Last updated: 
4 weeks 1 day ago
Blog Manager
One of Jisc’s activities is to monitor and, where possible, influence regulatory developments that affect us and our customer universities, colleges and schools as operators of large computer networks. Since Janet and its customer networks are classified by Ofcom as private networks, postings here are likely to concentrate on the regulation of those networks. Postings here are, to the best of our knowledge, accurate on the date they are made, but may well become out of date or unreliable at unpredictable times thereafter. Before taking action that may have legal consequences, you should talk to your own lawyers. NEW: To help navigate the many posts on the General Data Protection Regulation, I've classified them as most relevant to developing a GDPR compliance process, GDPR's effect on specific topics, or how the GDPR is being developed. Or you can just use my free GDPR project plan.

Group administrators:

Learning Analytics - an updated model

Wednesday, April 19, 2017 - 09:44

At Jisc's Learning Analytics Network meeting last month I presented an updated version of my suggested legal model for Learning Analytics. The new version adds the data collection stage(s) and seems to me – both as a sometime system developer and privacy-sensitive student – to provide the kinds of guidance, choices and protections that I'd expect universities and colleges to apply to student data.

Whereas learning analytics has sometimes been documented as a monolithic process, it seems to fit much better into data protection law if split into (up to) five separate stages:

  • Data Collection: using information the institution has already gathered about students as part of existing educational processes. Here rules and guidance on necessity and purpose limitation can help determine what data may be used for learning analytics purposes and how far those purposes may extend;
  • Data Donation (optional): in some cases students may be asked to provide additional information – for example reporting on their own study patterns. Rules and guidance on consent indicate what information students must be given and the rights they have to refuse or stop providing information without detriment;
  • Analysis: the stage where data are interrogated to discover relevant patterns, highlighting factors that may improve or hinder educational achievement. During this stage the aim should be to minimise impact on individuals and ensure that any remaining risk is justified, in accordance with rules and guidance on processing for legitimate interests;
  • Improvement (optional): where patterns can be used to improve educational provision in general, for example by adapting teaching materials or practices. Here there is no need to process personal data at all;
  • Intervention (optional): where patterns are used to identify and propose relevant actions for individual students. Here personal data must be used, and the aim is to maximise the (positive) impact on individuals. Thus consent for interventions is needed (unless they are, for example, a legal obligation) and this can be sought at the time when the organisation can give the most detailed information about the proposed intervention and its likely consequences.

It was good to receive feedback that this model was "reassuring" and, indeed, matched what many organisations already do in practice, even though their policies may describe the simpler, monolithic, model. The legal detail and resulting guidance can be found in a paper: "Downstream Consent: A Better Legal Framework for Big Data", published in the Journal of Information Rights, Policy and Practice.