GDPR and Learning Analytics – Frequently Asked Questions

Universities and colleges are understandably concerned about the European General Data Protection Regulation and its impact on their processes. There is quite a lot of uncertainty about how the new legislation applies to learning analytics initiatives. We believe it is perfectly possible to carry out learning analytics in the interests of students while complying with the new legislation, though careful consideration needs to be given to various issues such as whether and when to ask students for consent.

The following is our attempt to answer some of the main questions that have been cropping up in this area. My thanks to Andrew Cormack who has provided his useful detailed feedback on my initial drafts, much of which were based on his earlier work, and to Paul Bailey for further helpful comments.

Please let me know if any of these issues remain unclear or if you think there are additional important issues relating to GDPR and learning analytics which need to be clarified.

Q1. Should we ask students for their consent to collect their data for learning analytics?

Much of the data used for learning analytics is being collected anyway and may be necessary for providing students’ education or for statistical purposes e.g. date of birth, gender, prior qualifications, modules studied, grades and use of IT facilities.

Often it’s not possible to opt out of collecting such data so asking for students’ consent is not meaningful and would not be acceptable under GDPR.

You must ensure though that the collection is justified under one of the lawful bases for processing provided by GDPR such as it being a legal obligation, in your institution’s legitimate interests or necessary to fulfil your contractual obligations with the student.

If you’re collecting data specifically for learning analytics such as asking students how much time they’re spending studying you must ensure that the students have consented to this.

Also, if you plan to collect Special Category Data (e.g. ethnic origin) you must first obtain the consent of your students.

Q2. Should we ask students for their consent to carry out learning analytics on their data?

The UK Information Commissioner’s Office is clear that organisations should avoid over-reliance on consent as a justification for data processing and that it’s often better to use a different lawful basis.

Reasons why you should not normally ask students for their consent to carry out learning analytics on their data include:

1. Using a justification such as “legitimate interests” for the processing of student data provides students with better safeguards than using consent. In this case the institution takes on the burden of ensuring that all such processing is done in ways, and subject to policies, that minimise the risk to individual students.
2. If consent is requested you freeze the activities to which it can apply: new types of analysis cannot be added if they were not envisaged at the time consent was obtained.
3. Enabling students to opt out of data collection may create ‘holes’ in the data set which reduce the effectiveness of learning analytics and disadvantage students overall.

There are however two exceptions to this where students’ consent must be obtained:

1. Where Special Category Data is used
2. When you take interventions with individual students on the basis of their analytics.

Q3. Should we ask students for their consent to take personal interventions with them as a result of learning analytics?

The analytics may for example suggest that a student is at academic risk. Initial contact with the student can be justified under the legitimate interests of the institution however when you intend to carry out an intervention on the basis of this data then, yes, you do need to request the student’s consent. Examples might include:

• An email to the student (justified under legitimate interests) which offers an informed choice of whether to attend an extra class (the intervention to which they would need to give their consent)
• Discussion in a routine tutorial meeting (legitimate interests), suggesting that an extra class could be helpful (consent).

Q4. When should consent be obtained from students to collect and use their data?

We recommend that consent is sought at the point where Special Category Data is collected or at the point where an intervention is offered. Requesting consent from students to collect and use their data for learning analytics on their first day of study as part of registration processes is unlikely to be legally valid and could result in incomplete, and hence less useful, data sets.

Q5. How should we ask students for their consent?

The requirements of GDPR for requesting consent include:

1. Consent requests should be kept separate from other terms and conditions.
2. Clear and specific information must be given to the students about what they are consenting to.
3. Students should be informed of any third party data controllers who will rely on the consent.
4. The consequences of either providing or withholding their consent must be made clear.
5. Clear, affirmative action is required by the student; the use of pre-ticked boxes would not be acceptable.
6. Students have the right to withdraw their consent at any time so mechanisms must be put in place to enable them to do so easily – with the consequent removal of their Special Category Data from all databases or withholding of any interventions.
7. You should keep records of any granting, withholding or withdrawal of consent by students.

Q6. What happens if a student doesn’t consent to the collection or use of their data for learning analytics?

Students should normally only be asked for consent if Special Category Data is collected or used or if interventions are to be taken with them (e.g. being phoned by a tutor).

If the student refuses to provide Special Category Data then it clearly can’t be collected or processed in any way, while if they refuse the particular interventions offered then they should not be subject to them.

Q7. What should we tell students?

Complete transparency about the processes of learning analytics, the data used etc. is important to ensure legal compliance as well as acceptance by staff and students. We’ve produced a model student guide to learning analytics and a model institutional learning analytics policy which can be adapted for institutional use and discussed in relevant committees with student representation.

You should provide additional information to students when inviting them to provide Special Category Data or when seeking their consent to carry out interventions based on learning analytics. See the response to How should we ask students for their consent? for suggestions on what additional information to provide.

Q8. Is learning analytics automated decision making as defined under the GDPR?

The GDPR protects individuals from solely automated decision making (i.e. ones without any human involvement) that has legal or similarly significant effects on them. Most instances of learning analytics would not fall into this category. Significant decisions should be taken by humans, who could potentially use learning analytics to help inform the decisions.

Q9. Is learning analytics profiling as defined under the GDPR?

Profiling is defined as

any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements

Many applications of learning analytics, including the identification of at-risk students, would come under this definition. Profiling is considered a type of automated decision-making so, if it has legal or similarly significant consequences, it is regulated in the same way as automated decision making.

Ensuring that humans are involved in decisions with significant consequences for individual students will help to ensure compliance with GDPR.

Q10. Lecturers and tutors have always known about students who are at academic risk and been able to intervene: isn’t learning analytics may just be supplementing what we did anyway so why should we have to do things differently?

The GDPR is concerned with personal data. If a student’s data is used to inform interventions then this does require the student’s consent, even if the data is basically confirming what the lecturer or tutor already knows.