Data protection in education: what current evidence shows

Against the background of the General Data Protection Regulation applicable from May 2018, education authorities and providers should review how the comparison in education is defined, implemented and evidenced. Data used for the reported measure in education should be interpreted against stable definitions and an identifiable population. A revision or break in series should not be reported as a change in performance. Attention is directed to decisions with material consequences for learners, institutional responsibility and educational resources. Assessment should focus on the public outcome rather than presume one administrative arrangement.

At the publication date, General Data Protection Regulation applicable from May 2018 provides the relevant international context for data protection in education. Any consequential application still requires evidence from the affected jurisdiction or institution. Entry into force or applicability establishes an operative reference point, but the resulting duties must still be traced to the persons, services and jurisdictions covered. Authorities should distinguish immediate duties from staged provisions, and providers should retain the legal and operational basis for any conclusion about application.

Purpose and present context

The General Data Protection Regulation applies from 25 May 2018. Education providers processing personal data within its scope must connect each use to an appropriate legal basis and comply with principles governing fairness, transparency, purpose, minimisation, accuracy, retention and security. Rights and accountability are operational matters: notices, access controls, correction, supplier oversight, incident response and records of decision-making should function in practice.

The relevant outcome should be capable of direct and consistent explanation. Data used for data protection in education should be interpreted against stable definitions and an identifiable population. Formal adoption, expenditure and activity do not in themselves establish the intended result. Implementation evidence should be sufficient to identify unequal consequences and assign corrective responsibility.

Any indicator used in relation to the analytical question should distinguish description from causal explanation. Material variation and uncertainty should be reported together with any restriction on wider application. The evidential basis for the evidence under review should identify source, period, coverage and material limitations. Corroboration is required where a single record cannot support the decision. Any indicator used in relation to the reported measure should distinguish description from causal explanation. A technically sound method remains inadequate if its limits are not clear to the body using the result.

Implementation of the matter examined should be organised around a decision that can be tested. A decision concerning the reported measure should recognise that where an indicator is used as a proxy, the relationship between the proxy and the underlying educational outcome should be stated and tested. Analysis of the matter examined should state the unit of analysis, reference period, coverage, exclusions and treatment of missing information. Comparative findings should not conceal differences capable of changing their meaning.

The evidential record for the evidence under review should permit a reviewer to trace the matter from decision to outcome. This may require incident response and notification records, retention and secure disposal evidence, data-quality and correction controls, and a register of information assets and purposes, supported by supplier and transfer arrangements and lawful authority and consent records where relevant. Conflicting records, absent populations and uncertain follow-through require additional testing.

• Minimise collection before it is relied on for a decision with material effect.
• Verify accuracy where information affects learners and retain evidence sufficient for independent review.
• Provide accessible correction and complaint routes, including material exceptions and unequal effects.
• Limit and review access and retain evidence sufficient for independent review.
• Assign accountable data owners before any material decision relies on it.

The substantive quality question

A narrow control over data protection in education may create false assurance. Governance of the matter examined requires a clear allocation of authority, information and follow-through. Escalation should place material evidence before the authority capable of an effective response. Testing should include exceptions and adverse cases, not only routine or successful operation.

A proportionate method is available for the matter examined. Data used for the evidence under review should be interpreted against stable definitions and an identifiable population. A case-by-case response is insufficient when evidence shows recurrence or a population beyond the cases already identified. Analysis of the comparison should state the unit of analysis, reference period, coverage, exclusions and treatment of missing information.

Decision-makers using evidence on the evidence under review should be told what the data cannot establish as clearly as what it can. The finding should identify its analytical character and the system, institution, programme or learner population to which it applies. The basis for applying the result elsewhere should be established rather than assumed.

Analysis of the evidence under review should state the unit of analysis, reference period, coverage, exclusions and treatment of missing information. Material differences in population, setting or method should remain explicit in any comparison. For the comparison, security, privacy and data quality are related but distinct. A secure record may still be inaccurate or used without adequate authority, and a lawful use may still be poorly governed. The evidential basis for the analytical question should identify source, period, coverage and material limitations. No exception should continue without a documented basis, accountable approval and scheduled review.

The evidential trail should allow an affected decision to be identified, examined and corrected. For the reported measure, the responsible body should be able to identify the evidence considered, the judgement made, the person or body authorised to make it and the action that followed. A material amendment should record its reason and effective date, preserving the information basis of earlier decisions.

For the comparison, governing bodies should receive a concise account of the intended result, affected scope, principal risks, evidence limitations and unresolved exceptions. Responsibility and timing should be settled when the action is approved, not after delay occurs. An action may be complete while the underlying condition remains, and the two determinations should be recorded separately.

The appropriate response to the comparison is therefore one of controlled implementation and review. Neither administrative activity nor general assurance should obscure the intended result or its effect on learners. An evidential gap should lead to a qualified conclusion and continued action, not administrative closure.