Safeguarding Privacy and Data Protection Rights in AI- Enhanced Education and Learning Analytics: an Interdisciplinary Approach in Secondary High School Educational Settings. Mario Paludi 1 a Università degli Studi D’Annunzio, Chieti-Pescara, Italy b Università degli Studi di Foggia, Foggia, Italy Abstract The centrality of the right to privacy and personal data protection for high school students is fundamental in light of the increasing use of digital technologies for educational purposes and the effort to introduce learning analytics at the school level. The use of digital technologies, particularly those enhanced by artificial intelligence tools, necessitates heightened attention to data and privacy law and to the fundamental right to privacy and personal data protection for high school students, who are inherently vulnerable. All students will be compelled to interact with school-provided technology, with disabled or socially, culturally, and economically disadvantaged students being even more vulnerable. The definition of the legal framework in this domain is a prerequisite for the effective protection of privacy and data and the development of secure, data-driven technologies. A parallel understanding of the human factors that influence data handling and privacy is similarly of great consequence. The research project is structured as follows: (1) outline the legal and ethical rules and principles regarding privacy and personal data applicable to high school educational settings; (2) assess schools' preparedness in managing students' data in compliance with legal and ethical standards and evaluate teachers' and students' knowledge, attitude and awareness of privacy and personal data protection, and their behavior during educational activities in digital environments; (3) outline educational actions and improvement proposals for managing students' privacy and personal data, especially when AIED will be employed extensively, to help optimize learning and improve the environment in which it takes place. Keywords Privacy, Privacy awareness and knowledge, Data & Privacy Law, Digital technologies, High School Students, Artificial Intelligence, Learning Analytics, Data Literacy 1. Introduction students (age range 14-18) in the context of increasing use of artificial intelligence in educational settings, within the current European legal framework. The High schools are undergoing a Copernican European regulatory framework, primarily shaped by the transformation in education delivery, driven by GDPR and the (proposed) EU AI Act, is considered the technological digital evolution. The new frontier of most comprehensive source of relevant regulations. digital technologies in education, especially those driven Therefore, various disciplines are involved in by AI and the use of data assets, presents a critical addressing this set of elements. The implementation of challenge for schools striving to remain relevant amidst new digital technologies in education has significant these significant changes. implications for law and ethics, and these fields, in turn, Specifically, the adoption of new digital technologies influence technological development. in education raises important considerations in the areas To understand how to protect privacy and handle of law, privacy, and data protection, as well as digital data in compliance with legal and ethical principles, it is literacy. This research project aims to investigate the necessary to outline the legal provisions on privacy and privacy and data protection issues of high school Proceedings of the Doctoral Consortium of the 19th European Conference on Technology Enhanced Learning, 16th September 2024, Krems an der Donau, Austria. ∗ Corresponding author. mario.paludi@unifg.it (M. Paludi) 0009-0002-0684-6798 (M. Paludi) © 2024 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). CEUR ceur-ws.org Workshop ISSN 1613-0073 Proceedings data processing, highlight the centrality of privacy in the The expansion of digital technologies, particularly in the use of digital technologies in schools, and evaluate how field of information and communication technology privacy impacts artificial intelligence and data (ICT), has led to a heightened awareness of the processing, like learning analytics, and vice versa. importance of privacy. This is evidenced by the findings Beyond regulatory considerations, it is equally of EDUCAUSE 2020, which identified the protection of important to focus on the school environment, including personal data as one of the top 10 IT priorities for the the activities, awareness, knowledge, attitudes, and year 2020 (Grajek, 2020) [9] in the field of higher behaviors of both students and teachers. education, though conceptually generalizable. This is still Consequently, it is essential to evaluate the multiple the case in the 2023 top 10 IT priorities (Grajek, 2022) factors within high schools and among stakeholders [10], where it ranks second. related to privacy, data protection, and the handling of personal data. 2. Background 2.1. Digital technologies/EdTech The use of digital technologies in schools is growing steadily and, with appropriate policies, offers great potential for improving the delivery of education, learning, and school management. Figure 1: 2023 top 10 IT priorities. Retrieved from Recent literature indicates that digitization of schools [10] has been in the spotlight during the recent COVID-19 pandemic, revealing various challenges alongside the Furthermore, this is reflected in the general potential of improving the quality of teaching and perception according to the survey on awareness and learning with ICT [1]. management of access to personal data [11]. While digitization has yielded outcomes in promoting inclusion, participation, and learning, particularly for students with disabilities, substantial concerns remain regarding the legal compliance of systems and policies, as well as the competence of stakeholders in ensuring the “right to digital literacy” [2]. Certainly, for schools that want to keep up and adapt their educational offer to the canons of digital transformation, the competent use of new digital technologies, more often supported by AI, will be indispensable. The integration of digital technologies into the world of schooling has implications and effects not only on Figure 2: How did EU people manage access to their teaching and learning in the strict sense but also on many personal data in 2023. Retrieved from [11] interrelated and equally important issues, including protecting privacy and personal data and managing While the majority of research is concentrated on students’ data [3]. “Develop a digital citizenship higher education (HE), schools are also surveyed on a program: as technology use becomes more prevalent, range of related topics, including digital technologies, students must learn about responsible digital conduct. privacy, ethics, and data handling. These topics will Therefore, schools should establish a digital citizenship undoubtedly become more pertinent with the anticipated initiative that instructs students on online safety introduction of AI tools, which will lead to a greater measures, safeguarding their privacy, and utilizing depth of insights into the associated privacy concerns technology ethically and responsibly” [4] implies that the and the question of trustworthiness [12, 13]. consideration has to be extended to teachers and Two key dimensions inform doctoral research on institutions, including the legal framework and ethical privacy and data protection in schools: the legal instances [5]. framework at the normative level and the behavioral With the development of digital technologies, framework at the concrete level. The regulatory research on digital literacy (rectius literacies) in schools requirements, their interpretation and application, and [6] is experiencing considerable ferment from a variety the human factor, as observed in the context of the school of perspectives, including data literacy by teachers [7] environment, represent the two principal study and annexed study on digital identity and privacy and dimensions of the research. training “in favor of conscious use of tools for one’s own In particular, legal certainty, even if a universal virtual identity and privacy” [8]. definition of privacy is lacking [14] for some, is essential to provide the ground rules. 2.2. Privacy and Personal Data An interdisciplinary approach, drawing on the regulatory source, it is crucial to acknowledge that it is expertise of legal and learning sciences, will enable the not the sole relevant regulatory instrument. most comprehensive definition of the current state of the A comprehensive understanding of the full range of art in privacy and data handling, as well as the regulatory frameworks will enable each stakeholder to development of robust proposals [15]. fulfill their obligations with confidence and a heightened In light of these considerations, it becomes evident sense of responsibility, thereby facilitating informed that grasping the ratio between rules and behavior is of decision-making with regard to the handling of data. paramount importance. In the specific case of privacy, a fundamental 2.3. Learning analytics question has been raised: do people really care about their privacy? [16]. A 2023 survey with 2,600 of 18 years and older from One of the best-known definitions of learning analytics the following countries: Australia, Brazil, China, France, (LA) is from Siemens (2013) [19] who states that Germany, India, Italy, Japan, Mexico, Spain, United "Learning Analytics is the measurement, collection, Kingdom, and United States gave evidence that on analysis, and reporting of data about learners and their average, 46 percent of respondents across all surveyed context to understand and optimize learning and the countries were aware of their local privacy laws, with environment in which it takes place" (p. 1382). peaks of 63 percent from India, 63 percent from UK and The importance of data analytics in education is a 55 percent from Italy. multi-level issue: data-based decision-making, But on this same issue, we need to compare this evidence with the "privacy paradox" issue. This concept monitoring and evaluating processes for administrators; highlights the inconsistency of privacy attitudes and supporting quality, effectiveness, and assessment of behaviors in the face of the assumption that people care teaching and learning activities outcomes for teachers about their privacy [17]. and students [20]. Therefore attitude and behavior must be evaluated The potential benefits of LA are highlighted by the with caution, and awareness becomes a key factor. Quality Assurance with Learning Analytics in Schools This is a groundbreaking topic for high school (QUALAS) project (01/10/2023-30/09/2026), which aims students who are going through the process of to build capacity in secondary education schools for the developing character and building knowledge. use of learning analytics in the framework of quality However, dealing with awareness, educational assurance [21]. stakeholders involved in data management must possess a comprehensive and preliminary understanding of Ethical and legal issues related to privacy and data privacy principles anchored in explicit legal frameworks. processing in education are a topic of general interest [22]. They have been a recurring and hot topic of discussion in the LA community because of their close Year Event connection to data processing. Article 8 of the European Convention on Human In general, research on effective privacy-enhancing 1950 Rights (ECHR), which establishes the right to practices in LA tends to focus on specific aspects, such as respect for private life students' privacy concerns, perceptions of privacy risk The Council of Europe adopts Convention 108— and control, trust, and willingness to share personal data. now Convention 108 Plus—which is the largest Understanding students’ privacy concerns is seen as an 1981 European-level document for the protection of essential first move toward “effective privacy-enhancing personal data practices” in LA [23]. The EU adopts Directive 46/95 on the protection of Models have been developed to explore students' 1995 personal data privacy concerns, from the APCO (Antecedents → Privacy Concerns → Outcomes) to SPICE (students' Approval of the Nice Charter, in which Article 8 2001 establishes the right to protection of personal data privacy concerns), focusing on the antecedents-to- privacy-concerns link. Similar models for high school The right to the protection of personal data enjoyed students must take into account various factors, from by every person was reaffirmed in the TFEU. In 2007 addition, the legislative competence of the those of knowledge to those of awareness, confidence, European Parliament and the Council on the subject attitude, and relationship with teachers in the midst of was established learning when data are generated. 2016 General Data Protection Regulation (GDPR) As observed in a recent review on human-centred learning analytics and AI in education data, despite privacy emerged as the much-discussed topic, gaps Figure 3: Historical-legislative evolution of privacy remain in our understanding of the importance of human legislation. Retrieved from [18] control, safety, reliability, and trust in designing and deploying these systems [24]. Accordingly, a legal definition of privacy and data What emerges is a resolution to define the protection requires an understanding of the intertwined parameters within which to operate legally and ethically, provisions of multiple regulatory sources, including the and to provide practical ways of doing so [25]. General Data Protection Regulation (GDPR) and the In light of this, it is advisable to broaden the scope of recently enacted EU Act on Artificial Intelligence (AI). inquiry to understand the factors that may affect data Although the latter is the most widely recognized privacy at the high school level, with particular attention to the human elements at play, namely the behavior, operating within AI-enabled and learning analytics attitude, legal knowledge, and expectations of students educational contexts? and teachers, and lately their interrelation. (This research inquiry examines the operational Then, the use of LA in high schools, which is likely implementation of data governance and privacy to be on the increase, must be prepared with an protection frameworks within educational institutions, awareness of the range of human factors that can have with particular emphasis on empirical practices, an impact on the proper handling of data in compliance regulatory compliance behaviors, cognitive with the legal framework. understanding, and professional awareness demonstrated by educational practitioners and students in their engagement with AI-enabled educational 3. Goal and research questions environments and learning analytics methodologies). RQ3: Drawing upon the findings of the preceding When considering privacy and data protection in the RQs, to what extent privacy and data are protected context of upper secondary education, it is essential to within educational settings, and what theoretical and take into account the legal framework for privacy and operational measures may be proposed to enhance the data processing, both in general and specifically. level of compliance and ensure effective protection? This begins with an analysis of the regulations in (This research question aims to identify strategies for question and their application by judicial bodies. This is enhancing the efficacy of privacy and data protection particularly important in light of recent regulatory measures for students and to develop practical interventions, i.e. the EU AI Act, that apply directly in recommendations for implementation within schools.) Europe and may apply indirectly elsewhere. Subsequently, once the legal framework is outlined, we need to understand whether educational institutions, namely high schools, and their employees (primarily 4. Methodology and methods teachers) are actually behaving in accordance with the rules. In this way, it is possible to weigh up which To answer the research questions of the PhD project, elements have the greatest impact on the issue of privacy Design-Based Research (DBR) presents itself as a and data protection. validated methodological approach, implementable It is equally important to understand that the through a model process characterized by sequential protection of privacy and the management of personal activities and iterative cycles [26]. data in the school context are influenced by different The DBR framework enables the synthesis of variables that emerge from the environment (e.g. ICT theoretical research components with empirical structures and systems, legal documents and observations, whereby through progressive refinements prescription), the behavior (conduct), and the subjective among theoretical frameworks, design considerations, sphere of individuals (i.e. awareness, knowledge, and practical implementation, theoretical conjectures expectations, trust) that can only be assessed through a may be tested and knowledge generated [27]. field study and subsequent analysis of the data collected. Therefore, the DBR process should be modeled Finally, on the basis of the quantity and quality of the according to the following sequence. data collected and the results obtained from their Grounding: through a systematic examination of the interpretation, it is possible to provide operational regulatory framework and operational deployment indications to educational institutions and recommend mechanisms for Artificial Intelligence and data analytics training courses for teachers and students in order to within educational institutions, this research seeks to: a) make the protection of privacy and personal data as identify and analyze potential privacy infringement risks effective as possible and to propose operational and data protection vulnerabilities affecting student paradigms to the LA in the management of high school populations; b) delineate critical factors and structural student data. elements that may impact the effective implementation Accordingly, the research questions for this project of protective measures within the educational domain. may be formulated as follows: A comprehensive literature review examining the RQ1: What are the substantive scope and convergence of legal frameworks and Technology- jurisdictional reach of privacy and data protection legal Enhanced Learning (TEL) enables the identification and framework in conjunction with artificial intelligence analysis of fundamental parameters concerning privacy regulatory provisions, and how does their interrelation and data protection imperatives within formal impact AIED and data processing within high school educational settings, thereby elucidating critical educational settings? compliance challenges and regulatory implications (This question explores the legal constructs The main databases such as Scopus Web of Science, established on privacy and AI domains, and examines Eric, Bera databases, and relevant official documents and their application and impact on school educational publications from institutional sites (inter-alia OECD, practices and activities.) UNESCO, EUR-lex) are being retrieved. RQ2: How do high schools implement data The review will be based on the PRISMA-ScR governance and privacy protection legal frameworks in checklist and explanation, and the JBI methodological practice, and what are the behaviors, knowledge, and guidance [28]. awareness levels among educators and students Conjecturing: the next phase entails formulating (3) privacy and data protection frameworks applicable to theoretical propositions that will inform the high school, and (4) learning analytics methodologies development and evaluation of the research design with emphasis on ethical and privacy issues. framework. A comprehensive update and methodological Consultation with external experts recruited from systematization of the literature review documentation is legal experts in data and privacy protection will being undertaken. contribute in defining and validating the AIED In addition, in the coming months of the year, with framework scenario, within which students and the support of statistical experts, the identification and educators will be actively engaged. development of suitable and validated survey Iterating: based on the preceding phases, this instruments to be used in high schools in the 2024-2025 subsequent one entails the development of a data-driven school year. AIED and learning analytic scenario, which will be Finally, I am considering the most effective and submitted to students and educators in the form of a appropriate methods for defining DBR in a way that simulated scenario with a related questionnaire. The highlights the interdisciplinarity nature of the research, survey is intended to explore students’ and educators’ situated at the intersection of privacy and data law and awareness of the GDPR, the AI Act, and principal Technology Enhanced Learning. regulations as well as opinions and behaviors relating to data sharing and data protection. A defined and wide framework of questions is outlined in Prince et al. [29]. 6. Contribution to TEL Survey research will be employed to collect data and to ascertain the specific characteristics of the group in The project's contribution falls under the broad TEL question (Fraenkel et al.) [30]. Survey studies offer a theme of "Ethics, Privacy, Regulations and Policies." In quantitative description of trends, attitudes, and views particular, the first contribution will be to legally and across a population through studies conducted on a systematically define the concepts of privacy rights and representative sample. Thus, the results will help to personal data protection in the high school context and evaluate the privacy concerns, awareness, knowledge, within the use of digital technologies, with the clarity of attitude, and behavior in the education environment [31]. timely and explicit reference to the regulatory Multiple-choice questions on a Likert scale (still to be framework, primarily European (e.g. GDPR, AI ACT). defined) will be employed to ascertain the value of The second contribution will entail observing and students' and teachers' awareness, knowledge, behavior, evaluating the management of privacy and the handling trustworthiness, and attitude regarding high school of personal data in digital environments by high school privacy law and ethics. students and teachers as well as an LA system in action. If necessary, according to data quality and analysis, This will enable the measurement and evaluation of the qualitative data collection and analysis will follow impact of various factors affecting data handling and through focused interviews to enhance comprehension privacy in real-world educational contexts. of the underlying reasons behind statistical findings [32, The third contribution will be to propose practical 33]. and targeted strategies to improve the digital and legal Combining these methods can provide a comprehensive literacy of students and teachers; and to formulate understanding of high school teachers’ and students' practical preparatory guidance for learning analytics that privacy awareness, behavior, and data management is responsive to privacy and data safety at the school practices in digital environments. level, once it becomes fully widespread. Approval from the university's ethics committee and permission from the school principals will be required. Reflecting: this phase is dedicated to analyzing all 7. References data collected throughout the process and to highlighting the critical application of legal protections within the [1] S. Timotheou, O. Miliou, Y. Dimitriadis, Impacts of educational context, as well as the influence of digital technologies on education and factors stakeholders’ factors on this application. influencing schools' digital capacity and The outcome could be the development of proposals transformation: A literature review. Educ Inf and guidelines for students, teachers, and educational Technol (2023). doi.org/10.1007/s10639-2211431-8. institutions, along with learning tools and actions aimed [2] E. Celeste, G. De Gregorio, Towards a Right to at strengthening individuals' data literacy as a primary Digital Education? Constitutional Challenges of safeguard for privacy and data protection. Edtech, JIPITEC 14, 234 para 1, 2023. [3] E. Zeide (E. Selinger, J. Polonetsky, and O. Tene, 5. Current status of the work Eds), Education Technology and Student Privacy, in The Cambridge Handbook of Consumer Privacy, Cambridge University Press, 2018. A systematic scoping review of scholarly literature is [4] T. M. Yuliandari, A. Putri and Y. Rosmansyah, being conducted, examining the intersection of the "Digital Transformation in Secondary Schools: A following principal research domains: (1) regulatory and Systematic Literature Review," in IEEE Access, vol. legal framework governing data protection, (2) digital 11 (2023): 90459-90476. technology implementation within educational context [5] E. Baysan, Ş. Çetin, Determining the Training paradox phenomenon, Computers & Security, Needs of Teachers in Ethical Use of Information Volume 64, (2017): 122-134. Technoogies, Journal of Theoretical Educational doi.org/10.1016/j.cose.2015.07.002. Science, 14.3 (2021): 476-497. [18] D. Battista, G. Uva, Exploring the Legal Regulation [6] L. Ilomäki, M. Lakkala, V. Kallunki, D. Mundy, M. of social media in Europe: A Review of Dynamics Romero, T. Romeu, and A. Gouseti, “Critical digital and Challenges—Current Trends and Future literacies at school level: A systematic review”. Developments. Sustainability, 15, (2023): 4144. Review of Education, 11 (2023): e3425. doi.org/10.3390/su15054144. [7] F. Caena, C. Redecker, Aligning teacher [19] G. Siemens, Learning analytics: The emergence of a competence frameworks to 21st century discipline. American Behavioral Scientist, 57.10, challenges: The case for the European Digital (2013): 1380-1400. Competence Framework for Educators doi.org/10.1177/0002764213498851. (Digcompedu). Eur J Educ. 54 (2019): 356–369. [20] UNESCO: minding the data: protecting learners’ doi.org/10.1111/ejed.12345. privacy and security. UNESCO (2022). URL: [8] C. G. Demartini, L. Benussi, V. Gatteschi and F. https://unesdoc.unesco.org/ark:/48223/pf00003814 Renga, "Education and Digital Transformation: The 94 “Riconnessioni” Project," in IEEE Access, vol. 8 [21] Qualas, Quality assurance with Learning Analytics (2020): 186233-186256, doi: at School. URL: https://bild.research.vub.be/qualas 10.1109/ACCESS.2020.3018189. [22] P. Eleni, (S. Nurcan, A.L. Opdahl, H. Mouratidis, A. [9] S. Grajek, Top 10 IT issues 2020: The drive to digital Tsohou, Eds), Towards a Secure and Privacy transformation begins (2020). EDUCAUSE Review Compliant Framework for Educational Data Special Report. URL: https://er.educause.edu/- Mining. Information Science and the Connected /media/files/articles/2020/1/er20sr201.pdf World. RCIS volume 476, 2023. [10] S. Grajek and the 2023–2024 EDUCAUSE doi.org/10.1007/978-3-031-33080-3_35. Top10Panel. URL: [23] C. Mutimukwe, O. Viberg, L-M Oberg, & T. Cerratto- https://er.educause.edu/articles/2022/10/top-10-it- Pargman, Students’ privacy concerns in learning issues-2023-foundation-models. analytics: Model development. British Journal of [11] Eurostat, how internet users protected their data, Educational Technology, 53 (2022): 932–951. (2024). URL doi.org/10.1111/bjet.13234. https://ec.europa.eu/eurostat/web/products- [24] A. Riordan, Vanessa Echeverria, J. Yueqiao, Y. eurostat-news/w/ddn-20240126-1 Lixiang, S. Zachari, D. Gašević, R. Martinez- [12] C.C. Lin, A.Y.Q. Huang, and O.H.T. Lu, Artificial Maldonado, Human-centred learning analytics and intelligence in intelligent tutoring systems toward AI in education: A systematic literature review, sustainable education: a systematic review. Smart Computers and Education: Artificial Intelligence, Learn. Environ. 10.41 (2023). Volume 6, 2024, 100215. doi.org/10.1186/s40561-023-00260-y. doi.org/10.1016/j.caeai.2024.100215. [13] M. Pan, J. Wang and J. Wang, "Application of [25] A. Pardo, G. Siemens, Ethical and privacy principles. Artificial Intelligence in Education: Opportunities, Br J Educ Technol, 45 (2014): 438-450. Challenges, and Suggestions," 13th International doi.org/10.1111/bjet.12152. Conference on Information Technology in [26] T. Anderson, J. Shattuck, Design-based research: A Medicine and Education (ITME), Wuyishan, China, decade of progress in education research? (2023), 623-627. Educational Researcher, 41.1, 2012, 16-25. doi: 10.1109/ITME60234.2023.00130. doi.org/10.3102/0013189X11428813. [14] A.L. Allen, Unseasy access: Privacy for women in a [27] C. Hoadley, F. C. Campos, Design-based research: free society, Rowman & Littlefield, 1988 What it is and why it matters to studying online [15] P. Tsormpatzoudi, B. Berendt, F. Coudert, Privacy by learning. Educational Psychologist, 57.3, 2022, Design: From Research and Policy to Practice – the 207–220. doi.org/10.1080/00461520.2022.2079128. Challenge of Multi-disciplinarity. In: B. Berendt, T. [28] M.D.J. Peters, C. Marnie, H. Colquhoun, H. et al. Engel, D. Ikonomou, D. Le Métayer, S. Schiffner, Scoping reviews: reinforcing and advancing the (eds) Privacy Technologies and Policy. APF 2015. methodology and application. Syst Rev 10, (2021): Lecture Notes in Computer Science, 2016, vol 9484. 263. doi.org/10.1186/s13643-021-01821-3. Springer, Cham. doi.org/10.1007/978-3-319-31456- [29] C. Prince, N. Omrani, N. and F. Schiavone, "Online 3_12. privacy literacy and users' information privacy [16] Statista Ed. Awareness of internet users worldwide empowerment: the case of GDPR in of their country's privacy laws as of June 2023, by Europe", Information Technology & People, country. URL: Volume 37, (2024): 1-24. doi.org/10.1108/ITP-05- https://www.statista.com/statistics/1441448/privac 2023-0467. y-laws-awareness-global-by- [30] J. Fraenkel, N. Wallen, & H. Hyun, how to design and country/#statisticContainer evaluate research in education, 11th Edition, [17] S. Kokolakis, Privacy attitudes and privacy behavior: McGraw-Hill, New York, 2023. A review of current research on the privacy [31] A. F. Westin, Social and political dimensions of privacy. J. Soc. Issues, 59, (2023): 431−453. doi.org/10.1111/1540-4560.00072. [32] N. V. Ivankova, J. W. Creswell, and S. L. Stick, Using Mixed-Methods Sequential Explanatory Design: From Theory to Practice. Field Methods, 18.1 (2006): 3-20. doi.org/10.1177/1525822X05282260. [33] J.P. Takona, Research design: qualitative, quantitative, and mixed methods approaches / sixth edition. Qual Quant 58 (2024): 1011–1013. doi.org/10.1007/s11135-023-01798-2.