The document discusses the impact of data protection and privacy frameworks, particularly the GDPR, on the design of learning analytics systems in education. It highlights key privacy requirements and rights for learners, including consent, access to their data, and the right to be informed. The influence of cultural and legal variations across countries is also explored, emphasizing the need for a balance between privacy and educational analytics.

1. The Influence of Data Protection
and Privacy Frameworks on the
Design of Learning Analytics
Systems
Tore Hoel
Dai Griffiths
Weiqin Chen
LAK17, Vancouver, Canada
2017-03-16

2. From Tim McKay’s
keynote

3. Yesterday @ LAK17

4. This alphabet soup is working on a standard
on LA Privacy & Data Protection Policies
ISO/IEC SC36 WG8
Sunday, 12 March meeting co-located with LAK17

5. What influences privacy
requirements for LA?

6. Privacy frameworks
OECD APEC EU GDPR
Preventing Harm
Lawfulness, Fairness and
Transparency
Collection Limitation Collection Limitation Data Minimisation
Purpose Specification Choice Purpose Limitation
Use Limitation Uses of Personal Information Storage Limitation
Data Quality
Integrity of Personal
Information
Integrity and Confidentiality
Openness Notice
Individual Participation Access & Correction Accuracy
Accountability Accountability Accountability
Security Safeguards Security Safeguards
Data Protection by Design and
by Default

7. New European Data Protection
Regulation (GDPR) for the digital age
• Consent for processing data: A clear
affirmative action
• Easy access to your own data (Data
Portability)
• Data breaches (e.g., hacking): Notice
without undue delay
• Right to be forgotten
• Data Protection by
Design and Data
Protection by Default
Published May 2016 –
National law in all
European countries
from 2018

8. LA process model
ISO/IEC 20748-1

9. GDPR ➔ Pedagogical
Requirements
LA Processes GDPR Requirements Pedagogical Requirements
Learning activity Give information of processing
operation and purpose
Explicit formulation of the scope of LA
processes. Choice of metrics that give
answers to the pedagogical questions
that initiated the LA process.
Data collection Affirmative action of consent to data
collection
Support of learner agency
Data storage and
processing
Access to, and rectification or erasure of
personal data.
Exercise the right to be forgotten.
Pseudonymisation and risk assessment
Support of learner agency
Analysis Meaningful information about the logic
involved. Information of profiling, e.g.,
predictive modeling
Support of learner agency and
understanding of learning context
Visualisation General requirements about
transparency and communication
Selection of salient issues for
pedagogical intervention
Feedback actions Information about the significance and
envisaged consequences of data
processing
Pedagogical intervention, relating
actions to pedagogical goals

10. GDPR inspired system
requirements
• Right to be informed
• Right to access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object
• Right related to automated
decision making and
profiling
• Accountability and
governance
• Breach notification
• Transfer of data (outside of
EU)
• Data Protection by Design
and by Default

11. Right to be informed
• The learner will know…
• What is the purpose of LA session
• What data are collected
• How data are stored and processed
• Principles for processing (predictive models / algorithms…)
• What visualisations
• Technical feedback actions designed for the LA process

12. Automated decision making /
profiling
• Right to not to be subject to decisions when based
on automated processing
• Learner must be able to…
• …obtain human intervention
• …express their point of view
• …obtain explanation of decisions and able to
challenge them

13. Privacy discourse in
selected countries

14. Is the massive concern about privacy
reflected the LAK discourse ?
• 2015 EU citizens survey
• Only 15% European citizens felt they had control over
information they provided online
• 1/3 felt they had no control at all
• ‘Data protection’ in LAK proceedings?
• 2014 & 2015: 0 papers
• 2016: 1 paper
• 2017: 6 papers

15. European Union
• LACE project work: Privacy a show-stopper?
• OUUK Code of Practice
• JISC work on Consent Service
• General Data Protection Regulation – European law May 2018
• Will influence the development and implementation of LA
systems
• Potential for strengthening the pedagogical grounding of
these systems

16. What could be a compelling force
to bridge pedagogy and analytics?
Hoel, T. & Chen, W. (2016). The Principle of Data Protection by Design and Default as a lever for
bringing Pedagogy into the Discourse on Learning Analytics.
Workshop paper in Chen, W. et al. (Eds.) (2016). Proceedings of the 24th International
Conference on Computers in Education. India: Asia-Pacific Society for Computers in Education

17. Japan
• Bottom-up approach for application of educational
data for LA
• K-12 Smart School project: LA support system
• No public debate on privacy issues. (Raised though
in a Kyushu university LAK17 workshop paper)
• Different ministries have different positions on
disclosure of educational data (e.g., to 3rd parties)

18. Korea
• Top-down process
• KERIS report on Prospects for the Application of
LA
• Ambitious plans for rolling out LA in schools
• LASI-ASIA 2016
• Vendors: MoE are too conservative in giving
access to data

19. China
• Top-down
• Big Data Centres established at a number of
universities
• No data protection act or data protection regime
• Willingness to use every data there is; however,
still few examples of adoption at scale for LA

20. Issues

21. Individual vs Organisation

22. Schools vs. Higher Ed
• Schools may be more susceptible to the
influence of legal constrains than HE
• Higher Ed is more research driven, and the role
of research ethics rules may delay the
discussions on ethics and data protection of full
scale applications
• Tug of war between advocates of open vs.
closed data

23. Data Protection by Design
and by Default
• A simple
checkbox will
not do any more
• Open each sub
process of LA up
for discussion
related to data
protection

24. Window of
opportunity is now!
Will South Korea wait to launch a national
LA solution for K-12 until individualised
privacy solutions are found?
Will Japanese authorities give 3rd party
vendors the opportunity to analyse LA data?
Will European countries use the leverage given them
by the GDPR to broaden the discourse
on privacy and data protection?
And what about China?

25. 谢谢您的关注
This work is licensed under a Creative Commons
Attribution 4.0 International (CC BY 4.0).
tore.hoel@hioa.no
@tore
Skype: odintorloke
WeChat: Tore_no