Right2Object project report

Mind the Gap Technology in Schools and the Right to Object Dr Caroline Stockman, Dr Emma Nottingham, Prof. Maria Burke

SECONDARY SCHOOL Where does all this data go?

2

Contents Introductory statement 4

The Problem 5

Data Protection Rights 6

Further research 7

Acknowledgements 8

3

Introductory Statement This project is a collaboration between colleagues from three departments at the University of Winchester, UK: • The Department of Education Studies • The Department of Law • The Department of Responsible Management

The COVID-19 pandemic prompted a dramatic increase in the use of educational technology. But even our everyday practices of teaching and learning in the UK commonly integrate digital technology. With its many benefits, the commercial forces of the tech industry also pose certain risks for children today.

The problem statement on the next page explains this in more detail, closely followed by a brief outline of this issue in view of the child’s legal data protection rights. In this project, we sought to highlight the ‘right to object’. As we started questioning this right, and especially its practical implementation in the school context for educational technology, we realised the situation is more complex than it seems at first. There are grey areas, tension points, and uncertainties. We capture these in our future research outline.

A little bit about us Dr Caroline Stockman is a Senior Lecturer in Education Studies, and Senior Fellow of the Higher Education Academy. Her research centres on the human-technology relationship, with a cultural-political focus. She also draws on professional experience working within the commercial e-learning industry. Her doctoral study considered technology acceptance in education.

Dr Emma Nottingham is a Senior Lecturer in Law, and Fellow of the Higher Education Academy. She is the Co-director of the Centre for Information Rights at the University of Winchester. Her research focuses on the intersection of social, legal and ethical rights of children in various contexts including the digital world, broadcast media exposure and healthcare. Her doctoral study specifically considered the Gillick litigation.

Professor Maria Burke is a Professor of Management in the Department of Responsible Management. She draws on considerable previous experience in the area of information management and digital systems (both present developments as well as with a view on future society), and specifically in relation to business ethics.

It’s imperative that all stakeholders can become part of a constructive conversation to ensuring the right to object is not only a legal right, but socially acceptable, logistically possible, and clear to everyone involved. A digital future for education must enable businesses to ethically deliver excellent teaching and learning products, for the school and its staff to maximise technology’s pedagogical benefits, while guaranteeing children the social freedom to exercise their data protection rights as they wish.

l Lega h g i r t

y Sociall ble a t p e acc

Everyone involved

Logistically possible

4

The Problem Data processing has always been part of schooling. Attendance records, marks and feedback, notes about good (or bad) behaviour…But recent UK and EU reports have raised concerns over this data processing now being commonly executed and controlled by commercial companies.1 This raises issues of ethics and governance of data. There are questions of privacy, security, and sustainability as the commercial EdTech sector continues to expand. 2 Our biggest concern is where data processing happens for reasons of ‘surveillance capitalism’: the use of personal data about individuals for corporate enrichment, consumer manipulation, or market dominance.3 Schools have legal responsibilities to ensure they don’t implement technologies which will be harmful to the child’s security, of course – and further regulations attempt to limit the use of children’s personal data for advertising or marketing, direct or indirect.

However, violations still occur,4 either intentional or accidental.

From the age of 13, every individual may object to the use of their data for advertising or marketing purposes in the UK. In reality, the situation is tricky within the schooling context: • Objecting to using certain technologies may lead that person to be seen as ‘awkward’ or ‘rebellious’.

• Expressing a concern may in itself may be very difficult, given the hierarchy and authority structures of schooling.

• The school most likely has a legitimate interest or public task for certain data processing to take place, alongside pedagogical and practical reasons for using certain digital technologies.

Even well-intentioned, legal and pedagogically meaningful use of digital technology can carry privacy risks, and a commodification of the learning process for capital gain, market profiling or influencing. This risk should be unacceptable – especially when it comes to children, if we want them to be empowered citizens of our digital world.

1 See the 2019 report by Jen Persson, Director of defenddigitalme, “Children’s Data Protection in Education Systems: Challenges and Possible Remedies”, available at https://rm.coe.int/t-pd-201906final-eng-report-children/1680a01b47 and the subsequent Council of Europe guidelines in November 2020, available at https://rm.coe.int/t-pd-2019-6bisrev5-eng-guidelines-education-settingplenary-clean-2790/1680a07f2b 2 Read more about the UK’s 2019 EdTech strategy here : https://www.gov.uk/government/news/edtech-strategy-marks-new-era-for-schools 3 Surveillance capitalism is the profit-making commodification of personal data. The term was coined by Shoshana Zuboff, in The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power (2019) 4 Wendy Davis for Digital News Daily (31st of March 2021): https://www.mediapost.com/publications/article/361890/google-play-apps-still-unlawfully-collect-children.html

COMPANIES In October 2020, an inquiry was launched to investigate a breach of children’s personal data by Instagram.12

The value of the UK EdTech industry grew to £3.5bn5 and might be $404bn globally by 20256

In 2020 Google Classroom was the most downloaded free educational app in the UK on Apple devices.7

#LearnOnTikTok is launched.8

78% of people used YouTube during 2020 to watch or access educational content.9

In September 2019, YouTube was fined a record $170 million for illegally harvesting children’s personal data for advertising and marketing10 with a new £2.5bn class action-lawsuit starting in September 2020 for violating privacy and data rights of children under the age of 13.11

In February 2021, TikTok faced new regulatory complaints in the EU for misleading data protection practices in relation to children.13

Robert Walters for FENews (14th of January 2021): https://www.fenews.co.uk/press-releases/61610-uk-edtech-sector-grows-to-3-5bn-as-demand-surges-for-digital-classrooms-and-ar HolonIQ : https://www.holoniq.com/notes/global-education-technology-market-to-reach-404b-by-2025/ Margi Murphy for The Telegraph (2nd of April 2020): https://www.telegraph.co.uk/technology/2020/04/02/professor-googles-plan-change-classroom-forever/ 8 Ingrid Lunden for TechCrunch (5th of November 2020): https://tinyurl.com/3pppn9dp 9 Neil Shaw for Wales Online (14th of December 2020): https://www.walesonline.co.uk/news/uk-news/youtube-lists-most-watched-videos-19452572 10 Peter Kafka for Vox (4th of September 2019): https://www.vox.com/recode/2019/9/4/20849143/youtube-google-ftc-kids-settlement-170-million-coppa-privacy-regulation 11 Natasha Lomas for TechCrunch (14th of September 2020): https://techcrunch.com/2020/09/14/youtube-hit-with-uk-class-action-style-suit-seeking-3bn-for-unlawful-use-of-kids-data/ 12 James Titcomb for The Telegraph (18th of October 2020): https://www.telegraph.co.uk/technology/2020/10/18/instagram-investigation-exposing-millions-childrens-contact/ 13 Natasha Lomas for TechCrunch (16th of February 2021): https://techcrunch.com/2021/02/16/tiktok-hit-with-consumer-child-safety-and-privacy-complaints-in-europe/ 5 6 7

5

Data Protection Rights The General Data Protection Regulation (GDPR) aims to regulate any person’s data rights within a digital context. It has a direct relevance to learner data in schools but is not specific to this.

Post-Brexit, this overarching EU framework was nationally adopted as the UK GDPR – though the UK had in the meantime updated its Data Protection Act 2018 accordingly. It was followed by other measures such as the ICO’s Age Appropriate Design Code, to further protect children, and school-specified guidance such as the Department for Education’s ‘Data Protection: Toolkit for Schools’ 2018.

Right to object The GDPR states eight data protection rights – Article 21 covers the ‘right to object’.

If a child exercises their right to object in a schooling context, the school will be required to undertake ‘a balancing exercise’.14 This means considering whether there is an appropriate justification to override the objection. For example: ‘public task’ or ‘legitimate interest’ (Article 6 – 1(e) and 1(f)). Both of these reasonably apply to most schooling contexts.

However, there is a second, more covert layer of data processing. Apps, software, and online learning platforms may be gathering and using data in ways which do not directly align with the school’s fair and reasonable purposes of enabling education.

Legally, those apps or other technology suppliers must declare if they’ll be processing learner data for advertising and marketing purposes. The school can agree to that, and must then inform learners (or their parents/guardians).

However, government guidance suggests schools should avoid doing this, as a child may not fully understand the implications or their right to object.16 As the previous page shows, there are also the intentional or accidental breaches and violations which occur.

MESSAGES

PHOTOS

CONTACTS

SEARCH HISTORY

Most Learner Data Is Classed As Personal Data 15 Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

A child may wish to be educated, but without exposure to the underlying, commercially driven data processing. This means objecting to the use of a particular technology, and its underlying data processing, rather than the school’s reasons for using that technology, the learning process, or the data processing that comes with it. The right to object to data processing for advertising and marketing purposes is normally absolute16 – but the reality of doing so in the schooling context is problematic, as discussed in the previous section.

Learner data, student data, learning analytics, classroom data,…? A more in-depth discussion of terminoology is beyond the scope of this report – but for the purpose at hand, we opt for the term ‘learner data’ as ‘data about individual learners’, aligned with the category of ‘personal data’ in Article 4(1) of the UK GDPR.

15

6

14

See: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/

16

DfE (2014) Cloud (educational apps) software services and the Data Protection Act: Departmental advice for local authorities, school leaders, school staff and governing bodies, p.8.

Further research The right to object cannot just be a symbolic right for the child in his or her digital education context.

Dear School, I wish not to... bject

t to O

igh The R

X

While the right to object is solidly rooted in the legal framework of the GDPR, we did discover some tension points, and some missing gaps in the guidance.

We believe it’s urgent to address these questions, so the situation is clearer, fair, practical, ethical and legal – for all involved.

• What should a school do if an individual learner exercises their right to object?

There are legal and ethical duties to uphold but equally, it can pose significant logistical and pedagogical problems to provide alternative technology.

• What does it mean to use data ‘fairly’?

A recent UK report shows an over-reliance on legitimate interest and public task in schools - but this doesn’t yet address the more covert data processing for commercial purposes.

• What’s the risk-benefit balance for education?

The benefits of using logistically and pedagogically meaningful digital technologies need to be weighed up against the intentional or accidental exposure of the child’s personal data to the dominant market forces.

• Can a school provide high-quality education in another way?

There is a competitive benefit to relying on well-known, big-tech systems. It may improve educational standards, but also attractiveness of the school as a modern provider. A unified, nation-wide response may need to be considered here.

• How can we ensure digital education without surveillance capitalism?

School budgets are limited, and therefore often rely on freeware. The businesses which provide that may readily draw on surveillance capitalism to sustain their own market dominance.

• Is a different EdTech sector possible?

We need to consider how we can sustain this thriving economy, while also addressing the social, legal, ethical, and practical challenges with greater care and attention.

• Is stricter government regulation the answer?

Law, policies and guidance are available to steer management of the industry and its implementation. These could be developed further to specify the child’s rights within the educational process.

• How can a child’s right to object be made socially acceptable?

There is still the element of social hierarchies in schools, the expectation of tacit acceptance, and the disempowerment that comes with that.

It carries a real risk of social and educational exclusion.

• Do digital rights apply differently in schooling?

Digital rights activism has had some recent successes, such as the adoption of the UN General Comment No. 25 on Children’s Rights in the Digital Environment. A more explicit consideration as to how these frameworks apply in the schooling context would be useful.

17 The audit conducted by the Information Commissioner’s Office, about the UK’s Department for Education handling of pupil data: https://ico.org.uk/media/action-weve-taken/audits-and-advisoryvisits/2618384/department-for-education-audit-executive-summary-v1_0.pdf

7

Acknowledgements This project was made possible thanks to funding by Human-Data Interaction, a UK EPSRC Network Plus.

It received internal ethics approval by the University of Winchester’s ethics committee. The project design integrated the Orbit Responsible Research & Innovation Framework.

Our thanks also go to our colleagues at the University of Winchester, in research, ethics, fund management, and IT, for their support.

For more information… … about this particular project, please visit http://www.winchester.ac.uk/right2object … and do have a look at our project video: https://www.youtube.com/watch?v=g1x06ba3u60 … about the HDI Network Plus, please visit https://hdi-network.org … about the University of Winchester’s Centre for Information Rights, please visit http://www.winchester.ac.uk/cir Our contact details Caroline Stockman: caroline.stockman@winchester.ac.uk Emma Nottingham: emma.nottingham@winchester.ac.uk Maria Burke: maria.burke@winchester.ac.uk @EmmaCNottingham @c_stockman

Welcome to

DO NOT SIT ON THE PLASTIC SHEEP!

SECONDARY SCHOOL