=Paper=
{{Paper
|id=Vol-3738/paper6
|storemode=property
|title=The Right to Privacy and Data Protection for High School Students in the Context of Digital Learning Models and Learning Analytics
|pdfUrl=https://ceur-ws.org/Vol-3738/paper6.pdf
|volume=Vol-3738
|authors=Mario Paludi
|dblpUrl=https://dblp.org/rec/conf/lasispain/Paludi23
}}
==The Right to Privacy and Data Protection for High School Students in the Context of Digital Learning Models and Learning Analytics==
The Right to Privacy and Data Protection for High School Students in the Context of Digital Learning Models and Learning Analytics Mario Paludi1 a Università degli Studi D’Annunzio, Via dei Vestini 31, Chieti-Pescara, Italy b Università degli Studi di Foggia, Via A. Gramsci 89/91, Foggia, Italy Abstract The centrality of the right to privacy and personal data protection for high school students is fundamental in light of the increasing use of digital technologies for educational purposes and the effort to introduce learning analytics at the school level. The use of digital technologies, particularly those enhanced by artificial intelligence tools, necessitates heightened attention to data and privacy law and to the fundamental right to privacy and personal data protection for high school students, who are inherently vulnerable. All students will be compelled to interact with school-provided technology, with disabled or socially, culturally, and economically disadvantaged students being even more vulnerable. The definition of the legal framework in this domain is a prerequisite for the effective protection of privacy and data and the development of secure, data-driven technologies. A parallel understanding of the human factors that influence data handling and privacy is similarly of great consequence. The research project is structured as follows: (1) outline the legal and ethical rules and principles regarding privacy and personal data applicable to high school; (2) assess schools' preparedness in managing students' data in compliance with legal and ethical standards; (3) evaluate teachers' and students' knowledge, attitude and awareness of privacy and personal data protection, and their behavior during educational activities in digital environments; (4) outline educational actions and improvement proposals for managing students' privacy and personal data, especially when learning analytics will be employed extensively to help optimize learning and improve the environment in which it takes place. Keywords Privacy, Privacy awareness and knowledge, Data & Privacy Law, Digital technologies, High School Students, Learning analytics, Data Literacy 1. Introduction High schools are facing a Copernican shift in how they deliver their educational offerings, forced by technological digital evolution. The new frontier of digital technologies in education, especially those driven by AI and the use of data assets, is the challenge that schools face in order not to be left out of the momentous changes. LASI Europe 2024 DC: Doctoral Consortium of the Learning Analytics Summer Institute Europe 2024, May 29-31 2024, Jerez de la Frontera, Spain ∗ Corresponding author. mario.paludi@unifg.it (M. Paludi) 0009-0002-0684-6798 (M. Paludi) © 2024 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). CEUR ceur-ws.org Workshop ISSN 1613-0073 Proceedings In particular, new digital technologies in education have reflections in the fields of law, privacy and data protection, learning analytics, and digital literacy. This research project aims to investigate the issue of privacy and data protection of high school students (age range 14-18) within the current legal framework in Europe and the use of data in learning analytics. The European regulatory framework, regarded as the most comprehensive due to the influence of the GDPR and the EU AI Act, has a great impact. Therefore, different fields of study are involved in this set of elements. New digital technologies in education have implications in the fields of law, ethics, learning analytics, and digital literacy. In order to understand how to protect privacy and handle data in accordance with the law and ethical principles, we need to outline the legal provisions on privacy and data processing, describe the centrality of privacy in the use of digital technologies in the school environment, and evaluate how privacy impacts learning analytics and vice-versa. It is of the utmost importance to direct a comparable degree of attention to the school environment, students' and teachers' activities, awareness, knowledge, attitude, and behavior on the ground. Consequently, it is essential to assess the multiple factors involved in the high school environment and stakeholders about privacy and data protection, as well as their handling of personal data. 2. Background 2.1 Digital Technologies/EdTech The use of digital technologies in schools is growing steadily and, with appropriate policies, offers great potential for improving the delivery of education, learning, and school management. Current literature shows that digitization in schools has been in the spotlight during the recent COVID-19 pandemic, highlighting many problems alongside the promise of improving the quality of teaching and learning with ICT [1]. Besides positive results of improving inclusion, participation, and learning, including for students with disabilities, issues related to the legal compliance of systems and policies, and stakeholders' competence in terms of the “right to digital literacy” need to be considered broadly and in-depth [2]. Certainly, for schools that want to keep up and adapt their educational offer to the canons of digital transformation, the competent use of new digital technologies, more often supported by AI, will be indispensable. The integration of digital technologies into the world of schooling has implications and effects not only on teaching and learning in the strict sense but also on many interrelated and equally important issues, including protecting privacy and personal data and managing students’ data [3]. “Develop a digital citizenship program: as technology use becomes more prevalent, students must learn about responsible digital conduct. Therefore, schools should establish a digital citizenship initiative that instructs students on online safety measures, safeguarding their privacy, and utilizing technology ethically and responsibly” [4] implies that the consideration has to be extended to teachers and institutions, including the legal framework and ethical instances [5]. With the development of digital technologies, research on digital literacy (rectius literacies) in schools [6] is experiencing considerable ferment from a variety of perspectives, including data literacy by teachers [7] and annexed study on digital identity and privacy and training “in favor of conscious use of tools for one’s own virtual identity and privacy” [8]. 2.2 Privacy and Personal Data The expansion of digital technologies, particularly in the field of information and communication technology (ICT), has led to a heightened awareness of the importance of privacy. This is evidenced by the findings of EDUCAUSE 2020, which identified the protection of personal data as one of the top 10 IT priorities for the year 2020 (Grajek, 2020) [9] in the field of higher education, though conceptually generalizable. This is still the case in the 2023 top 10 IT priorities (Grajek, 2022) [10], where it ranks second. Figure 1: 2023 top 10 IT priorities. Retrieved from [10] Furthermore, this is reflected in the general perception according to the survey on awareness and management of access to personal data [11]. Figure 2. How did EU people manage access to their personal data in 2023. Retrieved from [11] While the majority of research is concentrated on higher education (HE), schools are also surveyed on a range of related topics, including digital technologies, privacy, ethics, and data handling. These topics will undoubtedly become more pertinent with the introduction of AI tools, which will generate insights into the associated privacy concerns and the question of trustworthiness [12, 13]. Two key dimensions inform doctoral research on privacy and data protection in schools: the legal framework at the normative level and the behavioral framework at the concrete level. The regulatory requirements, their interpretation and application, and the human factor, as observed in the context of the school environment, represent the two principal study dimensions of doctoral research. In particular, even if a universal definition of privacy is lacking [14] for some, legal certainty is essential to provide the ground rules. In addition, a more detailed examination of regulation should encompass the applicability of the "procedural account of technology-neutral regulation" in the context of education. This would entail the creation of legal frameworks that can accommodate future technological developments without necessitating the implementation of specific adjustments for each new technology [15]. A multidisciplinary approach, drawing on the expertise of legal and learning sciences, will enable the most comprehensive definition of the current state of the art in privacy and data handling, as well as the development of robust proposals [16]. In light of these considerations, it becomes evident that grasping the ratio between rules and behavior is of paramount importance. In the specific case of privacy, a fundamental question has been raised: do people really care about their privacy? [17]. A 2023 survey with 2,600 of 18 years and older from the following countries: Australia, Brazil, China, France, Germany, India, Italy, Japan, Mexico, Spain, United Kingdom, and the United States gave evidence that on average, 46 percent of respondents across all surveyed countries were aware of their local privacy laws, with peaks of 63 percent from India, 63 percent from the UK and 55 percent from Italy. But on this same issue, we need to compare this evidence with the "privacy paradox" issue. This concept highlights the inconsistency of privacy attitudes and behaviors in the face of the assumption that people care about their privacy [18]. Thus, attitude and behavior must be evaluated with caution, and awareness becomes a key factor. This is a groundbreaking topic for high school students who are going through the process of developing character and building knowledge. However, in dealing with awareness, educational stakeholders involved in data management must possess a comprehensive and preliminary understanding of privacy principles anchored in explicit legal frameworks. YEAR EVENT 1950 Article 8 of the European Convention on Human Rights (ECHR), which establishes the right to respect for private life 1981 The Council of Europe adopts Convention 108- now Convenction 108 Plus – which is the largest European -level document for the protection of personal data 1995 The EU adopts Directive 46/95 on the protection of personal data 2001 Approval of the Nice Charter, in which Article 8 establishes the right to protection of personal data 2007 The right to the protecion of personal data enjoyed by every person was reaffirmed in the TFEU. In addition, the legislative competence of the European Parliament and the Council on the subject was established. 2016 General Data Protection Regulation (GDPR) 2024 The Council of the European Union approves of the EU Artificial Intelligence ACT. Table 1. Historical-legislative evolution of privacy legislation. Retrieved from [19] Accordingly, a legal definition of privacy and data protection requires an understanding of the intertwined provisions of multiple regulatory sources, including the General Data Protection Regulation (GDPR) and the recently enacted EU Act on Artificial Intelligence (AI). Although the latter is the most widely recognized regulatory source, it is crucial to acknowledge that it is not the sole relevant regulatory instrument. A comprehensive understanding of the full range of regulatory frameworks will enable each stakeholder to fulfill their obligations with confidence and a heightened sense of responsibility, thereby facilitating informed decision-making with regard to the handling of data. 2.3 Learning analytics One of the best-known definitions of learning analytics (LA) is from Siemens (2013) [20] who states that "Learning Analytics is the measurement, collection, analysis, and reporting of data about learners and their context to understand and optimize learning and the environment in which it takes place" (p. 1382). The importance of data analytics in education is a multi-level issue: data-based decision- making, monitoring and evaluating processes for administrators; helping self-regulation in the online environment; supporting quality, effectiveness, and assessment of teaching and learning activities outcomes for teachers and students [21]. The potential benefits of LA at the high school educational level are highlighted by the current Quality Assurance with Learning Analytics in Schools (QUALAS) project (01/10/2023-30/09/2026), which aims to build capacity in secondary education schools for the use of learning analytics in the framework of quality assurance [22]. Ethical and legal issues related to privacy and data processing in education are a topic of general interest [23]. They have been a recurring and hot topic of discussion in the LA community because of their close connection to data processing. In general, research on effective privacy-enhancing practices in LA tends to focus on specific aspects, such as students' privacy concerns, perceptions of privacy risk and control, trust, and willingness to share personal data. Understanding students’ privacy concerns is seen as an essential first move toward “effective privacy-enhancing practices” in LA [24]. When designing an LA system for high schools, it is essential to consider beforehand the interests of all stakeholders. Research has primarily focused on the higher education level, and further investigation is needed to understand the conditions under which high school students are willing to disclose data relevant to learning analytics systems [25, 26]. Models have been developed to explore students' privacy concerns, from the APCO (Antecedents → Privacy Concerns → Outcomes) to SPICE (students' privacy concerns), focusing on the antecedents-to-privacy-concerns link. Similar models for high school students must take into account various factors, from those of knowledge to those of awareness, confidence, attitude, and relationship with teachers, better in the midst of learning when data are generated. As observed in a recent review on human-centred learning analytics and AI in education data, despite privacy emerging as a much-discussed topic, gaps remain in our understanding of the importance of human control, safety, reliability, and trust in designing and deploying these systems [27]. What emerges is a resolution to define the parameters within which to operate legally and ethically, and to provide practical and compliant ways of doing so [28]. Students must be considered agents of their own learning and any LA system must be a student-centered learning analytics (SCLA) [29]. In this scenario, the agency of students (and teachers) must be strengthened by effective legal competence of their rights and protections, because the undefined concepts are the enemy of their respect. In light of this, it is advisable to broaden the scope of the inquiry to understand the factors that may affect data privacy at the high school level, with particular attention to the human elements at play, namely the behavior, attitude, legal knowledge, and literacy, and expectations of students and teachers, as well as their interrelation. The use of LA in high schools, which is likely to increase, must be designed with an awareness of the range of human factors that can affect the proper handling of data. Not neglecting the need to comply with the kind of regulatory strategy that will be outlined for privacy and data protection in the face of the more futuristic stresses of technology development (namely AI-driven). 3. Goal and research questions When considering privacy and data protection in the context of upper secondary education, it is essential to take into account the legal framework for privacy and data processing, both in general and specifically. This begins with an analysis of the regulations in question and their application by judicial bodies. This is particularly important in light of recent regulatory interventions, i.e. the EU AI Act, that apply directly in Europe and may apply indirectly elsewhere. Subsequently, we need to understand whether educational institutions, namely high schools, and their employees (primarily teachers) are actually behaving in accordance with the rules. In this way, it is possible to weigh up which elements have the greatest impact on the issue of privacy and data protection. It is equally important to understand that the protection of privacy and the management of personal data in the school context are influenced by different variables that emerge from the environment (e.g. ICT structures and systems, legal documents and prescription), the behavior (conduct), and the subjective sphere of individuals (i.e. awareness, knowledge, expectations, trust) that can only be assessed through a field study and subsequent analysis of the data collected. Finally, based on the quantity and quality of the data collected and the results obtained from their interpretation, it is possible to provide operational indications to educational institutions and recommend training courses for teachers and students to make the protection of privacy and personal data as effectively as possible and to propose operational paradigms to the LA in the management of high school student data. Accordingly, the research questions for this project may be formulated as follows: RQ1: What are the legal definitions of privacy and personal data within the relevant legal framework, and what effects do they have on school activities? RQ2: How do high schools concretely manage data and protect privacy, and what are the behaviors, knowledge, awareness levels, and potential risks and causes associated with the activities of teachers and students? RQ3: How can the protection of students' privacy and personal data be made more effective, and what operational proposals can be formulated? 4. Methods To answer the research questions of the PhD project, the work is divided into three phases. The first consists of a systematic scoping review in the law domain, learning analytics, privacy and data, digital technologies, and high school. Furthermore, I will also conduct a review of current research in the learning analytics domain to assess the methods and objectives used to discuss and manage privacy awareness and knowledge in high school context. Strings containing a combination of the keywords "Privacy, Privacy awareness, and knowledge, Data & Privacy Law, Digital technologies, High School Students, Learning analytics, Data Literacy" are entered to query the Scopus Web of Science, Eric, and Bera databases. Relevant official documents and publications are retrieved from institutional sites (inter alia OECD, UNESCO, EUR-lex). The review will be based on PRISMA-ScR checklist and explanation and the JBI methodological guidance [30]. Thus, the results will help the evaluation of privacy concerns, awareness, knowledge, attitude, and behavior in the education environment [31]. The second phase is focused on collecting and analyzing data. Survey research will likely be employed to collect data and to ascertain specific characteristics of the group in question (Fraenkel et al.) [32]. Survey studies offer a quantitative description of trends, attitudes, and views across a population through studies conducted on a representative sample. Therefore, an explanatory sequential design will start with a structured questionnaire for students and teachers comprising multiple-choice questions on a Likert scale (still to be defined) to ascertain the value of students' and teachers' awareness, knowledge, behavior, trustworthiness and attitude regarding the high school privacy law and ethics in data management. Qualitative data collection and analysis through focused interviews will enhance the comprehension of the underlying reasons behind statistical findings [33, 34]. Finally to enrich the body of knowledge that will emerge from the research and to make the connection to the LA more consistent, I am considering whether it would be feasible to include in the research project the idea of simulating the use of the LA within high schools for student assessment and school self-assessment. Approval from the university's ethics committee and permission from the school principals will be required. The third phase is the analysis, study, interpretation and systematization of data for the development of possible proposals and guidelines for practitioners. 5. Current status of the work A scoping review of the literature relevant to the following major research topics is under review: (1) the legal framework, (2) digital technologies in education (3) privacy and data protection in high school, and (4) learning analytics, ethics and privacy issues. Updating and systematization of the literature review records are underway. In addition, in the coming months of the year, with the support of statistical experts, the identification and development of survey instruments to be used in high schools as soon as activities resume, i.e. in September 2024, will be carried out. Finally, I am reflecting on the methods, time, and means of implementing an LA driven experiment in the school. 6. Contribution The project's contribution falls under the broad LA theme of "Ethics, Privacy, Regulations and Policies." In particular, the first contribution will be to systematically define the law concepts of privacy rights and personal data protection in the high school context and within the use of digital technologies, with the clarity of timely and explicit reference to the regulatory framework, primarily European (e.g., GDPR, AI ACT). The second contribution will entail observing and evaluating the management of privacy and the handling of personal data in digital environments by high school students and teachers. This will enable the measurement and evaluation of the impact of various factors affecting data handling and privacy in real-world educational contexts. The third contribution will be to propose practical and targeted strategies to enhance the digital and legal literacy of students and teachers. Additionally, it will formulate practical preparatory guidance for learning analytics that is responsive to privacy and data safety at the school level, once it becomes fully widespread. 7. References [1] S. Timotheou, O. Miliou, Y. Dimitriadis, et al., Impacts of digital technologies on education and factors influencing schools' digital capacity and transformation: A literature review. Educ Inf Technol 28 (2023) 6695–6726. doi:10.1007/s10639- 2211431-8. [2] E. Celeste, G. De Gregorio, Towards a Right to Digital Education? Constitutional Challenges of Edtech, JIPITEC 14 (2023) 234 para 1. [3] E. Zeide, Education Technology and Student Privacy, in The Cambridge Handbook of Consumer Privacy, E. Selinger, J. Polonetsky, and O. Tene, Eds. Cambridge: Cambridge University Press, 2018, pp. 70–84. [4] T. M. Yuliandari, A. Putri and Y. Rosmansyah, "Digital Transformation in Secondary Schools: A Systematic Literature Review," in IEEE Access, vol. 11, 2023, pp. 90459- 90476. doi: 10.1109/ACCESS.2023.3306603. [5] E. Baysan, Ş. Çetin, Determining the Training Needs of Teachers in Ethical Use of Information Technologies, Journal of Theoretical Educational Science, 14(3) (2021) 476-497. doi:10.30831/akukeg.891057. [6] L. Ilomäki, M. Lakkala, V. Kallunki, D. Mundy, M. Romero, T. Romeu, & A. Gouseti, Critical digital literacies at school level: A systematic review. Review of Education, 11 (2023) e3425. doi: 10.1002/rev3.3425. [7] F. Caena, C. Redecker, Aligning teacher competence frameworks to 21st century challenges: The case for the European Digital Competence Framework for Educators (Digcompedu). Eur J Educ. 54 (2019) 356–369. doi: 10.1111/ejed.12345 [8] C. G. Demartini, L. Benussi, V. Gatteschi and F. Renga, "Education and Digital Transformation: The “Riconnessioni” Project," in IEEE Access, vol. 8, 2020, pp. 186233- 186256. doi: 10.1109/ACCESS.2020.3018189. [9] S. Grajek, Top 10 IT issues 2020: The drive to digital transformation begins (2020). EDUCAUSE Review Special Report. https://er.educause.edu/- /media/files/articles/2020/1/er20sr201.pdf [10] S. Grajek and the 2023–2024 EDUCAUSE Top10 Panel https://er.educause.edu/articles/2022/10/top-10-it-issues-2023-foundation- models. [11] Eurostat, how internet users protected their data in 2023, 26 January 2024. https://ec.europa.eu/eurostat/web/products-eurostat-news/w/ddn-20240126-1. [12] CC. Lin, A.Y.Q. Huang, & O.H.T. Lu, Artificial intelligence in intelligent tutoring systems toward sustainable education: a systematic review. Smart Learn. Environ. 10:41, 2023. doi:10.1186/s40561-023-00260-y. [13] M. Pan, J. Wang and J. Wang, "Application of Artificial Intelligence in Education: Opportunities, Challenges, and Suggestions" 2023 13th International Conference on Information Technology in Medicine and Education (ITME), Wuyishan, China, (2023), pp. 623-627. doi: 10.1109/ITME60234.2023.00130. [14] A.L. Allen, Unseasy access: Privacy for women in a free society, Rowman & Littlefield, 1988. [15] R. Leenes, Regulating New Technologies in Times of Change. In: Reins, L. (eds) Regulating New Technologies in Uncertain Times. Information Technology and Law Series, vol 32. T.M.C. Asser Press, The Hague, 2021, pp. 3-17. doi:10.1007/978-94- 6265-279-8_1. [16] P. Tsormpatzoudi, B. Berendt, F. Coudert, Privacy by Design: From Research and Policy to Practice – the Challenge of Multi-disciplinarity. In: B. Berendt, T. Engel, D. Ikonomou, D. Le Métayer, S. Schiffner, (eds) Privacy Technologies and Policy. APF 2015. Lecture Notes in Computer Science, 2016, vol 9484. Springer, Cham. doi:10.1007/978-3-319- 31456-3_12 [17] Statista (2019). Awareness of internet users worldwide of their country's privacy laws as of June 2023, by country. https://www.statista.com/statistics/1441448/privacy- laws-awareness-global-by-country/#statisticContainer. [18] S. Kokolakis, Privacy attitudes and privacy behavior: A review of current research on the privacy paradox phenomenon, Computers & Security, Volume 64, (2017), Pages 122-134. doi:10.1016/j.cose.2015.07.002. [19] D. Battista, G. Uva, Exploring the Legal Regulation of social media in Europe: A Review of Dynamics and Challenges—Current Trends and Future Developments. Sustainability, 15, (2023), 4144. doi:10.3390/su15054144. [20] G. Siemens, Learning analytics: The emergence of a discipline. American Behavioral Scientist, 57(10), (2013), 1380-1400. doi:10.1177/0002764213498851. [21] UNESCO: minding the data: protecting learners’ privacy and security. UNESCO (2022). https://unesdoc.unesco.org/ark:/48223/pf0000381494. [22] Qualas Quality Assurance with Learning Analytics at School. https://bild.research.vub.be/qualas [23] P. Eleni, Towards a Secure and Privacy Compliant Framework for Educational Data Mining. In: Nurcan, S., Opdahl, A.L., H. Mouratidis, A. Tsohou, (eds) Research Challenges in Information Science: Information Science and the Connected World. RCIS 2023. Lecture Notes in Business Information Processing, vol 476. Springer, Cham. doi:10.1007/978-3-031-33080-3_35. [24] C. Mutimukwe, O. Viberg, L-M Oberg, & T. Cerratto-Pargman, Students’ privacy concerns in learning analytics: Model development. British Journal of Educational Technology, 53 (2022) 932–951. doi:10.1111/bjet.13234. [25] D. Ifenthaler, & C. Schumacher, Student perceptions of privacy principles for learning analytics. Educational Technology Research & Development, 64(5) (2016) 923–938. doi:10.1007/s11423-016-9477-y. [26] R. Kimmons, Safeguarding student privacy in an age of analytics. Education Tech Research Dev 69 (2021) 343–345. doi:10.1007/s11423-021-09950-1. [27] A. Riordan, Vanessa Echeverria, J. Yueqiao, Y. Lixiang, S. Zachari, D. Gašević, R. Martinez- Maldonado, Human-centred learning analytics and AI in education: A systematic literature review, Computers and Education: Artificial Intelligence, Volume 6 (2024) 100215. doi:10.1016/j.caeai.2024.100215. [28] A. Pardo, G. Siemens, Ethical and privacy principles. Br J Educ Technol, 45 (2014) 438- 450. doi:10.1111/bjet.12152. [29] X. Ochoa, A.F. Wise, Supporting the shift to digital with student-centered learning analytics. Education Tech Research Dev 69 (2021) 357–361. doi:10.1007/s11423-020- 09882-2. [30] M.D.J. Peters, C. Marnie, H. Colquhoun, H. et al. Scoping reviews: reinforcing and advancing the methodology and application. Syst Rev 10 (2021) 263. doi:10.1186/s13643-021-01821-3. [31] A. F. Westin, Social and political dimensions of privacy. J. Soc. Issues, 59 (2023) 431−453. doi:10.1111/1540-4560.00072 [32] J. Fraenkel, N. Wallen, & H. Hyun, how to design and evaluate research in education, 11th Edition, McGraw-Hill, New York, 2023. [33] N. V. Ivankova, J. W. Creswell, & S. L. Stick, Using Mixed-Methods Sequential Explanatory Design: From Theory to Practice. Field Methods, 18(1) (2006) 3-20 doi:10.1177/1525822X05282260. [34] J.P. Takona, Research design: qualitative, quantitative, and mixed methods approaches / sixth edition. Qual Quant 58 (2024) 1011–1013. doi:10.1007/s11135-023-01798-2.