{"schema_version":"ICEQC_NEWS_ARTICLE_V1","id":"iceqc-news-2569ab875d079f05","slug":"2023-01-12-assurance-and-improvement-in-learner-data-privacy","language":"en","publication_status":"READY_FOR_IMPORT","publication_date":"2023-01-12","last_modified_date":"2023-01-12","title":"Assurance and improvement in learner data privacy","summary":"Provides an evidence-led method for improving assurance and improvement in learner data privacy, from definition of the problem to review of effectiveness and residual risk.","category":{"code":"QUALITY_IMPROVEMENT_METHODS","label":"Quality Improvement Methods"},"article_type":"Quality improvement method","publisher":"International Council for Education Quality Certification (ICEQC)","jurisdictional_scope":"International","historical_reference_basis":"Expansion of AI-enabled education services","reference_authority":"Relevant public authorities and official international sources","sections":[{"heading":null,"paragraphs":["The expansion of AI-enabled education services provides the immediate reference point for consideration of learner data privacy in 2023. A decision concerning the corrective programme should recognise that the method set out here treats improvement as a controlled cycle of diagnosis, action, measurement and review. The control response should be sufficient to protect learners while avoiding burdens not justified by the evidence."]},{"heading":"Defining the problem","paragraphs":["The historical reference basis is the expansion of AI-enabled education services. Its relevance to learner data privacy should be assessed against the affected jurisdiction, learner population and form of provision.","Responsibility for the improvement objective should be visible at the point where consequential decisions are made. The analysis of the improvement objective proceeds on the basis that follow-up should determine whether the change is embedded in ordinary operations and whether it has created new risks or unequal effects. In relation to assurance and improvement in learner data privacy, a decision should not be closed at the operating level where material impact, conflict or a significant evidential gap remains unresolved.","The technical issue within the corrective programme concerns the basis on which a conclusion is reached. In reviewing the practice, an improvement plan should connect a verified problem with a specific intervention, accountable ownership, resources, milestones and a measure of effect. Broad intentions should be converted into decisions capable of review. The judgement should state its supporting evidence and any condition limiting application to the declared scope.","In relation to assurance and improvement in learner data privacy, the evidential record should be limited to material that can answer the question under review. For the corrective programme, the most relevant material is likely to include incident response and notification records, data-quality and correction controls, retention and secure disposal evidence, and a register of information assets and purposes. Each source has limitations; confidence depends on corroboration between independent records and transparent treatment of uncertainty."]},{"heading":"Improvement method","paragraphs":["For learner data privacy, the public interest is not confined to institutional compliance. A decision concerning the practice should recognise that education information should be collected for a defined purpose, protected in proportion to its sensitivity and retained only for an authorised period.","Risk assessment of the issue under review should give particular attention to excessive access to learner information, inaccurate data affecting decisions, and retention beyond an identified need. A provider should also consider uncontrolled supplier access or transfer and collection without a defined educational or legal purpose."],"bullets":["Verify accuracy where information affects learners, with responsibility, scope and timing recorded.","Provide accessible correction and complaint routes before it is relied on for a decision with material effect.","Control third-party processing.","Test incident and recovery arrangements.","Assign accountable data owners."]},{"heading":"Measures and review","paragraphs":["The review method for learner data privacy should be reproducible. Review of the intervention should prioritise actions by learner impact and control weakness, establish dependencies, test implementation at suitable intervals and retain unresolved items until effectiveness is verified. Amend the plan where evidence does not support the original causal assumption. The retained analysis should be reproducible from the selected evidence, decision rule and recorded reasons for accepted exceptions.","A decision to close improvement work on the improvement objective should be made by a person with authority and sufficient independence from implementation.","The analysis of the corrective programme should remain within the limits of the evidence. A decision concerning the improvement objective should recognise that methods should be proportionate to the significance and recurrence of the problem; low-risk local issues and systemic learner-protection failures require different levels of control. A decision concerning the issue under review should recognise that security, privacy and data quality are related but distinct. A secure record may still be inaccurate or used without adequate authority, and a lawful use may still be poorly governed.","Records relating to the intervention should preserve both the conclusion and its limits. If further evidence changes the position, the correction should identify its scope and any earlier decision requiring reconsideration. This is material where learners, authorities or institutions relied on information that cannot be corrected by replacing the current text alone."]},{"heading":"Residual risk and follow-up","paragraphs":["Public reporting on learner data privacy should distinguish established fact, analytical judgement and planned action. Changes to definitions or evidence should be recorded separately from changes in educational performance.","The measure of progress on the practice is not the amount of policy or documentation produced."]}],"word_count":718,"content_hash":"sha256-1369d0ba6c0d221f949d073df8d3f8fe1487e52ca287a13e288ae60733b2fd77","seo_keywords":["assurance and improvement in learner data privacy","education quality improvement","education quality","ICEQC"],"schema_type":"TechArticle"}