FAQ’s concerning tools for videoconference (especially ZOOM)

1. What is ZOOM typically used for?

ZOOM is suitable for courses, seminars, webinars, interactive lectures, online meetings with up to 300 participants and public events. For larger numbers of participants in lectures and events, UZH has a limited number of licenses for webinars with up to 500 or 1000 participants. These licenses must be applied for via MELS/AV Services separately, using the appropriate form (see https://www.zi.uzh.ch/en/support/audio-video.zoom.html).

ZOOM is also suitable for courses with feedback functions and interactive elements.

For lectures, asynchronous solutions (e.g. video recording at the desk) are recommended.

2. When should ZOOM not be used?

Under no circumstances may ZOOM be used for seminars and lectures in which sensitive data is exchanged (e.g. patient data in the context of clinical seminars of the medical faculty, psychological consultations, supervision by psychologists).

If personal data is exchanged, special caution is required and a risk assessment must be carried out.

ZOOM should not be used for UZH internal meetings for privacy and security reasons.

Instead, Microsoft Teams should be used for such conferences and meetings.

3. What is the advantage of the ZOOM campus license compared to ZOOM’s free version or single licenses

In order to cope with the Corona crisis, UZH has acquired a campus license for the ZOOM software. This contract includes a Global Data Processing Addendum as part of a framework agreement with SWITCH (or the European organisation Géant), which ensures compliance with the EU-GDPR. This Global Data Processing Addendum is defined as a requirement by the Data Protection Commissioner of the Canton of Zurich for using ZOOM in the public sector during the Corona crisis. Individual licences and the free version however don’t guarantee EU-GDPR compliance.

According to the Data Protection Commissioner of the Canton of Zurich (state supervisory authority of UZH), ZOOM may only be used for the time of the Corona crisis and on the basis of the campus licence. Once the crisis is over, the situation must be reassessed.

The use of ZOOM is subject to further conditions according to the data protection officer:

  • For recordings, local storage is preferable to storage in the cloud.
  • If storage in the cloud is used, a storage location in Europe must be selected.
  • Attention Tracking must be disabled before using ZOOM.
  • Videoconferences must be protected with a password.
  • The use of the ZOOM App is preferfable to the browser-based usage.
  • Participation in ZOOM conferences via telephone is completely unencrypted and is therefore not recommended.

5. What is the position of the Federal Commissioner for Data Protection of the Federal Republic of Germany on ZOOM?

The Federal Commissioner for Data Protection of the Federal Republic of Germany advises the use of alternative offers. Users should question their communication possibilities instead of using the best-known offers for reasons of convenience.

He also advises against communication via ZOOM if personal data is involved, as the communication is not necessarily encrypted end-to-end. He also criticises the non-transparent data transfer, for example to Facebook.

6. The current press says that ZOOM is careless with data. Is this true?

ZOOM has revised its privacy policy since the start of the Corona crisis. It says: «We do not sell your personal data» and «Your meetings are yours. We do not monitor them or even store them after your meeting is done.» ZOOM has thus made positive amendments, but there are still better alternatives in terms of data security and data protection.

Attention tracking, which has also come under criticism and can be used by lecturers to monitor participants, has since been switched off by default.

7. Do I need to take any special precations if I want to use ZOOM?

If personal data is shared via ZOOM, general caution is required, and appropriate protective measures must be taken to address the risks. Data protection requirements must be assessed according to the sensitivity of the personal data exchanged in a specific case and the risks to the data subjects arising from data processing. In most cases, it is not only the participants of the video conference who are affected, but also other persons, e.g. patients, customers, students, employees.

The use of information about clearly identified or contextually identifiable persons (e.g. photographs and film recordings of students, patients, etc.) must therefore be avoided, unless the persons concerned have agreed to a publication for this purpose.

Please observe the recommendations of the Data Protection Commissioner of the Canton of Zurich (see above).

8. What about ZOOM’s recording function?

If video conferences are to be recorded, the persons involved must first and foremost agree to the recording. Without the consent of the persons involved in the conversation, you could be prosecuted.

If an event is to be recorded and made available offline, make sure that the participants have switched off their video functionality and only the lecturer's screen is recorded. If question or discussions are recorded, the participants must be informed accordingly.

In line with the specifications of the Data Protection Commissioner of the Canton of Zurich, the recording should be locally stored and not in the cloud. If cloud storage is used, a storage location in Europe should be chosen.

9. Does ZOOM use end-to-end encryption?

When using ZOOM, you must be aware that there is no real end-to-end encryption of the video data streams, but encryption is only between participants and the server where the data is available unencrypted. If video conferences are recorded or files are shared, these contents are usually at least temporarily stored unencrypted on the provider's server.

10. Can existing accounts be converted from single licences and free versions to a UZH campus licence?

Yes, this is possible and is strongly recommended (for data protection reasons). Guidance can be found here.

11. What must be considered with regards to copyright?

If works (pictures, texts etc.) of other authors are used in online courses and presentations, the source must always be indicated (good scientific practice). Works from the Internet also enjoy copyright protection.

You should also point out to students how the recordings of the courses and the presentations, videos, etc. contained therein may be used. This can be done, for example, by adding the following remark: "This work is protected by copyright and may only be used for teaching purposes at the University of Zurich. The author's consent is required for any other usage, in particular distribution via the Internet".

12. Where can I find more information and technical support for other video conferencing tools?

Central IT provides information via the following links:

https://www.zi.uzh.ch/en/teaching-and-research/event-support/videoconference/desktop-vc.html

UZH’s data protection office has carried out an assessment of available online tools, see link:

https://www.dsd.uzh.ch/dam/jcr:e8615576-6aca-40cb-9b6e-7414ce1370ab/Online-Tools_de.pdf

The Data Protection Commissioner of the Canton of Zurich has published a very comprehensive list of products for digital collaboration, see link:

https://dsb.zh.ch/internet/datenschutzbeauftragter/de/themen/digitale-zusammenarbeit.html

The Federal Commissioner for Data Protection of the Federal Republic of Germany has published a selection guide for messenger systems with audio/video support, see link:

https://www.bfdi.bund.de/SharedDocs/Downloads/DE/Datenschutz/Auswahlhilfe-Messenger-Systeme.html?nn=13881424