ‘Stay Current’ program. For some of our solutions, partners have to come back every 3 months to show that they are staying current. They do this in the form of taking a short “delta” knowledge assessment. For instance, for certified professionals of SAP SuccessFactors it is mandatory to stay current in order to get provisioning access to the software systems.

In 2018, SAP’s certification approach was acknowledged with the ITCC Innovation Award. Industry peers like from Microsoft, IBM and others recognized this great achievement with this award.

 

Secrets to Measuring & Enhancing Learning Results: Webinar

Julie ProfilePosted by Julie Delazyn

Research has shown that assessments play an important role on learning and retention — and the benefits vary before, during and after a learning experience. No matter where learning occurs, the goal remains the same: ensuring people have the knowledge, skills and abilities to perform well.

So, how can you use assessments to measure and enhance learning within your organization?

Check out our newest 30-minute webinar – and register today!

  • The Secrets to Measuring and Enhancing Learning Results
  • Date & Time: Wed, Dec 7  at 4:00 p.m. UK GMT / 11:00 a.m. US EDT

Join us as we discuss the important role assessments play within the learning process and explore the benefits of using them before, during and after learning. We’ll also give you some useful pointers and resources to take away.

Register for the webinar now. We look forward to seeing you at the session!

Online Proctoring: FAQs

John Kleeman HeadshotPosted by John Kleeman

Online proctoring was a hot-button topic at Questionmark’s annual Users Conference. And though we’ve discussed the pros and cons in this blog and even offered an infographic highlighting online versus test-center proctoring, many interesting questions arose during the Ensuring Exam Integrity with Online Proctoring  session I presented with Steve Lay at Questionmark Conference 2016.

I’ve compiled a few of those questions and offered answers to them. For context and additional information, make sure to check out a shortened version of our presentation. If you have any questions you’d like to add to the list, comment below!

What control does the online proctor have on the exam?

With Questionmark solutions, the online proctor can:

  • Converse with the participant
  • Pause and resume the exam
  • Give extra time if needed
  • Terminate the exam

What does an online proctor do if he/she suspects cheating?

Usually the proctor will terminate the exam and file a report to the exam sponsor.

What happens if the exam is interrupted, e.g. by someone coming in to the room?

This depends on your security protocols. Some organizations may decide  to terminate the exam and require another attempt. In some cases, if it seems an honest mistake, the organization may decide that the proctor can use discretion to permit the exam to continue.

Which is more secure, online or face-to-face proctoring?online proctoring

On balance, they are about equally secure.

Unfortunately there has been a lot of corruption with face-to-face proctoring, and online proctoring makes it much harder for participant and proctor to collude as there is no direct contact, and all communication can be logged.

But if the proctors are honest, it is easier to detect cheating aids in a face-to-face environment than via a video link.

What kind of exams is online proctoring good for?

Online proctoring works well for exams where:

  • The stakes are high and so you need the security of a proctor
  • Participants are in many different places, making travel to test centers costly
  • Participants are computer literate – have and know how to use their own PCs
  • Exams take 2-3 hours or less

If your technology or subject area changes frequently, then online proctoring is particularly good because you can easily give more frequent exams, without requiring candidates to travel.

What kind of exams is online proctoring less good for?

Online proctoring is less appropriate for exams where:

  • Exams are long and participants needs breaks
  • Exams where participants are local and it’s easy to get them into one place to take the exam
  • Participants do not have access to their own PC and/or are not computer literate

How do you prepare for online proctoring?

Here are some preparation tasks:

  • Brief and communicate with your participants about online proctoring
  • Define clearly the computer requirements for participants
  • Agree what happens in the event of incidents – e.g. suspected cheating, exam interruptions
  • Agree what ID is acceptable for participants and whether ID information is going to be stored
  • Make a candidate agreement or honor code which sets out what you expect from people to encourage them to take the exam fairly

I hope these Q&A and the linked presentation are interesting. You can find out more about Questionmark’s online proctoring solution here.