Universities and colleges are having to adapt their policies and processes to meet the requirements of the EU General Data Protection Regulation (GDPR).
Worried about the impact of GDPR on learning analytics?
Well I have some encouraging news - it’s perfectly possible to carry out learning analytics in the interests of students while complying with the new legislation, though careful consideration needs to be given to issues such as whether you should ask students for their consent.
Here are some questions that you might be asking:
Do you need consent from students under GDPR to collect their data for learning analytics?
You’ll already be collecting much of the data used for learning analytics. Much of it is necessary for providing students’ education or for statistical purposes - date of birth, prior qualifications, modules studied, grades and use of IT facilities, for example.
Often, it’s simply not possible for students to opt out of collecting such data, so asking for their consent isn’t meaningful and is not acceptable under GDPR.
You must ensure though that the collection is justified under one of the lawful bases for processing provided by GDPR. For example:
- Meeting a legal obligation
- Collection is in your institution’s legitimate interests
- Required to fulfil contractual obligations with the student
Are there any exceptions?
While consent is not needed for collecting most of the data associated with learning analytics, if you’re collecting data specifically for that purpose (such as asking students how much time they’re spending studying), you must ensure that students have consented to this.
Also, if you plan to collect special category data , such as students’ ethnic origin, you must first obtain consent.
Do students need to give consent to carry out learning analytics on their data?
The UK's Information Commissioner’s Office (ICO) is clear that organisations should avoid over-reliance on consent to justify data processing.
Using a justification such as “legitimate interests” for the processing of student data instead requires the institution to minimise the risk to individual students and therefore provides students with better safeguards than when using consent.
There are, however, two circumstances when consent must be obtained:
- Where special category data is used
- When you make interventions with individual students based on their analytics
When do you need consent to make personal interventions with students based on learning analytics data?
The analytics may, for example, suggest that a student is at academic risk.
Initial contact with the student can be justified under the legitimate interests of the institution, without consent. But when you intend to carry out an intervention based on this data then, yes, you do need to request the student’s consent. Examples might include:
- An email to the student (justified under legitimate interests) which offers an informed choice of whether to attend an extra class. The class is the intervention to which they would need to give their consent
- Discussion in a routine tutorial meeting (legitimate interests) suggesting that an extra class could be helpful (consent needed)
How should you ask students for their consent?
The requirements of GDPR for requesting consent include:
- Keeping consent requests separate from other terms and conditions
- Giving clear and specific information to students about what they’re consenting to
- Informing them of any third-party data controllers who will rely on their consent
- Making clear the consequences of either providing or withholding their consent.
- Requiring clear, affirmative action by the student; the use of pre-ticked boxes is not be acceptable.
- As students have the right to withdraw their consent at any time, putting in place mechanisms to enable them to easily do so
- Keeping records of any granting, withholding or withdrawal of consent by students
What should you tell students?
You need complete transparency about the processes of learning analytics and the data because it is important to ensure legal compliance, as well as acceptance by staff and students.
Jisc has produced a code of practice which can be adapted for institutional use and discussed in relevant committees with student representation.
You should provide additional information to students when inviting them to provide special category data, or when seeking their consent to carry out interventions based on learning analytics.