The centrality of the right to privacy and personal data protection for high school students is fundamental in light of the increasing use of digital technologies for educational purposes and the effort to introduce learning analytics at the school level. The use of digital technologies, particularly those enhanced by artificial intelligence tools, necessitates heightened attention to data and privacy law and to the fundamental right to privacy and personal data protection for high school students, who are inherently vulnerable. All students will be compelled to interact with school-provided technology, with disabled or socially, culturally, and economically disadvantaged students being even more vulnerable. The definition of the legal framework in this domain is a prerequisite for the effective protection of privacy and data and the development of secure, data-driven technologies. A parallel understanding of the human factors that influence data handling and privacy is similarly of great consequence. The research project is structured as follows: (1) outline the legal and ethical rules and principles regarding privacy and personal data applicable to high school educational settings; (2) assess schools' preparedness in managing students' data in compliance with legal and ethical standards and evaluate teachers' and students' knowledge, attitude and awareness of privacy and personal data protection, and their behavior during educational activities in digital environments; (3) outline educational actions and improvement proposals for managing students' privacy and personal data, especially when AIED will be employed extensively, to help optimize learning and improve the environment in which it takes place.
High schools are undergoing a Copernican transformation in education delivery, driven by technological digital evolution. The new frontier of digital technologies in education, especially those driven by AI and the use of data assets, presents a critical challenge for schools striving to remain relevant amidst these significant changes.
Specifically, the adoption of new digital technologies in education raises important considerations in the areas of law, privacy, and data protection, as well as digital literacy. This research project aims to investigate the privacy and data protection issues of high school students (age range 14 -18) in the context of increasing use of artificial intelligence in educational settings, within the current European legal framework. The European regulatory framework, primarily shaped by the GDPR and the (proposed) EU AI Act, is considered the most comprehensive source of relevant regulations.
Therefore, various disciplines are involved in addressing this set of elements. The implementation of new digital technologies in education has significant implications for law and ethics, and these fields, in turn, influence technological development.
To understand how to protect privacy and handle data in compliance with legal and ethical principles, it is necessary to outline the legal provisions on privacy and data processing, highlight the centrality of privacy in the use of digital technologies in schools, and evaluate how privacy impacts artificial intelligence and data processing, like learning analytics, and vice versa.
Beyond regulatory considerations, it is equally important to focus on the school environment, including the activities, awareness, knowledge, attitudes, and behaviors of both students and teachers.
Consequently, it is essential to evaluate the multiple factors within high schools and among stakeholders related to privacy, data protection, and the handling of personal data.
The use of digital technologies in schools is growing steadily and, with appropriate policies, offers great potential for improving the delivery of education, learning, and school management.
Recent literature indicates that digitization of schools has been in the spotlight during the recent COVID -19 pandemic, revealing various challenges alongside the potential of improving the quality of teaching and learning with ICT [1].
While digitization has yielded outcomes in promoting inclusion, participation, and learning, particularly for students with disabilities, substantial concerns remain regarding the legal compliance of systems and policies, as well as the competence of stakeholders in ensuring the “right to digital literacy” [2].
Certainly, for schools that want to keep up and adapt their educational offer to the canons of digital transformation, the competent use of new digital technologies, more often supported by AI, will be indispensable.
The integration of digital technologies into the world
of schooling has implications and effects not only on
teaching and learning in the strict sense but also on many
interrelated and equally important issues, including
protecting privacy and personal data and managing
students’ data [3]. “Develop a digital citizenship
program: as technology use becomes more prevalent,
students must learn about responsible digital conduct.
Therefore, schools should establish a digital citizenship
initiative that instructs students on online safety
measures, safeguarding their privacy, and utilizing
technology ethically and responsibly” [4] implies that the
consideration has to be extended to teachers and
institutions, including the legal framework and ethical
instances [
With the development of digital technologies,
research on digital literacy (rectius literacies) in schools
[
The expansion of digital technologies, particularly in the
field of information and communication technology
(ICT), has led to a heightened awareness of the
importance of privacy. This is evidenced by the findings
of EDUCAUSE 2020, which identified the protection of
personal data as one of the top 10 IT priorities for the
year 2020 (Grajek, 2020) [
Furthermore, this is reflected in the general
perception according to the survey on awareness and
management of access to personal data [
While the majority of research is concentrated on
higher education (HE), schools are also surveyed on a
range of related topics, including digital technologies,
privacy, ethics, and data handling. These topics will
undoubtedly become more pertinent with the anticipated
introduction of AI tools, which will lead to a greater
depth of insights into the associated privacy concerns
and the question of trustworthiness [
Two key dimensions inform doctoral research on privacy and data protection in schools: the legal framework at the normative level and the behavioral framework at the concrete level. The regulatory requirements, their interpretation and application, and the human factor, as observed in the context of the school environment, represent the two principal study dimensions of the research.
In particular, legal certainty, even if a universal
definition of privacy is lacking [
An interdisciplinary approach, drawing on the
expertise of legal and learning sciences, will enable the
most comprehensive definition of the current state of the
art in privacy and data handling, as well as the
development of robust proposals [
In light of these considerations, it becomes evident that grasping the ratio between rules and behavior is of paramount importance.
In the specific case of privacy, a fundamental
question has been raised: do people really care about
their privacy? [
A 2023 survey with 2,600 of 18 years and older from the following countries: Australia, Brazil, China, France, Germany, India, Italy, Japan, Mexico, Spain, United Kingdom, and United States gave evidence that on average, 46 percent of respondents across all surveyed countries were aware of their local privacy laws, with peaks of 63 percent from India, 63 percent from UK and 55 percent from Italy.
But on this same issue, we need to compare this
evidence with the "privacy paradox" issue. This concept
highlights the inconsistency of privacy attitudes and
behaviors in the face of the assumption that people care
about their privacy [
Therefore attitude and behavior must be evaluated with caution, and awareness becomes a key factor.
This is a groundbreaking topic for high school students who are going through the process of developing character and building knowledge.
However, dealing with awareness, educational stakeholders involved in data management must possess a comprehensive and preliminary understanding of privacy principles anchored in explicit legal frameworks.
Year
Event 1950 1981 1995 2001 2007
Article 8 of the European Convention on Human Rights (ECHR), which establishes the right to respect for private life The Council of Europe adopts Convention 108— now Convention 108 Plus—which is the largest European-level document for the protection of personal data The EU adopts Directive 46/95 on the protection of personal data Approval of the Nice Charter, in which Article 8 establishes the right to protection of personal data The right to the protection of personal data enjoyed by every person was reaffirmed in the TFEU. In addition, the legislative competence of the European Parliament and the Council on the subject was established 2016
General Data Protection Regulation (GDPR)
Accordingly, a legal definition of privacy and data protection requires an understanding of the intertwined provisions of multiple regulatory sources, including the General Data Protection Regulation (GDPR) and the recently enacted EU Act on Artificial Intelligence (AI). Although the latter is the most widely recognized regulatory source, it is crucial to acknowledge that it is not the sole relevant regulatory instrument.
A comprehensive understanding of the full range of regulatory frameworks will enable each stakeholder to fulfill their obligations with confidence and a heightened sense of responsibility, thereby facilitating informed decision-making with regard to the handling of data. 2.3.
One of the best-known definitions of learning analytics
(LA) is from Siemens (2013) [
The importance of data analytics in education is a
multi-level issue: data-based decision-making,
monitoring and evaluating processes for administrators;
supporting quality, effectiveness, and assessment of
teaching and learning activities outcomes for teachers
and students [
The potential benefits of LA are highlighted by the
Quality Assurance with Learning Analytics in Schools
(QUALAS) project (01/10/2023-30/09/2026), which aims
to build capacity in secondary education schools for the
use of learning analytics in the framework of quality
assurance [
Ethical and legal issues related to privacy and data
processing in education are a topic of general interest
[
In general, research on effective privacy-enhancing
practices in LA tends to focus on specific aspects, such as
students' privacy concerns, perceptions of privacy risk
and control, trust, and willingness to share personal data.
Understanding students’ privacy concerns is seen as an
essential first move toward “effective privacy-enhancing
practices” in LA [
Models have been developed to explore students' privacy concerns, from the APCO (Antecedents → Privacy Concerns → Outcomes) to SPICE (students' privacy concerns), focusing on the antecedents-toprivacy-concerns link. Similar models for high school students must take into account various factors, from those of knowledge to those of awareness, confidence, attitude, and relationship with teachers in the midst of learning when data are generated.
As observed in a recent review on human -centred
learning analytics and AI in education data, despite
privacy emerged as the much-discussed topic, gaps
remain in our understanding of the importance of human
control, safety, reliability, and trust in designing and
deploying these systems [
What emerges is a resolution to define the
parameters within which to operate legally and ethically,
and to provide practical ways of doing so [
In light of this, it is advisable to broaden the scope of inquiry to understand the factors that may affect data privacy at the high school level, with particular attention to the human elements at play, namely the behavior, attitude, legal knowledge, and expectations of students and teachers, and lately their interrelation.
Then, the use of LA in high schools, which is likely to be on the increase, must be prepared with an awareness of the range of human factors that can have an impact on the proper handling of data in compliance with the legal framework.
When considering privacy and data protection in the context of upper secondary education, it is essential to take into account the legal framework for privacy and data processing, both in general and specifically.
This begins with an analysis of the regulations in question and their application by judicial bodies. This is particularly important in light of recent regulatory interventions, i.e. the EU AI Act, that apply directly in Europe and may apply indirectly elsewhere.
Subsequently, once the legal framework is outlined, we need to understand whether educational institutions, namely high schools, and their employees (primarily teachers) are actually behaving in accordance with the rules. In this way, it is possible to weigh up which elements have the greatest impact on the issue of privacy and data protection.
It is equally important to understand that the protection of privacy and the management of personal data in the school context are influenced by different variables that emerge from the environment (e.g. ICT structures and systems, legal documents and prescription), the behavior (conduct), and the subjective sphere of individuals (i.e. awareness, knowledge, expectations, trust) that can only be assessed through a field study and subsequent analysis of the data collected.
Finally, on the basis of the quantity and quality of the data collected and the results obtained from their interpretation, it is possible to provide operational indications to educational institutions and recommend training courses for teachers and students in order to make the protection of privacy and personal data as effective as possible and to propose operational paradigms to the LA in the management of high school student data.
Accordingly, the research questions for this project may be formulated as follows:
RQ1: What are the substantive scope and jurisdictional reach of privacy and data protection legal framework in conjunction with artificial intelligence regulatory provisions, and how does their interrelation impact AIED and data processing within high school educational settings?
(This question explores the legal constructs established on privacy and AI domains, and examines their application and impact on school educational practices and activities.)
RQ2: How do high schools implement data governance and privacy protection legal frameworks in practice, and what are the behaviors, knowledge, and awareness levels among educators and students operating within AI-enabled and learning analytics educational contexts?
(This research inquiry examines the operational implementation of data governance and privacy protection frameworks within educational institutions, with particular emphasis on empirical practices, regulatory compliance behaviors, cognitive understanding, and professional awareness demonstrated by educational practitioners and students in their engagement with AI-enabled educational environments and learning analytics methodologies).
RQ3: Drawing upon the findings of the preceding RQs, to what extent privacy and data are protected within educational settings, and what theoretical and operational measures may be proposed to enhance the level of compliance and ensure effective protection? (This research question aims to identify strategies for enhancing the efficacy of privacy and data protection measures for students and to develop practical recommendations for implementation within schools.)
To answer the research questions of the PhD project,
Design-Based Research (DBR) presents itself as a
validated methodological approach, implementable
through a model process characterized by sequential
activities and iterative cycles [
The DBR framework enables the synthesis of
theoretical research components with empirical
observations, whereby through progressive refinements
among theoretical frameworks, design considerations,
and practical implementation, theoretical conjectures
may be tested and knowledge generated [
Therefore, the DBR process should be modeled according to the following sequence.
Grounding: through a systematic examination of the regulatory framework and operational deployment mechanisms for Artificial Intelligence and data analytics within educational institutions, this research seeks to: a) identify and analyze potential privacy infringement risks and data protection vulnerabilities affecting student populations; b) delineate critical factors and structural elements that may impact the effective implementation of protective measures within the educational domain.
A comprehensive literature review examining the convergence of legal frameworks and TechnologyEnhanced Learning (TEL) enables the identification and analysis of fundamental parameters concerning privacy and data protection imperatives within formal educational settings, thereby elucidating critical compliance challenges and regulatory implications
The main databases such as Scopus Web of Science, Eric, Bera databases, and relevant official documents and publications from institutional sites (inter-alia OECD, UNESCO, EUR-lex) are being retrieved.
The review will be based on the PRISMA-ScR
checklist and explanation, and the JBI methodological
guidance [
Conjecturing: the next phase entails formulating theoretical propositions that will inform the development and evaluation of the research design framework.
Consultation with external experts recruited from legal experts in data and privacy protection will contribute in defining and validating the AIED framework scenario, within which students and educators will be actively engaged.
Iterating: based on the preceding phases, this
subsequent one entails the development of a data-driven
AIED and learning analytic scenario, which will be
submitted to students and educators in the form of a
simulated scenario with a related questionnaire. The
survey is intended to explore students’ and educators’
awareness of the GDPR, the AI Act, and principal
regulations as well as opinions and behaviors relating to
data sharing and data protection. A defined and wide
framework of questions is outlined in Prince et al. [
Survey research will be employed to collect data and
to ascertain the specific characteristics of the group in
question (Fraenkel et al.) [
Multiple-choice questions on a Likert scale (still to be defined) will be employed to ascertain the value of students' and teachers' awareness, knowledge, behavior, trustworthiness, and attitude regarding high school privacy law and ethics.
If necessary, according to data quality and analysis, qualitative data collection and analysis will follow through focused interviews to enhance comprehension of the underlying reasons behind statistical findings [32, 33].
Combining these methods can provide a comprehensive understanding of high school teachers’ and students' privacy awareness, behavior, and data management practices in digital environments.
Approval from the university's ethics committee and permission from the school principals will be required.
Reflecting: this phase is dedicated to analyzing all data collected throughout the process and to highlighting the critical application of legal protections within the educational context, as well as the influence of stakeholders’ factors on this application.
The outcome could be the development of proposals and guidelines for students, teachers, and educational institutions, along with learning tools and actions aimed at strengthening individuals' data literacy as a primary safeguard for privacy and data protection.
A systematic scoping review of scholarly literature is being conducted, examining the intersection of the following principal research domains: (1) regulatory and legal framework governing data protection, (2) digital technology implementation within educational context (3) privacy and data protection frameworks applicable to high school, and (4) learning analytics methodologies with emphasis on ethical and privacy issues.
A comprehensive update and methodological systematization of the literature review documentation is being undertaken.
In addition, in the coming months of the year, with the support of statistical experts, the identification and development of suitable and validated survey instruments to be used in high schools in the 2024-2025 school year.
Finally, I am considering the most effective and appropriate methods for defining DBR in a way that highlights the interdisciplinarity nature of the research, situated at the intersection of privacy and data law and Technology Enhanced Learning.
The project's contribution falls under the broad TEL theme of "Ethics, Privacy, Regulations and Policies." In particular, the first contribution will be to legally and systematically define the concepts of privacy rights and personal data protection in the high school context and within the use of digital technologies, with the clarity of timely and explicit reference to the regulatory framework, primarily European (e.g. GDPR, AI ACT). The second contribution will entail observing and evaluating the management of privacy and the handling of personal data in digital environments by high school students and teachers as well as an LA system in action. This will enable the measurement and evaluation of the impact of various factors affecting data handling and privacy in real-world educational contexts.
The third contribution will be to propose practical and targeted strategies to improve the digital and legal literacy of students and teachers; and to formulate practical preparatory guidance for learning analytics that is responsive to privacy and data safety at the school level, once it becomes fully widespread.
[1] [2] [3] [4]
S. Timotheou, O. Miliou, Y. Dimitriadis, Impacts of digital technologies on education and factors influencing schools' digital capacity and transformation: A literature review. Educ Inf Technol (2023). doi.org/10.1007/s10639-2211431-8. E. Celeste, G. De Gregorio, Towards a Right to Digital Education? Constitutional Challenges of Edtech, JIPITEC 14, 234 para 1, 2023.
E. Zeide (E. Selinger, J. Polonetsky, and O. Tene, Eds), Education Technology and Student Privacy, in The Cambridge Handbook of Consumer Privacy, Cambridge University Press, 2018.
T. M. Yuliandari, A. Putri and Y. Rosmansyah, "Digital Transformation in Secondary Schools: A Systematic Literature Review," in IEEE Access, vol. 11 (2023): 90459-90476. [31] A. F. Westin, Social and political dimensions of privacy. J. Soc. Issues, 59, (2023): 431−453. doi.org/10.1111/1540-4560.00072. [32] N. V. Ivankova, J. W. Creswell, and S. L. Stick, Using Mixed-Methods Sequential Explanatory Design: From Theory to Practice. Field Methods, 18.1 (2006): 3-20. doi.org/10.1177/1525822X05282260. [33] J.P. Takona, Research design: qualitative, quantitative, and mixed methods approaches / sixth edition. Qual Quant 58 (2024): 1011–1013. doi.org/10.1007/s11135-023-01798-2.