Regulatory Developments

Last updated:

6 days 6 hours ago

Blog Manager

One of Jisc’s activities is to monitor and, where possible, influence regulatory developments that affect us and our customer universities, colleges and schools as operators of large computer networks. Since Janet and its customer networks are classified by Ofcom as private networks, postings here are likely to concentrate on the regulation of those networks. Postings here are, to the best of our knowledge, accurate on the date they are made, but may well become out of date or unreliable at unpredictable times thereafter. Before taking action that may have legal consequences, you should talk to your own lawyers. NEW: To help navigate the many posts on the General Data Protection Regulation, I've classified them as most relevant to developing a GDPR compliance process, GDPR's effect on specific topics, or how the GDPR is being developed. Or you can just use my free GDPR project plan.

Group administrators:

Andrew Cormack

Recent members:

A Data Protection Framework for Learning Analytics

Andrew Cormack

Learning Analytics - Legal Framework Draft Submitted.pdf

Since becoming involved in Jisc's work on learning analytics, I've been trying to work out the best place to fit the use of students' digital data to improve education into data protection law. I've now written up those thoughts as a paper, and submitted it to the Journal of Learning Analytics. As the abstract says:

Most studies on the use of digital student data adopt an ethical framework derived from human-studies research, based on the informed consent of the experimental subject. However consent gives universities little guidance on the use of learning analytics as a routine part of educational provision: which purposes are legitimate and which analyses involve an unacceptable risk of harm. Obtaining consent when students join a course will not give them meaningful control over their personal data three or more years later. Relying on consent may exclude those most likely to benefit from early interventions.

This paper proposes an alternative framework based on European Data Protection law. Separating the processes of analysis (pattern-finding) and intervention (pattern-matching) gives students and staff continuing protection from inadvertent harm during data analysis; students have a fully informed choice whether or not to accept individual interventions; organisations obtain clear guidance: how to conduct analysis, which analyses should not proceed, and when and how interventions should be offered. The framework provides formal support for practices that are already being adopted and helps with several open questions in learning analytics, including its application to small groups and alumni, automated processing and privacy-sensitive data.

As a current student and (twice) alumnus, I prefer to think that my own data will be handled according to these ideas, rather than on the basis that I gave informed consent mumble years ago. The Journal encourages authors to share their drafts for comment during the submission process, so I'd be very interested to hear what you think.