What can parents decide in the digital school system?

Choose language in the Google-box below. Some translations may be flawed or inaccurate.

The school solutions from Apple, Microsoft, Google, and others have both positive and negative sides. First and foremost, students get access to apps where they can write, calculate, and much more. They can also deliver assignments or chat with classmates. But school solutions also contain risks, market influences, and data trails that some parents may not appreciate.

The development is very fast. To avoid making name calls, some schools abroad have started using facial recognition. There are cameras in the classroom that count which students are present in the class. Can parents put their foot down if they think it’s going too far?

There are essentially consent requirements for parts of the school solutions

Schools, businesses, and others cannot collect personal data as they wish in Norway, they must have something called a basis for processing to be allowed to do so. The basis for processing can be translated as “permission.” If the company has received consent from the person concerned, it has at the same time obtained a basis for processing, i.e., permission to collect such information.

But that only applies if the consent is given voluntarily. When you receive a service from public institutions in Norway, you sometimes have to provide personal information in order to get it, because the state or municipality is the only supplier. This means that any consent that is not voluntary on your part is not valid. In such circumstances, the institution cannot ask for consent, but must in the case find something in the legislation that gives it the right to collect the personal information in question.

It is mostly the municipalities that own the schools. The municipalities can point to the Education Act, curricula, and various information from the Norwegian Directorate for Education and Training and believe this together gives them the right and obligation to create digital teaching solutions. And further that this also gives the municipalities the basis for processing, i.e., permission to collect personal data from the students.

The Norwegian Data Protection Authority’s guidelines on school solutions apply to all school solutions, even if it is based on Google’s solution. Chapter four of the guidelines writes that the municipalities have a basis for processing, i.e., permission, to collect personal data through the school solutions. But according to the Data Protection Authority, this only applies to the core services in the school solution. Core services include a typing app, an app for creating presentations, a chat app, and so on. If a school wants to use additional services of the school solution, the municipality must have the consent of the guardians.

In many cases, school owners are thus obliged to ask parents for consent. But the school solutions have so many apps and features from so many different providers that it’s hard for parents to check if they really have been asked for consent in each case.

Tips for parents: Ask the school to show you a list of what your school solution provider defines as core services. All that is not on that list are additional services. And if an additional service collects personal data, then the school must ask parents for consent before using the additional service.

Teachers can also use apps that they find around the web. If such an app collects personal information, as far as we understand the rules, the teacher must ask for parental consent. For example, personal data can be a picture of the child, the name of the child, and so on.

In addition, the Norwegian Data Protection Authority writes in its guideline that schools cannot collect more sensitive information without asking for consent.

For instance:

• ethnic origin
• political opinion
• religion
• philosophical belief
• health information
• sexual identity
• biometrics

Fingerprints are biometrics and are therefore on the ‘no list’ of the Norwegian Data Protection Authority. A large municipality that «Barnevakten» has been in contact with says that their students use fingerprints to log on to tablets. Those who do not want to use fingerprints can use code to turn on the tablet. The municipality believes that such use of fingerprints is legal because the fingerprint is registered only in the tablet and does not pass the data to the school or data provider.

Since biometrics is on the ‘no list’ of the Norwegian Data Protection Authority, schools cannot install cameras in classrooms to introduce facial recognition and automatic “name-calling.” In such cases, schools must ask for parental consent, as far as we can understand. Consent must probably be obtained from all parents throughout the school because sometimes teachers have to take their class to another classroom and there should be no camera with facial recognition without consent.

If the Norwegian Data Protection Authority determines that fingerprints on the tablet are within the rules, one can believe that facial recognition on the tablet is also within the rules, as long as data from the facial recognition does not escape from the tablet and transfer over to other apps or the school solution. So far as we understand, you cannot make automatic name calls via the tablet’s camera.

No student profiles are allowed in the school solution

The supervisor from the Norwegian Data Protection Authority also says no to profiling the pupils. In case, the school must have the consent of the parents. Profiling means using information collected about a student to identify their behavior, needs, abilities, and preferences. Here there is probably a larger grey area. Because when the teacher asks a student to practice math pieces in an app, and the app says after an hour that the student needs more help in the subject, then it is a form of profiling on a single level.

Good information about what is defined as profiling is difficult to find. But charting how good a student is in mathematics, one might think is a natural part of teaching and the teacher’s work. A possible natural distinction is profiling that applies to subjects as opposed to profiling that applies to a person.

What one probably means by profiling that is not legal without consent is if you collect information about the students from different places in the school solution and then put digital labels on each student as a person. For example, metadata can reveal the times when a student delivers their homework. In an imaginary example, the profile program can automatically tag the student with “sleep problems” because homework is often delivered after midnight. You can then have the school solution automatically send out information to the student or parents about the importance of sleep. Or the profile program can automatically shut down this student’s school machine at night. “So good!” some would say, “this is how technology can help us.” Others will be skeptical because the student is then guided by profiling and technique that does not see the full picture. Perhaps it is precisely at night that this student gets peace from a difficult family and can be able to concentrate on homework.

This was just an example. «Barnevakten» does not know if there is any such profiling of students in Norway. In case, profiling requires the consent of the individual parent because it is a matter of collecting personal data. So here the parents have some rights.

Who decides in the digital school?

In Stavanger, there is a political decision that 1^st and 2^nd-grade students should not bring their school machines home. And for 3^rd-4^th grade, parents should be consulted before the machines can be taken home. In Stavanger, local politicians have decided that the parents should have a say in the team.

It is not about privacy. Part of the rationale for the decision is that there will be too much use of screens for the children in total if schools are to require children to bring machines home.

But who really has the right to decide what? How far can local politicians go in giving parents a say in the digital school solutions?

When it comes to school solutions, it does not seem that everything is in place for rules, routines, and limits. It can be changed if politicians and agencies clarify the rules and tell them who can decide what: the municipality, the school, the teacher, the parents, or the student.

School solutions can become more privacy-friendly

The computer system in the schools is a complex system with different intertwined platforms, some for the students and others for the administration. The systems also collect metadata that is not necessary for the schools to meet the law’s requirements for what is to be taught. But what is collected at each school is difficult to know, because schools inform little about it. For example, is it recorded how often you as a parent log into the school solution? It is in the case of a registration that is not necessary to comply with the Education Act. This was just an imaginary example.

When three students have collaborated on a project and have had joint access to files and chat, one may ask: Will the files be available to the three students also the following year? What if one of the students leaves? How long are chat and files available? Which employees can view the files? The answers to such questions should be available openly on the school websites so that parents know how the school solution works. When parents learn what is under the hood of the school solutions, they can guide their children on how to use the school solutions safely.

School solutions can be built in a more privacy-friendly way. A lot of metadata can be automatically deleted every hour, every day, every week, or after each school year, as per fixed settings. In other words, the school solution does not have to be exactly as it is today. It is not the case that the Education Act forces schools to use the exact current version of the school solution. Therefore, it can be argued that schools do not really have support in the Education Act for absolutely everything that exists in computer systems. And then you can also discuss whether parents should have more influence.

Tips for parents: When it comes to deleting students’ files, parents can ask the school to arrange “delete week” before each summer vacation so that parents, along with the children, can delete anything that should not be taken care of and be searchable for fellow students or staff in the years to come. At the same time, parents can make copies of some submissions and store those files in their private cloud as future reminiscence.

What the guidelines do not address

Students can gain digital skills and improve digital judgment by creating digital presentations or browsing the web. But the Education Act does not say that it is essential that the presentation app and browser are provided by a global company that, outside the school, makes a living from data collection and profiling.

It could be argued that digital judgment weakens over time when students become accustomed to using the software of a “surveillance company” for ten years. However, in its guidelines, the Data Protection Authority does not address such matters, because the Data Protection Authority must concentrate on privacy and not on impact. The Directorate of Education’s guidelines do not address the issue either, as the Directorate of Education concentrates on asking schools to ensure that the students do not see harmful content. It, therefore, appears that parents have no rights in mattes of influence, such as which global data company will become “the children’s best friend» in school.

Computer systems are very complicated and complex, so it’s hard to point out where parents have the right to veto.

There is a lack of a list from the authorities of what the Education Act and curricula require and how these requirements must be expressed in functions in the school solutions.

As far as we know, the Norwegian Directorate of Education does not have a list of what a school solution must have of functions. Such a list could be, for example, a writing program, calculation program, class chat, and so on. Then it would have been easier for parents to know which features are “outside” and can trigger consent requirements. For example, the class chat could have been defined as “inside” and the students’ municipal chat as “outside.” It all becomes somewhat random if it is up to each individual data provider to define what is the core service and what is additional.

Moreover, one could also have a list of examples of metadata necessary to collect in order to comply with the Education Act and curricula, as well as a list of examples of metadata that should not be collected without consent at all.

Information from the authorities to parents should provide answers to questions like these:

• Based on the Education Act, what kind of functions must a school solution contain?
• What features should a school solution not contain at all?
• What kind of metadata does a school solution need to collect to comply with the Education Act?
• What kind of metadata should a school solution not collect?
• Who should have access to the files?
• What kind of files should be deleted and when?

Not a voluntary choice?

The Norwegian Directorate for Education and Training states that any consent must be given voluntarily and that it is therefore not natural to ask for consent in some cases.

UDIR also writes: “This will be the case for all the tasks that school-and-kindergarten owners are required to do in the Education Act and the Kindergarten Act. Otherwise, the Directorate for Education and Training recommends that the school-and-kindergarten owners have a very conscious relationship with whether consent is an appropriate legal basis for the processing being done.”

Different laws may give the school the right to collect personal information. Concerning the Education Act, it provides permission to collect personal data for the tasks that schools perform within the act. The Education Act does not provide a free card to collect all kinds of personal data in all kinds of circumstances at the school, the “free card” only applies to the tasks mentioned in the act or that can be derived from it.

If the school is to collect personal data that is not related to a task in the Education Act, the school must either find support in another law, i.e., find another basis for processing, or ask for consent from the parents.

It’s hard to get a full understanding of the rules. The Education Act states, for example, that students should learn mathematics. It does not say that students must leave personal information, such as a picture of the family, to learn mathematics. If the math app uses images of the student as an educational measure, and thus collects personal data, does this mean that the school must ask for consent?

And what if the mathematics app is included as one of the school solution’s core services, is it already “accepted” by the Norwegian Data Protection Authority? Because the Data Protection Authority says yes to core services in its guidelines?

«Barnevakten» does not have all the answers, but it seems that the authorities should go even a few rounds and clarify more about school solutions:

• What can school solutions contain?
• What triggers consent requirements?
• What should school solutions not contain at all?

It is not only about personal data, but also what risks or influences are embedded in the functions. An example of risk is when the school solution allows all students in the municipality to chat with each other. Does the Education Act require the school solution must offer this?

If students are to understand what chat is and are trained in this, is it enough that the ten-year-olds are in conversations with the rest of the class? Or must they also be able to talk to the rest of the municipality’s students? Or do they have to talk to the rest of the county or possibly everyone in the world? What is necessary to comply with the Education Act and the curricula?

The Data Protection Authority talks about privacy. The Directorate for Education and Training talks about harmful content. But which agency is talking about security?

How parents can gain more influence and better information

Today, when you come to a website that you have not visited before, the site asks for your consent to collect information about how you use the site. This is the button many of us blindly press “ok” because we are so tired of being asked. But really, you can choose how much the site should know about you. When most websites in Europe are able to arrange this technically, then school solutions should also be able to give parents some consent choices.

Consent can then be arranged when the children start school by parents signing a screen form where they can tick and approve what personal data the school can collect that does not already have a basis for processing (permission) from the Education Act and the curricula.

In this way, one can distinguish between the curricula requirement of education and what the schools themselves put in as additional tasks.

Barnevakten has previously recommended about schools and parents entering a data agreement. It is not easy to reach a data agreement that has points that go in the parents’ favor, because the parents have few rights as perceived today. However, parents have some rights: In the case of computer functions that collect personal data and that do not cover under the Education Act, the parents must be asked for consent. And they can say no.

Today’s data agreements usually only apply to the school’s requirements for parents or pupils, for example that machines should be charged and that parents must replace the machine if it is damaged. It is difficult to find anything in the agreements that give parents some rights on behalf of their children.

Requirements for information

Anyway, parents are entitled to the information. The Norwegian Data Protection Authority writes in its guideline: “In several of the cases we have dealt with, we have seen that the municipalities have provided too little information.” Barnevakten has made a list of questions that parents can ask the school. The list is comprehensive, but it means that it is also helpful for schools. If the school answers all the questions on the school’s website, parents can get better information and the school does not have to answer repeatedly at parent meetings and the like.

One idea is that the authorities create a standard for what the information for the parents should contain.

Do you just have to give up?

YouTube is a good example of how complicated it is to get acquainted with school solutions. One cannot just ask whether YouTube is part of the school solution or not. You can find it both via browser and as an app. In addition, you can have an account on YouTube, and it allows you to post comments on your own or other people’s posts. And you can choose from different age settings. YouTube is also available in a separate children’s version. So, if you’re asking if YouTube is a core or additional service and that you, as a parent, might be involved with consent, then your question isn’t precise enough, because YouTube can be so many. And so you can deal with service after service — what is inside and what is outside?

It is easy to think that our digital lives are so complicated that it is only to give up having some rules and that only online knowledge training is the only sensible measure. But why should there then be a requirement for parental consent when children under the age of 13 want to use social media?

School solutions and curricula are difficult matters, it does not seem that the cake is fully baked. It seems that we are currently mixing ingredients in a bowl and are a little unsure what to put in the bowl and how the cake will taste in the end.

As mentioned in Stavanger, a municipal decision has been made that parents should be consulted regarding pupils in 3^rd and 4^th grades before deciding whether or not to bring the machines home. In other words, there is an imposed cooperation between school and home when it comes to the school solution. Politicians can thus give parents somewhat more influence over school solutions.

Read more about privacy:
Municipalities and schools lag on privacy.

(First published on 15.08.2021. Translated by Ratan Samadder)

Utviklet som en del av Erasmus+ prosjektet «TeachingTools».