NOU 2023: 19

Learning: Lost in the Shuffle?— Use of pupil and student data to enhance learning

Next chapter

Previous chapter

Part 3
The Expert Group’s recommendations and proposals

11 The objectives of the Expert Group’s recommendations

The discussions in the first interim report showed that there is a need for clear frameworks that ensure justifiable learning analytics. These frameworks must safeguard the privacy of pupils and students, while at the same time create sufficient scope of action to utilise the potential. The Expert Group has found that there is a considerable demand in the education sector for clear guidelines on matters pertaining to data protection and artificial intelligence. Regarding matters such as quality assessment and decisions regarding use, a greater degree of support and guidance is desirable.

Developing good practice that includes learning analytics means facilitating professional discussions regarding purpose, impact on learning processes, instruction situations and roles. Such discussions must incorporate professional, pedagogical, ethical and data protection aspects. Drawing on the professional environment in this manner enhances knowledge, awareness and competence about learning analytics, adaptability and the use of artificial intelligence.

In this report, we have based our work on the knowledge of what kinds of learning analytics are currently carried out in Norwegian education, what needs the actors themselves express that learning analytics can address, what characterises data quality in learning analytics, and how learning analytics is regulated in the current legislation. Through assessing how learning analytics can enhance learning and improve instruction, which pedagogical and ethical challenges are associated with learning analytics, how participation should be ensured, and the need to amend the legislation, the Expert Group has drawn up recommendations and proposals that will contribute to safeguarding trust, reducing risk and building good pedagogical practice.

11.1 Safeguarding trust in the education sector

In Norway, public authorities enjoy a high level of trust among the population. Privacy is a value that contributes to safeguarding and building trust in society (NOU 2022: 11). It has been important for the Expert Group to take a position on privacy in the context of pedagogical, ethical and legal issues. Learning analytics can both challenge and strengthen trust in the education sector, and the Expert Group has emphasised preparing recommendations and proposals that contribute to secure and justifiable learning analytics with a clear pedagogical purpose.

It is worth noting that trust in how the school safeguards children’s privacy is significantly lower than in other public agencies (Norwegian Data Protection Authority, 2020b). Part of the reason for this may be that a lot of attention has been paid to several breaches of the Personal Data Act in the school sector (NOU 2022: 11). Nevertheless, it is our clear impression that there are high expectations that schools are to be able to adequately solve privacy challenges. In its comments to the Expert Group, the Parents’ Committee for Primary and Secondary Education (2022b) states as follows:

[c]hoices we as parents make in our spare time are often characterised by naivety and trust that someone will ensure that no one tampers with my data. When we send our children to school, many of us have a higher expectation of what considerations the school will make in relation to our children. The school as a public institution must set the standard! (p. 3)

In higher education and tertiary vocational education, student representatives have expressed that they largely perceive that their personal data are in safe hands with the educational institutions.

Data protection is not just about personal data being secure. It strengthens trust if the educational institutions process pupil and student data in ways where the purpose and procedure are predictable and comprehensible for pupils and students. In the case of learning analytics, the processing of data will not be self-explanatory, as in digital learning resources with simpler functionality. If schools and educational institutions enable pupils and students to understand and properly use personalised functionality, this contributes to increasing their trust and autonomy.

Taking to steps that contribute to strengthening trust that privacy is safeguarded throughout the educational pathway is one of the main goals of the Expert Group’s recommendations and proposals. First and foremost, trust must be strengthened through improved data protection practices. The Expert Group recommends clarifying the legal basis for learning analytics and preparing a code of conduct and guidelines for data protection in education to help achieve this goal. Recommendations regarding predictability, fairness, transparency and participation in learning analytics are key to ensuring trust.

11.2 Risk reduction

Decisions regarding learning analytics involve various risk assessments. Risk reduction is often associated with exercising caution. However, the Expert Group notes that standing still is not risk-free either, particularly in the field of technology. Innovations in artificial intelligence have created fertile ground for curiosity, exploration and innovation in the education sector, but also the need to ask critical questions. We wish to facilitate experiences with learning analytics within as secure and justifiable frameworks as possible, but recognise that the improvement and development of teaching practice through the use of new forms of technology always involves a certain risk.

Learning analytics requires that school owners and educational institutions assess the risk by using information about pupils’ and students’ activities, behaviour, performance and background to enhance learning and improve instruction. This entails considering the data protection consequences in relation to other values in society. An important task is to identify measures that reduce the data protection risk to an acceptable level. The school owners and the institutions must also assess the risk of not utilising the potential of learning analytics to enhance learning and improve instruction. Although the platform of knowledge on learning analytics in Norway is inadequate, we do find indications of untapped potential. As we showed in the first interim report, research and development projects point to pedagogical gains by having access to information about pupils’ and students’ professional development through learning analytics. Realising these gains requires innovation and the development of good resources with functionality for learning analytics. This is a market with considerable investment costs and development involves a high risk for developers and suppliers (ICT-Norway, 2023).

Making school owners and institutions better able to safeguard pupils’ and students’ privacy is a clear goal of the recommendations put forward by the Expert Group. The Expert Group wishes limit both an unnecessarily restrictive and an uncritical approach to learning analytics in the education sector. We also wish to stimulate development that to a greater extent brings out the inherent value of learning analytics. Recommendations on a code of conduct and guidelines for data protection and a clarification of legal bases can contribute to the former, while recommendations on competence development, guidance services, grant schemes and usage-based price models can contribute to the latter.

11.3 Developing good practice

A common concern about the use of technology in education is whether it contributes to good learning and instruction. An important task for the Expert Group has been to investigate how learning analytics can support the objectives of education and enhance learning. Several of our recommendations and proposals concern facilitating good pedagogical practice by increasing free choice and support for quality assessment in learning analytics and offering various guidance services and contributing to competence development.

A large part of the data generated in learning situations involving the use of digital devices can constitute a valuable pedagogical resource. Giving pupils and students insight into their own learning and giving teachers and instructors a better basis for differentiating instruction and follow-up are two main areas of value. The third main area of value concerns learning analytics as a suitable instrument for conducting computer-supported quality assurance work in education. Analyses of pupil and student data can also be relevant at an even more general level. In the Norwegian Government’s strategy for digital competence and infrastructure in kindergartens and schools, it is noted that researchers can use aggregated data to develop knowledge about learning, which the authorities can use to adapt the use of instruments to improve the schools’ situations (Norwegian Ministry of Education and Research, 2023). In the strategy for digital transformation in the university and university college sector it is a stated ambition that data from this sector is used to contribute to streamlining and strengthening education and research and to generate more innovation and value creation (Norwegian Ministry of Education and Research, 2021).

Frameworks and guidelines that safeguard scope of action and professional discretion will support the improvement and further development of pedagogical practice. Thereby, the Expert Group wishes to promote good learning analytics and pedagogical practice by recommending frameworks and guidelines for learning analytics for primary and secondary education and training, higher education and tertiary vocational education, respectively. For primary and secondary education and training, we have emphasised providing teachers and schools with a better overview and free choice when using digital resources, strengthening the basis for assessing the quality and suitability of the resources and facilitating competence development. In higher education and tertiary vocational education, we have emphasised free choice, guidance and competence development.

11.4 Overview of the content of the recommendations

In the following chapters, the Expert Group will present four main recommendations to support good and justifiable learning analytics throughout education system. Primary and secondary education and training, higher education and tertiary vocational education each receive their own recommendations. The reason for this is partly that the sectors do not have the same purposes, structures, traditions and practices, but also that they have different experiences with learning analytics, and their needs for learning analytics clearly differ from each other. Nevertheless, it is important to view the four recommendations in context. This is primarily because an educational pathway should involve a certain degree of continuity and predictability, but also because the recommendations influence and build on each other. For example, recommendations on legal basis are closely related to the recommendations on creating a code of conduct and guidelines on data protection. In order for learning analytics to be used as an instrument at all, the legal basis must be in place. However, it is the code of conduct and guidelines that will ensure a justifiable practice.

11.4.1 The Expert Group’s four main recommendations on learning analytics

The first recommendation is to clarify the legal basis for learning analytics in primary and secondary education and training, higher education and tertiary vocational education. The purpose of this recommendation is to clarify when the processing of personal data in learning analytics is lawful, create better predictability and provide guidance.

The second recommendation is to prepare a data protection code of conduct in primary and secondary education and training. The purpose of this recommendation is to strengthen pupils’ privacy and facilitate good data protection practices and increase data protection awareness and competence.

The third recommendation is to establish a framework for good learning analytics in primary and secondary education and training. The purpose of this recommendation is to strengthen the free choice of pupils and teachers and to provide a better basis for pedagogical decisions regarding learning analytics to enhance learning.

The fourth recommendation is to develop broad guidelines for good and justifiable learning analytics in higher education and tertiary vocational education. The purpose of this recommendation is to facilitate good data protection practices and justifiable learning analytics that promote student learning and enhance the quality of education.

12 Legal basis for learning analytics

Processing personal data about pupils and students is key to many forms of learning analytics. In order for schools and educational institutions to have the right to process such personal data, there must be a legal basis. In Chapter 10, the Expert Group assesses various legal bases for learning analytics.

The Expert Group’s experience is that there is considerable uncertainty in the education sector regarding what legal basis they have for processing personal data in learning analytics. This uncertainty has different effects. In primary and secondary education and training, the Expert Group’s impression is that it varies between schools and municipalities as to what is considered lawful and justifiable use of resources with functionality for learning analytics. The range extends from relatively uncritical use – as also confirmed by the Norwegian Privacy Commission – to a more restrictive approach. This leads to considerable unpredictability for pupils, parents and suppliers (Parents’ Committee for Primary and Secondary Education, 2022a; ICT-Norway, 2023). In higher education, the Expert Group has found that the uncertainty regarding legal basis means that learning analytics is not included in pedagogical practice, as the strategic level of service providers and institutions limits access to functionality and resources. For the vocational colleges, the situation is somewhat more unclear, but the Expert Group’s impression is that the practice varies greatly between the different educational institutions.

The Expert Group believes that there is a need to clarify the legal basis for processing personal data in learning analytics. This will enhance predictability for pupils and students regarding how their personal data are processed throughout the educational pathway. In this chapter, we will present relevant options for clarifying the legal basis in the legislation governing the three levels of education. A clearer legal basis will provide a less ambiguous starting point for further practice involving learning analytics in the education sector.

12.1 Some broad challenges

The Expert Group points to three broad challenges in amending the legislation to clarify the legal basis for learning analytics.

The signalling effect – a clearer legal basis is not meant as an invitation

The purpose of clarifying the legal basis is not about more learning analytics being a goal in itself. It would be unfortunate if a legal basis was perceived as an invitation to carry out learning analytics that has limited pedagogical value.

The legal basis must take account of a rapidly developing technology

Changes happen quickly in the field of learning analytics. Legal bases that are too technology-specific and aimed at specific ways of processing personal data risk quickly becoming outdated and irrelevant.

More complexity in the legislation can result in less predictability

The existing provisions that the Expert Group has considered as possible bases for learning analytics are found in different parts of the legislation. By clarifying the legal basis, there is a risk of unnecessarily increasing complexity and further muddling the legislation. The consequence of more convoluted legislation is less predictability for pupils, students and controllers.

12.2 The Expert Group’s recommendations on the legal basis for learning analytics in primary and secondary education and training

The Expert Group recommends clarifying the legal basis for learning analytics in primary and secondary education and training. In this section, we present a proposal for how the legal basis for processing personal data in learning analytics can be clarified in the legislation governing primary and secondary education and training.

This proposal concerns establishing a separate provision on processing personal data in learning analytics, provided the processing is justifiable. As learning analytics, by definition, entails a high risk for data protection and as the processing can be invasive for the individual, the Expert Group believes that learning analytics should be regulated in a separate provision. In March 2023, the Norwegian Ministry presented a proposal for a new Education Act, where it has mainly been proposed to continue the provisions that have been discussed in this report Prop. 57 L (2022–2023). The Expert Group’s proposal for a provision is based on the general scheme in the proposal for a new Education Act. Our proposal will also apply to corresponding provisions in the Independent Schools Act.

12.2.1 Provision on the processing of personal data in learning analytics

Against the backdrop of the high risk for pupils’ privacy, we believe that a separate provision should be established that clarifies that pupils’ personal data can be processed in learning analytics. A separate provision is suitable to clarify that pupils’ personal data may be processed in learning analytics when this is necessary to solve the tasks in the Act, e.g., in connection with differentiated instruction, formative assessment and quality development.

The Expert Group believes that the provision should be included as a separate paragraph in section 25-1 of the Education Act, the provision on the processing of personal data in the proposal for a new Education Act, which in turn is a continuation of section 15-10 Prop. 57 L (2022–2023), section 54.5.2). The Expert Group described the current section 15-10 in section 10.3.1. The first paragraph of section 25-1 has a purely pedagogical purpose. The section clarifies that it is permissible to process personal data when this is necessary to perform a task in the Act, which is already stipulated in Article 6 of the GDPR. In addition, section 25-1, second and third paragraphs establish independent legal bases that apply to the processing of data in connection with changing schools and to prevent absence from education. Section 25-1 contains both broad guidelines and independent legal bases for processing personal data. The Expert Group finds that these statutory provisions are suitable for including a section on processing personal data in learning analytics.

The Expert Group is of the opinion that the provision on the processing of learning analytics will first constitute an independent legal basis according to Article 6(1)(e) of the GDPR if the provision establishes a basis for “the performance of a task carried out in the public interest or in the exercise of official authority”. If the provision only describes the processing of personal data in learning analytics and the tasks in the Act where the processing of personal data in learning analytics may be necessary, the provision will not constitute an independent legal basis. Our proposal will not constitute an independent legal basis, but it will establish clearer frameworks for the processing of the existing statutory tasks and duties.

The Expert Group emphasises that the term learning analytics will not be suitable in a statutory provision. The term learning analytics does not have a clear definition, there are different interpretations within the sector, and through the Expert Group’s meetings with young people it has become clear that pupils are not familiar with the term. However, this can be resolved by describing the types of processing of personal data that learning analytics entails.

In the following paragraphs, we will show how a provision on learning analytics can describe the processing of personal data, the tasks where it may be necessary to process personal data in learning analytics according to the law, and what qualifies as justifiable processing of personal data. We will then assess how the purpose of the processing can be specified and any other criteria that should be determined. Finally, we will describe what is required for the provision to constitute either an independent legal basis in accordance with the GDPR or a clarification of the existing bases in the legislation.

The provision should describe the processing

A separate provision on learning analytics in acts or regulations should describe how the processing of personal data is carried out. One question is whether the provision should contain an overview of all possible data that can be processed for learning analytics. The Norwegian Ministry of Education and Research discussed the issue before the Storting adopted the general provision on processing personal data in section 15-10 of the Education Act. The Norwegian Ministry concluded that it would not be appropriate for the provision to contain an overview of all types of data that may be processed pursuant to the Act. Firstly, the Norwegian Ministry believed that it is not possible to create an exhaustive list, and second, it was stated that a non-exhaustive list is more suitable in regulations or as guidelines Prop. 145 L (2020–2021), section 2.3.2.3). The Expert Group believes that the same assessment is relevant for learning analytics. It is not appropriate to create an overview of all types of personal data that can be processed in learning analytics. We propose to use the wording “machine analysis and alignment” to include the processing of personal data using artificial intelligence. This wording also covers the processing of personal data in learning analytics in primary and secondary education and training.

Necessity

The Expert Group is of the opinion that the provision should describe the tasks in the Act where it may be necessary to process personal data. We have identified the tasks differentiated instruction, formative assessment and quality development as relevant, but the provision should not exclude the possibility that other tasks may also be relevant. There is a risk that a provision which allows for the processing of personal data in learning analytics to be carried out to solve tasks in the Act could be interpreted such that it also allows for the processing of personal data for other tasks in the Act that are not relevant. The Expert Group emphasises that the proposal is not intended to facilitate increased processing of personal data in learning analytics in connection with performing other tasks in the Act where learning analytics is neither necessary nor justifiable. For tasks pursuant to the Act, school owners will have a processing basis if the requirement of necessity is met according to Article 6(1)(e) of the GDPR, cf. Article 6(3).

Justification

In addition to the provision having to describe the actual processing, the Expert Group is of the opinion that the provision must require that the processing be justifiable. The requirement for justification is about emphasising that the processing must be subject to the condition that the pedagogical and ethical aspects of the processing have been assessed. The interference with the individual pupil’s privacy can be significant in the case of learning analytics, and this requires a thorough assessment of the pedagogical and ethical aspects of the specific processing.

The Expert Group believes that processing personal data in learning analytics raises issues of a pedagogical and ethical nature. This has made it necessary for the text of the Act to emphasise that the processing must be ethically and pedagogically justifiable, so that the wording clearly conveys what is guiding for the assessment. What constitutes justifiable processing of personal data in learning analytics must be assessed individually in relation to the specific processing and in the light of recognised pedagogical and ethical principles. The Expert Group is of the opinion that the assessment of what constitutes justifiable processing in the individual case presupposes a minimum requirement of an assessment of the ethical and pedagogical challenges the group discussed in Chapter 8. At the same time, we recognise that the challenges will change over time, and that this will affect what should be included in the assessment of justification.

Specify the purposes of the processing

The current broad purpose of learning analytics derives from the objectives of education and the individual statutory tasks. Further specifying the purposes for the processing of personal data in a separate provision will clarify the legal bases for learning analytics.

The Expert Group notes that there is currently little experience-based knowledge on which specific purposes it is appropriate for learning analytics to have. Learning analytics is a complex practice that can be used for different purposes. In this report, we have identified several purposes that we believe have sufficient pedagogical value to justify the processing of personal data. The purposes we have identified do not constitute an exhaustive overview of the types of processing that will have sufficient pedagogical value. Therefore, the Expert Group does not believe it is suitable to include these purposes in the text of the Act. The following clarifications can nevertheless provide guidance on what constitutes justifiable and necessary processing of personal data in learning analytics. The details are based on the assessments in chapters 7 and 8.

1) Insight into the pupils’ learning

The Expert Group believes that learning analytics, which provides insight into pupils’ learning, can be useful for pupils and teachers.

Learning analytics that provides information to pupils is tempered by the fact that the teacher is involved and supports the pupils in interpreting the information from the analysis when necessary. Such information can, e.g., be presented through a visualisation, recommendations or a report that provides an overview of what the pupils have mastered and can contribute to participation and reflection on their own learning. We believe that this form of learning analytics and the teacher’s involvement must be differentiated according to the pupil’s age and maturity. Learning analytics that provides information to the teachers can form a basis for differentiating the instruction and providing formative assessments. Such information can, e.g., be presented through a visualisation, recommendations or a report that provides an overview of the pupils’ learning activities and academic progress.

2) Feedback and suggestions

The Expert Group believes that learning analytics that provides pupils and teachers with feedback and suggestions for instruction and learning based on pupil data can have pedagogical value.

For the pupils, this may entail that they receive recommendations from the learning resource regarding what they should work on next. Another example is that a pupil is assigned tasks in an adaptive resource based on how the pupil has previously solved tasks. Appropriate use of adaptive resources requires that the teacher has the opportunity to maintain a certain overview of how the pupils work with these resources. For example, the resource must facilitate so that the teacher can detect if pupils, for various reasons, receive feedback or suggestions that are incorrect in relation to the pupil’s actual needs. For the teachers, learning analytics can provide recommendations on learning activities and subject content based, among other things, on certain preferences, subjects, topics or methods. Learning analytics can also contribute to streamlining and individualising feedback to the individual pupil.

3) Work on quality development

The Expert Group believes that learning analytics, which provides information on learning and instruction, can be useful in quality development work in schools and with school owners.

Aggregated information on pupils’ academic development and on teaching practice can serve as a relevant source for the work on quality development. This will mainly apply to information that is comparable over time and across schools. Information that provides a broad description of the status quo will also be useful to support the schools in their quality development work.

Establish additional criteria for processing personal data in learning analytics

As shown in section 5.2.1, Article 6(3) of the GDPR allows for the stipulation of limitations in the legal basis for processing personal data. Such criteria could include storage limitation, further processing, accuracy and data minimisation. The Expert Group notes that learning analytics can involve processing personal data in different ways for different purposes. This makes it difficult to determine specific limitations that apply to all forms of learning analytics. Nevertheless, we believe it is crucial for pupils’ privacy that personal data that identifies pupils is not processed more than is necessary in relation to the purpose. The provisions that determine the tasks concerning differentiated instruction, formative assessment and quality development are open in terms of the types of information collected to carry out the tasks. Therefore, we propose that the proposal for a provision expressly states that the degree of personal identification shall not be greater than is necessary in relation to the purpose. This is a specification of the data minimisation principle in the Article 5(c) of the GDPR, and we note that it will rarely be necessary in relation to the purpose to process directly identifying personal data, especially in the case of quality development. This wording has also been used in other acts and regulations.1

Regarding further processing of personal data for purposes other than those stipulated in the legislation governing the education sector, the Expert Group is aware that this is carried out to further develop software, among other things. This is a commercial purpose on the part suppliers of digital resources and such further processing takes place without a legal basis (Bouvet, 2021; NOU 2022: 11). We believe this situation is unsustainable. However, the school owners are not able to do anything about this individually and it is therefore necessary for the national authorities to initiate a dialogue with the suppliers in order to clarify the issue.

The Expert Group also supports the Norwegian Privacy Commission’s proposal that:

[…] the Norwegian Government must initiate a broad investigation of digital tools that are currently in use in Norwegian schools and how they impact children’s privacy. Such an investigation should apply to all types of teaching aids and other methods and tools used in the teaching context. What control and monitoring possibilities these tools provide, what knowledge it is possible to extract from the data that are collected and stored and how the knowledge is used for the benefit of pupils and educational institutions, should be elucidated in such an investigation. Furthermore, it should be assessed how the collected personal data are further processed for various purposes. (NOU 2022: 11, pp. 136–137)

12.2.2 The Expert Group’s proposal on the legal basis for learning analytics in primary and secondary education and training

The Expert Group recommends clarifying the legal basis for processing personal data in learning analytics in primary and secondary education and training. The proposal is based on the general scheme in the proposal for a new Education Act Prop. 57 L (2022–2023). The provision shall be inserted in the Education Act and in the corresponding provision in the Independent Schools Act:

The Expert Group proposes including a new paragraph in section 25-1 of the Education Act on the processing of personal data in learning analytics and the tasks in the Act where such processing will be necessary. Proposed new paragraph:

“Municipalities, county authorities and training establishments may process personal data about pupils and apprentices by means of machine analysis and alignment where this is ethically and pedagogically sound and necessary to perform tasks and duties in the Act and regulations pursuant to the Act. Examples of such tasks and duties may be to adapt the instruction, the work on quality development in section 17-12 and formative assessment in section 3-10 of the Regulations pursuant to the Education Act. The degree of personal identification shall not be greater than necessary for the purpose in question.”

12.3 The Expert Group’s recommendations on the legal basis for learning analytics in higher education

The review of the existing legal bases for processing personal data in learning analytics in higher education in section 10.4 showed that there is a glaring need to clarify the basis for processing personal data in learning analytics. The Expert Group believes that the provisions on the tasks and responsibilities of the institutions are not suitable for specifying and constituting a legal basis for processing personal data in learning analytics.

The Expert Group recommends clarifying the legal basis for learning analytics in higher education. In this section, we present two proposals to strengthen the legal basis for processing personal data in learning analytics in higher education. The first proposal concerns creating a separate provision on processing personal data in learning analytics. The second proposal concerns specifying one of the provisions on quality assurance work, to specify that the institution may process personal data in learning analytics in the quality assurance work. The proposals by the Expert Group will not constitute independent legal bases within the meaning of the GDPR because the proposals do not impose their own tasks on the institutions that make it necessary to process personal data. However, the proposals will establish clearer frameworks for processing personal data in learning analytics that occurs to carry out tasks in the legislation.

12.3.1 Provision on the processing of personal data in learning analytics

Section 4-15 of the Universities and University Colleges Act contains provisions on the processing of personal data. The first paragraph of the provision stipulates that the educational institutions may process personal data “when the purpose of the processing is to safeguard the rights of the data subject, or to fulfil the institution’s tasks and duties under the Universities and University Colleges Act.” This does not constitute an independent legal basis as the provision merely reiterates what is stipulated in Article 6(1)(e) and (3), i.e., that personal data may be processed when the “processing is necessary for the performance of a task carried out in the public interest” and the task is laid down in national legislation. The Expert Group is of the opinion that section 4-15 on the processing of personal data is a suitable place to establish a provision on the processing of personal data in learning analytics.

In the following paragraphs, we will show how a provision on learning analytics can describe the processing of personal data and the tasks where it may be necessary to process personal data in learning analytics according to the law, and what qualifies as justifiable processing. Next, we will consider how the provision will specify the purpose of the processing.

The provision should describe the processing

A clarification of the provision presupposes that the processing of personal data is described. As the Expert Group showed in section 12.2.1, it is neither appropriate to use the term learning analytics in a provision nor to list all the information that would be relevant to process in learning analytics. This assessment also applies to the processing of personal data in higher education. We propose to use the wording “machine analysis and alignment” to include the processing of personal data using artificial intelligence. This wording also covers the processing of personal data in learning analytics in higher education.

Necessity

The Expert Group is of the opinion that the provision should describe the tasks in the Act where it may be necessary to process personal data. The Expert Group believes that processing personal data in learning analytics is relevant, among other things, to fulfil the following tasks and duties, but that the provision should not exclude the possibility that other tasks may also be relevant:

The responsibility for offering higher education based on the foremost within research in section 1-3a, and ensuring that teaching maintains a high professional level and is conducted in accordance with recognised scientific, pedagogical and ethical principles in section 1-5, first paragraph.
Having a satisfactory internal system for quality assurance in section 1-6, and requirements for systematic quality assurance work in section 2-1 of the Regulations on the quality of programmes of study and section 4-1 of the Academic Supervision Regulations.

There is a risk that a provision that mentions examples of tasks for which learning analytics may be relevant could be interpreted such that it also allows for personal data to be processed for other tasks in the Act that are not relevant. The Expert Group emphasises that this proposed wording is not intended to facilitate increased processing of personal data in learning analytics where this is neither necessary nor justifiable. For tasks pursuant to the Act, the institutions will have a processing basis if the requirement of necessity is met according to Article 6(1)(e) of the GDPR, cf. Article 6(3).

Justification

In addition to the provision having to describe the actual processing of personal data, the Expert Group is of the opinion that the provision must require that the processing be justifiable. The requirement for justification is about clarifying that the processing must be subject to the condition that the pedagogical and ethical aspects of the processing have been assessed. The interference with the individual student’s privacy can be significant in learning analytics, and this requires a thorough assessment of the pedagogical and ethical aspects of the specific processing.

Specify the purposes of the processing

1) Active learning

The Expert Group believes that learning analytics, which provides students with insight into their own learning, can be useful in their learning process.

Information regarding which activities the students have carried out and what academic results they have achieved in various subjects during their educational pathway, can contribute to self-regulation, participation and involvement. The Expert Group believes that students should be involved in learning analytics processes at the educational institution. The students must also receive sufficient guidance to be able to understand, interpret and make use of the information from learning analytics in order to meet the objective of increased insight into their own learning processes and active learning.

2) Student follow-up

The Expert Group believes that learning analytics that offers information about learning and teaching can have pedagogical value for teachers.

Data about students from digital resources can provide information to teachers about how the students use the resources available to them. This can support instructors in following up students and structuring teaching. For learning analytics with this purpose, it is key that teachers and students work together to interpret the information and jointly determine what significance the analyses will have for the further development of teaching.

3) Quality assurance work

The Expert Group believes that learning analytics that provides information on students’ academic development and on teaching practice can serve as a relevant source for the quality assurance work at educational institutions.

The Expert Group believes that the general rule must be that the data processed for quality assurance work must be de-identified. Processing personal data for quality assurance work requires the necessary guarantees in accordance with Article 89 of the GDPR to ensure pupils’ and students’ rights and freedoms. The guarantees shall ensure that technical and organisational measures have been introduced to ensure compliance with the principle of data minimisation. Such measures include pseudonymisation, de-identification, aggregation or anonymisation. The decision on what degree of identification is permitted must be based on a risk assessment linked to the types of personal data included in the analysis.

12.3.2 Specification of the provision on quality assurance work

The provisions on quality assurance work are divided between three different sets of acts and regulations. Section 1-6 of the Universities and University Colleges Act lays down the broad provision that the institutions “shall have a satisfactory internal system for quality assurance that will ensure and further develop the quality of the education”. The objectives and requirements for the content of the quality assurance work are stipulated in section 2-1 of the Regulations on the quality of programmes of study and section 4-1 of the Academic Supervision Regulations. These provisions specify to a greater extent how the institutions should work on quality development. In order to support the general scheme in the current legislation, a specification to clarify the basis for processing personal data in learning analytics would be best suited to be included in the provision that regulates how the quality assurance work should take place.

Section 4-1 of the Academic Supervision Regulations states, among other things, that the “[i]nstitution shall systematically collect information from relevant sources in order to be able to assess the quality of all study programmes”. The wording is open in terms of what kind of information is collected for the quality assurance work. Therefore, the Expert Group believes that the provision should explicitly show that the degree of personal identification should not be greater than what will be necessary for the purpose, as discussed in more detail in section 12.2.1. The student unions have been concerned that personal data are processed in systems which unnecessarily identify the individual student. A requirement that the degree of personal identification must be necessary for the purpose clarifies how the Expert Group believes the principle of data minimisation in Article 5(1)(c) of the GDPR should be specified in connection with quality assurance work.

12.3.3 The Expert Group’s proposal on the legal basis for learning analytics in higher education

The Expert Group recommends clarifying the legal basis for processing personal data in learning analytics in higher education. The provisions shall be inserted in the Universities and University Colleges Act and the Regulations pursuant to the Act:

The Expert Group proposes inserting a new paragraph in section 4-15 of the Universities and University Colleges Act on the processing of personal data in learning analytics and for which tasks such processing may be necessary. Proposed new paragraph:

“The educational institution may process personal data about students by means of machine analysis and alignment where this is ethically and pedagogically justifiable and necessary to fulfil tasks and obligations pursuant to the Act. Examples of such tasks and duties include quality assurance work and the responsibility to ensure that instruction is provided in accordance with recognised ethical and pedagogical principles, cf. section 1-5.”

The Expert Group proposes specifying the provisions on quality assurance work in section 4-1 of the Academic Supervision Regulations so that these provisions explicitly apply to the processing of personal data in learning analytics. Proposed new paragraph:

“The institutions may process personal data by means of machine analysis and alignment where necessary for its systematic quality assurance work. The degree of personal identification shall not be greater than necessary for the purpose in question.”

12.4 The Expert Group’s recommendations on the legal basis for learning analytics in tertiary vocational education

The Expert Group recommends that the legal basis for learning analytics in vocational colleges should be clarified. The Expert Group notes that the assessments in section 12.3 on processing bases for higher education are largely transferable to the processing of personal data in learning analytics in tertiary vocational education.

The Expert Group also believes that it is appropriate that the design of the legal basis for processing of personal data in learning analytics be identical for tertiary vocational education and for higher education. Therefore, the Expert Group will in this section only present changes in proposals for legislation and refers to section 12.3 for a description of the background for the recommendations.

12.4.1 Provision on the processing of personal data in learning analytics

The processing of personal data at vocational colleges is regulated in section 4 of the Vocational Education Regulations. The Expert Group proposes to add a new paragraph to the provision that applies to the processing of personal data in learning analytics.

The Expert Group believes that processing personal data in learning analytics is relevant, among other things, to fulfil the following tasks and duties, but that the provision should not exclude the possibility that other tasks may also be relevant:

Quality assurance work pursuant to section 5 of the Vocational Education Act and section 4-1 of the Vocational Education Academic Supervision Regulations
The requirement that the vocational colleges must have learning and teaching methods that are suitable for the students to achieve the learning outcome in section 2-1 of the Vocational Education Academic Supervision Regulations

12.4.2 Specification of the provision on quality assurance work

The Expert Group believes it is also relevant to specify the provision on quality assurance work in vocational colleges in a similar way to what the Expert Group has proposed in the legislation governing higher education, cf. section 12.3.2. Section 5 of the Vocational Education Act states that vocational colleges must have systems for quality assurance. The detailed content of the requirement for the vocational college’s quality assurance work is regulated in the Vocational Education Academic Supervision Regulations. Section 5, sixth paragraph, letter d) of the Vocational Education Act states that the Norwegian Ministry has the right to issue regulations on requirements for quality assurance work. Section 4-1, third paragraph of the Vocational Education Academic Supervision Regulations states, among other things, that the vocational colleges must “systematically collect […] information from students, employees, representatives from the professional field and any other relevant sources”. The Expert Group believes it would be appropriate to specify in the same provision that vocational colleges may process personal data using learning analytics in connection with quality assurance work when this is necessary and justifiable.

12.4.3 The Expert Group’s proposal on the legal basis for learning analytics in tertiary vocational education

The Expert Group recommends clarifying the legal basis for processing personal data in learning analytics in tertiary vocational education. The provisions shall be inserted in the Vocational Education Act and the Regulations pursuant to the Act:

The Expert Group proposes inserting a new paragraph in section 4 of the Vocational Education Regulations on the processing of personal data in learning analytics and for which tasks such processing may be necessary. Proposed new paragraph:

“The vocational colleges may process personal data about students by means of machine analysis and alignment where this is ethically and pedagogically justifiable and necessary to fulfil tasks and obligations pursuant to the Act. Examples of such tasks and duties may be quality assurance work and having learning and instruction methods that are suitable for the students to achieve the learning outcomes, cf. section 2-1 of the Vocational Education Academic Supervision Regulations.”

The Expert Group proposes specifying the provisions on quality assurance work in section 4-1, third paragraph of the Vocational Education Academic Supervision Regulations so that these provisions explicitly apply to the processing of personal data in learning analytics. Proposed new paragraph:

“The vocational colleges may process personal data by means of machine analysis and alignment where necessary for its systematic quality assurance work. The degree of personal identification shall not be greater than necessary for the purpose in question.”

12.5 Summary of the Expert Group’s recommendations and proposals on the legal basis for learning analytics

Primary and secondary education and training

The Expert Group proposes including a new paragraph in section 25-1 of the Education Act on the processing of personal data in learning analytics and the tasks in the Act where such processing will be necessary. Proposed new paragraph:

“Municipalities, county authorities and training establishments may process personal data about pupils and apprentices by means of machine analysis and alignment where this is ethically and pedagogically sound and necessary to perform tasks and duties in the Act and regulations pursuant to the Act. Examples of such tasks and duties may be to adapt the instruction, the work on quality development in section 17-12 and formative assessment in section 3-10 of the Regulations pursuant to the Education Act. The degree of personal identification shall not be greater than necessary for the purpose in question.”

Higher education

The Expert Group proposes inserting a new paragraph in section 4-15 of the Universities and University Colleges Act on the processing of personal data in learning analytics and for which tasks such processing may be necessary. Proposed new paragraph:

“The educational institution may process personal data about students by means of machine analysis and alignment where this is ethically and pedagogically justifiable and necessary to fulfil tasks and obligations pursuant to the Act. Examples of such tasks and duties include quality assurance work and the responsibility to ensure that instruction is provided in accordance with recognised ethical and pedagogical principles, cf. section 1-5.”

The Expert Group proposes specifying the provisions on quality assurance work in section 4-1 of the Academic Supervision Regulations so that these provisions explicitly apply to the processing of personal data in learning analytics. Proposed new paragraph:

“The institutions may process personal data by means of machine analysis and alignment where necessary for its systematic quality assurance work. The degree of personal identification shall not be greater than necessary for the purpose in question.”

Tertiary vocational education

The Expert Group proposes inserting a new paragraph in section 4 of the Vocational Education Regulations on the processing of personal data in learning analytics and for which tasks such processing may be necessary. Proposed new paragraph:

“The vocational colleges may process personal data about students by means of machine analysis and alignment where this is ethically and pedagogically justifiable and necessary to fulfil tasks and obligations pursuant to the Act. Examples of such tasks and duties may be quality assurance work and having learning and instruction methods that are suitable for the students to achieve the learning outcomes, cf. section 2-1 of the Vocational Education Academic Supervision Regulations.”

The Expert Group proposes specifying the provisions on quality assurance work in section 4-1, third paragraph of the Vocational Education Academic Supervision Regulations so that these provisions explicitly apply to the processing of personal data in learning analytics. Proposed new paragraph:

“The vocational colleges may process personal data by means of machine analysis and alignment where necessary for its systematic quality assurance work. The degree of personal identification shall not be greater than necessary for the purpose in question.”

13 Code of conduct for data protection in primary and secondary education and training (School Code of Conduct)

In the vast majority of cases, learning analytics in primary and secondary education and training requires the processing of personal data. Data protection must therefore be safeguarded for learning analytics to be justifiable. The right to privacy is enshrined in international and national legislation. The legislation in this area is general and risk oriented. This means that for processing that is considered to be invasive (high risk), there must be mechanisms other than the text of the Act in place to safeguard the basic principles of the GDPR.

The Expert Group’s clear opinion is that there are currently inadequate arrangements to safeguard privacy in Norwegian schools. This is also supported by the assessments of the Norwegian Privacy Commission (NOU 2022: 11). Many of the provisions in the area of data protection are vague and ambiguous, entailing that it can be difficult to translate them into practice. Inadequate safeguarding of data protection can threaten the public’s trust in schools. The Expert Group believes there is a need for greater governance of learning analytics than is found in the legislation, and that the best solution is to draft a code of conduct to safeguard data protection in schools.

13.1 What is a data protection code of conduct?

A data protection code of conduct is a collection of guidelines that enterprises within an industry or sector agree to observe. The guidelines can be designed as several different measures. The purpose of the code of conduct is for the provisions in the legislation to be supplemented through specific requirements for, among other things, organisational, technical and pedagogical measures to achieve satisfactory data protection. In addition to guidelines, additional mechanisms can also be included in such a code of conduct. Such mechanisms may include various support functions that are necessary to ensure good implementation of the guidelines. Developing and working on the basis of such a code of conduct is an important part of achieving the goal of the code of conduct as it facilitates competence development, a shared understanding and equal practice.

In the health and care sector, a data protection and information security code of conduct has been drawn up with great support in the sector. In the health and care sector, this is referred to as Normen (Health and Care Sector Code of Conduct).2 In the GDPR, the intention is for such a code of conduct to be approved by the Norwegian Data Protection Authority. In order for a collection of guidelines to be approved as a code of conduct, there are a number of formal requirements that must be met. The Health and Care Sector Code of Conduct does not meet all these criteria, and is therefore not categorised as a code of conduct.

13.2 The need for a code of conduct for data protection in schools

The need for a code of conduct to safeguard data protection in schools has been put forward in several contexts. The Norwegian Privacy Commission recommended that state authorities be required take the initiative to draw up a data protection code of conduct for the school and kindergarten sector (NOU 2022: 11). The Commission notes that a data protection code of conduct can better enable municipalities and county authorities to safeguard their processing responsibilities.

The Education Act Committee recommends that codes of conduct be drawn up for the education sector, and highlights learning analytics as a particularly relevant area for a code of conduct:

For municipalities as controllers, it may be relevant to have codes of conduct pertaining to learning analytics. For example, general codes of conduct can be drawn up for the purchase and use of tools for learning analytics, or in relation to a particular tool. Furthermore, publishers and other processors can draw up codes of conduct to ensure compliance with the requirements in the GDPR that apply to them. This could involve codes of conduct on privacy by design. (NOU 2019: 23, p. 70)

We have received several comments calling for a code of conduct to safeguard data protection, including from the industry organisation ICT-Norway (2023):

ICT-Norway supports the intention regarding standard-setting guidelines that can ensure uniform application of the legislation across municipalities and suppliers. A data protection code of conduct for schools can contribute to a more uniform application of requirements for data protection and security for digital teaching aids and make it easier for suppliers to understand what requirements apply to their products. (p. 2)

In order for a code of conduct to aid school owners in complying with the data protection legislation, it should be aimed at the entire life cycle and all target groups of the technology. The entire service life cycle spans from planning, via design, coding, testing, commissioning, to use, management and decommissioning. The most important target groups are developers, suppliers, school owners, school administrators, teachers, pupils and parents. We stress that the different target groups have different needs. However, they also have an urgent and overlapping need for fixed guidelines governing data protection in schools. Therefore, it is hugely beneficial if the content of a code of conduct corresponds to the needs of all these target groups for guidance and assistance in the various phases of the service life cycle.

13.3 Three conditions for the School Code of Conduct

We will highlight three special conditions for the School Code of Conduct. The first condition is that the development of the code of conduct should be based on existing materials and measures in the school sector. The remaining conditions concern two areas to which particular attention should be directed – the data protection risk when using open resources and resources that are autonomous systems.

Building on existing work

There are already several initiatives and measures in place to strengthen data protection in schools. Among them are the Norwegian Association of Local and Regional Authorities’ (KS) project SkoleSec3 and the Norwegian Directorate for Education and Training’s resource pages on data protection in schools4. These resources include extensive guidance material, templates for contracts and assessments, tools for competence development and development projects to support school owners in safeguarding their processing responsibilities. These resources have largely been developed in collaboration with the sector, and the Expert Group believes they form a good starting point for drawing up the School Code of Conduct.

License-based and open resources

The code of conduct is intended to regulate all resources with functionality for learning analytics that schools use, regardless of whether or not they are license-based. Before the schools adopt license-based resources with functionality for learning analytics, they must undertake a comprehensive procurement process. However, services that are openly available online are prevalent in schools. Using open resources often occurs without the approval of management or others with data protection competence. This entails a major privacy risk for pupils (Bouvet, 2021).

The Norwegian Privacy Commission investigated services in schools where “payment is made in the form of children’s personal data” (NOU 2022: 11). The Commission’s work clearly demonstrates that the safeguarding of pupils’ privacy is a major challenge in relation to such services. One of the reasons why the use of open resources is high risk is that data protection impact assessments are generally more thorough when procuring a license-based resource compared to when the school uses an open resource. Another reason relates to commercial matters. The Norwegian Data Protection Authority (2021b) notes that suppliers of open services reuse personal data as part of their business model. This entails a high risk of personal data being used for purposes for which there is no legal basis. In order to reduce the privacy risk in schools, it is crucial that the code of conduct also addresses open resources.

Autonomous systems

Adaptive teaching aids and assessments make an automated, individual adaptation according to the pupil’s situation with the aid of artificial intelligence. Resources that act without human involvement are referred to as autonomous systems or automated decision systems. Questions regarding who is responsible for the consequences of the decisions made by such systems, and how to delimit such autonomy, have been major topics in discussions on ethics and artificial intelligence in recent years (Norwegian Ministry of Local Government and Modernisation, 2020). As adaptive teaching aids and tests fall under the definition of autonomous systems, we believe it is particularly important to pay attention to them in the code of conduct.

13.4 The Expert Group’s proposal for content in the School Code of Conduct

In this section, we will provide a brief and general description of four proposals that are particularly important for safeguarding data protection in learning analytics:

development and administration of specific data protection requirements in resources that have functionality for learning analytics
preparation and administration of guidance materials for school owners, teachers, pupils, parents, developers and suppliers
development and administration of national data protection impact assessments for resources that have functionality for learning analytics
facilitation of competence development and exchange of experience related to data protection in schools

13.4.1 Specific data protection requirements in resources that have functionality for learning analytics

Key to the School Code of Conduct is the development of requirements for the use and development of resources with functionality for learning analytics, including through privacy by design. The requirements can be directed at controllers as well as developers and suppliers. Currently, it is often the suppliers who in practice assess which functions the tools should have, e.g., storage time and what is visible to the teacher (ICT-Norway, 2023).

In 2021, the Norwegian Directorate for Education and Training was tasked with creating a general guide on which data protection requirements should be imposed on suppliers of digital learning resources (Norwegian Ministry of Education and Research, 2021). Experience from this work and from the development of security requirements in SkoleSec may be useful when data protection requirements are to be developed in the School Code of Conduct. The requirements can also form a starting point for preparing criteria-based guides that school owners can use in the procurement of resources with functionality for learning analytics.

In the specific requirements for data protection, it may be relevant to specify, among other things, what will be necessary to process personal data based on the purposes set out in the legal bases. We have identified the following four data protection principles that have proven to be particularly challenged by learning analytics and artificial intelligence:

fairness (uncritical use of analyses, little co-determination)
transparency (closed business models, dynamic algorithms)
data minimisation (collection of data without a clear plan for use)
accuracy (biases in the supporting data).

The specific requirements for data protection in resources with functionality for learning analytics should be particularly aimed at reducing risk within these four areas. We will highlight some examples of which requirements may be relevant to ensuring fairness, transparency and accuracy, and to safeguarding data minimisation in learning analytics to a greater extent than is currently the case.

Fairness

A basic requirement to safeguard fairness is that the supplier provides information about how the data are processed, in an objective and neutral manner, and that the supplier does not use misleading or manipulative language or design.

To ensure fairness, it will be key to facilitate in order for pupils and parents to exercise their rights. This involves, among other things, incorporating requirements that grant pupils and parents access and the opportunity to rectify and erase data. Fairness is also promoted if the resources have functionality for data portability, which makes it possible to extract data in a reusable format. In addition, the possibility for users to control whether their data are used in learning analytics can enhance fairness. Functionality for enabling and disabling learning analytics must be weighed against pedagogical needs and what is practically feasible to implement. However, the default setting should be that functionality for learning analytics is disabled. Such requirements can contribute to ensuring participation in learning analytics.

Algorithms that contribute to maintaining or amplifying discrimination are a significant threat to fair use of artificial intelligence. Therefore, mechanisms to detect and remedy this are key requirements for consideration. Regularly testing whether the algorithms work in line with the purposes, and adjusting the algorithms to reduce biases are relevant examples of such mechanisms.

Transparency

Transparency around the use of personal data is necessary to preserve pupils’ and parents’ trust in the school and the trust they have in suppliers of learning resources. Requirements that can safeguard transparency are largely linked to information that is aimed at different target groups. Examples of relevant information include

an easily understandable and adequate description of what the solution actually does
an outline of data flow and processing protocol5
an explanation of how the algorithm weights variables, and the accuracy of the algorithm
making visible what and whence the information is collected, and how it is interpreted in the analysis

Although the information may be of a complex and technical nature, it must be accessible to school owners, school administrators and teachers with general technical competence. This is a prerequisite for being able to decide whether the best interests of the child have been assessed and safeguarded by the manner in which the resource has been developed. The information must also be possible to convey to pupils and parents. Pictures, icons and symbols can be used to make the information clearer. Animation, video and sound can be good tools for adapting the information to the target groups.

Data minimisation

The principle of data minimisation is about limiting the amount of data collected and processed to what is necessary to achieve the purpose. It is necessary to set requirements for mechanisms that ensure that, by default, only personal data that are necessary for the purpose of the processing are collected. A specification of this could be that the resource contains barriers to the linking of personal data in other systems or that have been collected for other purposes. Another way to comply with the principle of data minimisation is to require the removal or masking of directly identifying data (pseudonymisation) once such identification is no longer necessary. This can apply to, e.g., the training of algorithms and quality development of the resource.

Accuracy

In order to ensure the accuracy of analyses, there should be a requirement that the source data are quality assured and validated prior to being used in learning analytics. The Norwegian Privacy Commission notes that biases can occur when digital tools lack transparency (NOU 2022: 11). Such biases are amplified if the solutions are used uncritically or fed flawed training data Therefore, it will be relevant to require built-in regular testing for biases in the data material, the models or in the use of the algorithms. In addition, there should be a requirement to re-train the algorithms if the accuracy falls below a predetermined threshold.

13.4.2 Guidance material for school owners, teachers, pupils, parents, developers and suppliers

Guidance material that elaborates on the requirements of the School Code of Conduct and supports the various roles in safeguarding their responsibilities is a prerequisite for the code of conduct to function as intended. The guidelines must be developed in collaboration with the school sector and be adapted to the target groups.

There are already many good data protection guides that are openly available and developed by competent actors. In table 13.1, we have listed some of these guides, their target groups, and which phase of the technology life cycle is covered. None of the resources are designed for learning analytics specifically, nor are any of the resources aimed at all target groups of relevance to learning analytics.

Table 13.1

	The Norwegian Directorate for Education and Training and the Norwegian Data Protection Authority: Dubestemmer.no¹	Udir.no²	Norwegian Association of Local and Regional Authorities (KS): Skolesec³	KiNS⁴	Norwegian Data Protection Authority⁵
Target group
developers				X	X
suppliers			X	X	X
school owners		X	X	X	X
school administrators		X	X
teachers	X	X	X
pupils	X	X
parents	X	X	X

Phase
development					X
order			X	X	X
implementation			X	X	X
use	X	X	X		X

Addresses
data protection	X	X	(X)	(X)	X
information security			X	X	X
ethics	X	X	X
pedagogical matters	X	X

¹ https://www.dubestemmer.no/

² https://www.udir.no/regelverk-og-tilsyn/personvern-for-barnehage-og-skole/

³ https://www.ks.no/fagomrader/digitalisering/felleslosninger/skolesec/

⁴ https://kins.no/verktoykasse/

⁵https://www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/innebygd-personvern/programvareutvikling-med-innebygd-personvern/

The Norwegian Data Protection Authority’s guide stands out in the sense that it is the only one that specifically targets service developers. However, if it is to be used in a code of conduct aimed at schools, it must be homed in on the school sector.

The Expert Group notes that guidance material as part of the School Code of Conduct can contribute the following:

Gathering resources and tools
Many useful tools already exist, but are fragmented such that it is difficult to gain an overview. The School Code of Conduct can help create the necessary overview.
Interdisciplinarity
Several of the resources contain both elements of law and technological requirements, but few address requirements related to quality of education. The School Code of Conduct can contribute by contextualising these perspectives, and updates should also occur by way of such contextualisation.
Communication
Guidance linked to the code of conduct can contribute to target group outreach, which can underpin the objective of increased shared understanding across the target groups. An important aspect of this is to ensure that the various guides do not contradict each other.

13.4.3 National Data Protection Impact Assessments (DPIAs)

The School Code of Conduct is a suitable arrangement for identifying a better solution for assessing data protection consequences for learning analytics in school. The Norwegian Data Protection Authority states that processing personal data to evaluate learning, coping and well-being in school always requires a DPIA to be carried out (Norwegian Data Protection Authority, 2019). This requirement will cover the vast majority of forms of learning analytics. There is a considerable need to carry out DPIAs of resources with functionality for learning analytics in a more efficient and qualified manner.

As controllers, all school owners are subject to the same statutory requirements to assess data protection risks, but have different prerequisites for carrying out such assessments. A likely consequence is that pupils do not receive an equal provision of digital learning resources across municipalities because the municipalities fail to use resources due to their lack of capacity and competence to assess privacy risks (Høiseth-Gilje et al., 2022).

The Expert Group notes that there is a great deal of uncertainty among the school owners in the process of assessing whether the use of a resource in the school entails an acceptable privacy risk. This leads to marked differences in what is considered justifiable learning analytics among schools and municipalities (Parents’ Committee for Primary and Secondary Education, 2022a). It also leads to unpredictability for schools, pupils, parents, suppliers and developers (ICT-Norway, 2023). Although the responsibility for the DPIAs is clearly placed with the school owners, in many cases they do not have sufficient competence to carry out a satisfactory assessment. Such an assessment also requires considerable resources from each individual municipality.

A national actor may be responsible for preparing and managing risk analyses and general DPIAs with associated data processor agreements. Nevertheless, it is the controllers who are to carry out the residual risk assessment and local adaptation. Nationally prepared DPIAs of resources with functionality for learning analytics as part of the School Code of Conduct can contribute to countervailing differences, ensuring justifiable assessments of high quality and reducing the use of public resources. It is important that the actor that carries out the assessments has specialised competence in assessing privacy risks, particularly within core public institutions that include vulnerable groups, such as children. According to Article 35(1) of the GDPR, a single assessment of data protection consequences may address a set of similar processing operations that present similar high risks. Therefore, it may be appropriate to prepare joint DPIAs for similar services.

For the procurement of digital teaching aids, the most socio-economically expedient option is considered to be for a single national actor to carry out DPIAs (Høiseth-Gilje et al., 2022). According to a socio-economic analysis of the procurement of digital teaching aids, the current procurement system is inefficient and does not ensure that all pupils have equal access to high-quality digital teaching aids that meet requirements for data protection, information security and universal design (Høiseth-Gilje et al., 2022). The report recommends centralising parts of the activities involved in purchasing digital teaching aids, including obtaining information and carrying out parts of DPIAs and risk and vulnerability analyses of digital teaching aids, as well as drawing up standardised data processor agreements.

The Expert Group recognises that national DPIAs are a powerful instrument that can challenge local self-government and autonomy. There is also a risk that the responsibility for safeguarding data protection in schools may be shifted or pulverised. Therefore, it is important to carry out a thorough investigation of how national DPIAs can be prepared and managed in the best possible manner. We emphasise that the potential impact on the market and connection with the procurement legislation are important components of such an investigation. It will be particularly relevant to identify good solutions to ensure equal treatment of digital learning resources – both licensed and open resources – to avoid distortion of competition.

The Expert Group emphasises that, as it is the school owners who have the statutory responsibility for data protection in schools, an arrangement involving national DPIAs means that the school owners carry out residual risk assessments and any adaptations of the national assessments and agreements. We recognise that there is a need to offer support to school owners in making residual risk assessments, e.g., through centrally prepared guidelines. This is particularly important as many of the country’s municipalities do not have employees with legal competence (Juristforbundet, 2021).

Textbox 13.1 Project on national assessment of data protection consequences¹

KS and the City of Bergen have launched a project to implement and test a national assessment of data protection consequences (DPIA) for Google’s products and services in schools. The aim is to have an overall national DPIA in place by the end of 2023.

Such a broad national DPIA will ensure sufficient competence and capacity in the assessments and enable the municipalities to make assessments of residual risk for the use of the services. In addition to a broad DPIA, the project will prepare an accompanying guide to adapt and anchor the DPIA to the individual municipality.

In addition to having a national broad but thorough DPIA prepared for Google’s services, an aim of the project is to gather experience in order to co-govern and coordinate processes for data protection impact assessments. These experiences will be transferrable to national assessments of similar services, e.g., Microsoft Office 365. The experiences will also be relevant for other services and solutions used in schools.

¹ https://www.ks.no/fagomrader/digitalisering/felleslosninger/skolesec/personvernkonsekvenser-for-googles-produkter-i-skolen-skal-vurderes/

Sharing of municipally prepared DPIAs

Establishing national DPIAs will take time, and the privacy situation in schools is precarious (NOU 2022: 11). According to the Norwegian Privacy Commission, schools have generally failed to safeguard pupils’ privacy and adequately manage their personal data. As mentioned, there are major differences in terms of the assessments carried out by the schools.

Several municipalities have already prepared thorough DPIAs of resources with functionality for learning analytics, which will largely be relevant for other municipalities. Most school owners have similar considerations and needs, and the school sector is generally well suited for sharing and simultaneous use. Until national measures related to DPIAs are in place, a first step should therefore be to arrange for the municipalities to share parts of their DPIAs. This will ensure more equality in education – as it will reduce the likelihood that municipalities assess different resources in completely different ways – and serve as quality assurance for municipalities with less legal competence seeking to build on the assessments of others. The municipally prepared DPIAs can also serve as a starting point when their national counterparts are to be prepared.

13.4.4 Facilitation of competence development and exchange of experience

Safeguarding data protection in learning analytics in schools requires a high level of competence. The ordering competence of school owners varies. Many utilise support functions such as the Norwegian Directorate of Education and Training’s guides for assessment of quality in teaching aids, risk assessment, cloud services and data protection consequences.6

One of the Expert Group’s proposals in the School Code of Conduct is to facilitate the exchange of experience and develop data protection competence. A good solution would be to add this function to an already existing network, e.g., the municipal sector’s regional digitalisation networks and other national cooperation arenas between authorities and KS for digitalisation in the developmental environment. The competence development that takes place in such a network must also contribute to guiding suppliers in order to strengthen technological development that is in compliance with the requirements.

In addition to serving as an arena for competence development and exchange of experience, such a network can also facilitate the development of pilot projects and testing environments.

13.5 The Expert Group’s proposal on management of and participation in the School Code of Conduct

In order for the School Code of Conduct to have a regulatory function, the Expert Group believes it is necessary to have considerable support among school owners, schools, developers and suppliers. The School Code of Conduct must also be managed appropriately, with good involvement and anchoring in the school sector. There are several alternative solutions that can contribute to ensuring good management and a high degree of participation.

13.5.1 Management and coordination responsibility for the School Code of Conduct

In order to ensure that the School Code of Conduct is sufficiently anchored in the sector, it is crucial to establish mechanisms for management and coordination that will be suitable to realise the purpose of the code of conduct. This will entail, among other things, developing the data protection requirements in the code of conduct, carrying out national data protection impact assessments, establishing data processor agreements and preparing guidance material.

Governance model

One option for governance is to establish a steering group consisting of representatives from key actors and user groups. This can contribute to ensuring adequate anchoring of the School Code of Conduct. The steering group can be consensus-driven, as in the data protection and information security code of conduct in the health and care sector. We also believe that an important measure will be to include actors with observer status in the steering group, such as representatives from the Norwegian Data Protection Authority, industry organisations, relevant research environments and others. One disadvantage of a consensus-based governance model is that it is less suited for strong governance. Nevertheless, we believe it is essential that the School Code of Conduct ensures coordination and anchoring in the sector, and that a consensus-based governance mechanism would be suitable for this purpose.

Another possible governance model is that a central government actor – e.g., the Norwegian Directorate for Education and Training or Sikt – be given responsibility for administering the School Code of Conduct. A solution involving a central government actor as administrator of the code of conduct could result in clearer national governance, at the same time as there would be a need for mechanisms to ensure ownership and support in the school sector.

A third option is the establishment of a new body with interdisciplinary competence suitable for administering the School Code of Conduct.

Coordination

An option for coordinating the School Code of Conduct is the establishment of an independent secretariat under e.g., the Norwegian Directorate for Education and Training or Sikt. The secretariat may be responsible for following up the decisions made by the steering group and, e.g., preparing proposals for data protection requirements and guidance material. The Health and Care Sector Code of Conduct uses such a coordination model with a working secretariat under the Norwegian Directorate of eHealth.

Another option is for KS to be responsible for coordination. The association is perhaps closer to the school sector and is an interest group in the policy-making process distinct from central government actors.

13.5.2 Support for the School Code of Conduct

The least binding model for support among school owners is an optional commitment to the code of conduct. Such an arrangement would be consistent with the strong local self-government we have in Norway. Several school owners express to the Expert Group that they need significantly more assistance in the area of data protection, which may indicate acceptance of a model involving stronger central governance. The Expert Group notes that there is a high level of motivation on the part of school owners to endorse centralised arrangements that make it more predictable and manageable to handle processing responsibilities.

One model with a stronger incentive for participation on the part of both suppliers and municipalities is to closely link the School Code of Conduct with a national service catalogue for digital learning resources. In the digitalisation strategy for schools, one of the measures is to establish a publicly managed national service catalogue for digital teaching aids (Norwegian Ministry of Education and Research, 2023). The purpose of such a service catalogue is to provide the municipalities and schools with a better overview of the market, while at the same time ensuring free choice and a wealth of options. The catalogue may include an overview and description of digital teaching aids, information about available licences, statistics and analysis of use, as well as assessments in relation to requirements for data protection, universal design and language variant. The data protection requirements included in the code of conduct can be key criteria for inclusion in the national service catalogue. The Norwegian Privacy Commission emphasises that a national service catalogue is an important initiative to strengthen pupils’ privacy if clear requirements for data protection and information security are included as criteria for including the learning resources in the catalogue (NOU 2022: 11). We stress that we have not considered such a link in relation to the procurement legislation and other legislation that regulates the market, but are aware that there may be a need to investigate new interpretations and possible amendments to the legislation.

The Expert Group notes that resources available through national platforms and access services – such as Feide – are already perceived in the sector as being controlled according to statutory requirements. This is incorrect. It is the school owners who are responsible for ensuring that the learning resources meet the data protection requirements, and there is a widespread misconception that Feide relieves school owners of this responsibility. We are concerned that the consequence of the misconception that national access services involve an approval based on statutory requirements will be amplified if a service catalogue devoid of data protection requirements becomes available to schools.

13.6 The Expert Group’s assessments

The Expert Group believes there is a considerable need to develop a code of conduct for data protection in schools. Currently, pupils’ privacy is not adequately safeguarded, and this challenges trust in the school as a public institution. The processing of personal data in primary and secondary education and training occurs on a large scale, including without learning analytics. It is not the analysis of pupil data that, in isolation, necessitates a code of conduct to safeguard data protection in schools, but learning analytics reinforces this need.

The Expert Group does not consider it appropriate to develop a code of conduct that is approved by the Norwegian Data Protection Authority according to criteria for a code of conduct. One of the reasons for this is that the Norwegian Data Protection Authority, in its comments to the Expert Group, has noted that there is a requirement to establish a monitoring body to ensure compliance with the provision on codes of conduct in the GDPR. However, we emphasise that national authorities should periodically assess whether the GDPR’s arrangement for codes of conduct would be suitable for the school sector.

The Expert Group believes that the best solution for better management and safeguarding of data protection in schools is to develop a School Code of Conduct according to a model similar to the Health and Care Sector Code of Conduct7. We recognise that the school sector differs from the health and care sector, in part because the State has greater controller functions in the health sector. The Norwegian Directorate for Education and Training (2023) has highlighted this in its consultation comments to the Norwegian Privacy Commission’s report. Nevertheless, we believe that the experience from the work on the Health and Care Sector Code of Conduct will be relevant for the school sector.

National authorities must take responsibility for ensuring that the School Code of Conduct is developed in close cooperation with the sector. At the same time, the Expert Group finds that the code of conduct should be binding for the relevant actors. Centralised support and guidance in the code of conduct must be designed in such a manner that the responsibility for processing continues to clearly rest with the school owners. In our assessment, specific requirements for data protection in resources with functionality for learning analytics, national data protection impact assessments, comprehensive guidance material with explanations and examples, and facilitating competence development in the sector will be necessary components of the School Code of Conduct.

13.7 The Expert Group’s recommendations

The Expert Group recommends that, in cooperation with the sector, a code of conduct be drawn up to safeguard data protection in schools. The School Code of Conduct should include the following minimum requirements:
- development and administration of specific data protection requirements in resources that have functionality for learning analytics
- preparation and administration of guidance materials for school owners, school administrators, teachers, pupils, parents, developers and suppliers
- development and administration of national data protection impact assessments for resources that have functionality for learning analytics
- facilitation of competence development on and exchange of experiences from data protection work in schools
The Expert Group recommends that, as part of the School Code of Conduct, specific, verifiable data protection requirements be drawn up for resources that have functionality for learning analytics. The requirements of the School Code of Conduct must be identical for both licensed and open resources. At a minimum, the requirements should be aimed at reducing the risks associated with the following four data protection principles:
- fairness
- transparency
- data minimisation
- accuracy
The Expert Group recommends that a national actor, as part of the School Code of Conduct, prepare and administer overall risk analyses, data protection impact assessments (DPIAs) and data processor agreements for resources that have functionality for learning analytics. The Expert Group emphasises that the responsibility for processing rests with the school owners. As the privacy situation in schools is precarious, we recommend as a first step that arrangements be made for school owners to share their analyses and assessments with each other.
The Expert Group recommends that as part of the School Code of Conduct, provisions be made for developing competence on and exchanging experiences related to the work on data protection. It would be beneficial if an already existing relevant network were assigned this role.
The Expert Group recommends that the administration model for the School Code of Conduct include a steering group with representatives from key actors and user groups.
The Expert Group recommends that the School Code of Conduct be based on relevant measures and guidelines that are already firmly anchored in the school sector, but it emphasises that the code of conduct must take a comprehensive approach to data protection in schools.
The Expert Group recommends linking the School Code of Conduct with a national service catalogue for digital learning resources. Such a link must be in accordance with the procurement legislation.
The Expert Group recommends that further work on the School Code of Conduct:
- be developed with a realistic level of ambition and include thorough investigations and evaluations along the way
- be aligned with existing learning technology standardisation efforts and privacy by design
- includes all processing of personal data in schools, including processing that does not have learning analytics as a purpose
- involves pupils and parents, where relevant

14 Frameworks for good learning analytics in primary and secondary education and training

Good learning analytics in schools is partly about the extent to which it supports the intentions of the National Curriculum. Therefore, it is necessary to facilitate a teaching practice characterised by variation, also with regard to the use of digital resources. There is also a need to require suppliers of digital learning resources to provide sufficient information about the pedagogical principles on which the resources are based.

The Expert Group believes that schools must be given a greater degree of free choice and a better overview of the digital learning resources with functionality for learning analytics available to them, and that greater provision should be made for schools to pay for use rather than access. They must also be better supported in assessing the quality of resources with functionality for learning analytics, and competence development related to pedagogical practice must be facilitated.

14.1 The Expert Group’s proposals for measures to increase free choice and equal access to learning analytics

In order for the information from learning analytics to be perceived as relevant and accurate for pupils and teachers, the selection of resources must reflect the variation in subjects, methods and pupils’ prerequisites. At the same time, access to a wide range of resources does not imply free choice per se. Teachers increasingly have access to high-quality digital teaching aids, but find it challenging to gain an overview of the selection thereof and identify the teaching aids that are suitable for the current learning situation (Norwegian Directorate for Education and Training, 2022a). A prerequisite for teachers to be able to adapt learning analytics to the distinctive nature of the subject, professional judgement and local conditions is that schools have a good overview of and information about the quality of the resources. Furthermore, access to learning analytics must be equal irrespective of which school the pupils attend. Teachers also need to be able to choose resources based on their suitability and not on whether the resources are part of larger licensed package solutions.

The Expert Group’s clear view is that teachers, school administrators and school owners are requesting a better and more quality-assured overview of what resources are available, what features they have, and to what extent they meet various pedagogical, legal and technical requirements. The Expert Group believes that a national service catalogue for digital learning resources is a good solution for offering such an overview in a number of areas and for stimulating equalising pricing models. We also believe that the grant schemes for the purchase and development of digital teaching aids are important drivers of free choice that should be further developed, and that financial measures aimed at testing and developing resources with learning analytics functionality should be established.

14.1.1 National service catalogue

A national service catalogue for digital learning resources can offer teachers, school administrators and school owners a better overview of the selection of digital resources suitable for use in schools, and increase free choice for individual teachers. Such a catalogue may include an overview and description of digital learning resources with functionality for learning analytics, information about available licenses, statistics and analysis of use, as well as assessments in relation to requirements for data protection, universal design and language variant.

The digitalisation strategy for kindergartens and schools for 2023–2030 states that the Norwegian Government will, in cooperation with KS, establish a publicly administered national service catalogue for digital teaching aids and consider including other digital solutions (Norwegian Ministry of Education and Research, 2023). We believe that the plan to establish a national service catalogue for digital teaching aids is a good starting point for supporting good and justifiable learning analytics in schools.

14.1.2 Pricing models

We have received a lot of comments from teachers, school administrators and school owners about the need for a more flexible pricing model than the current license-based models. Several municipalities have expressly stated a desire to pay for use to a greater extent in order to combine multiple digital teaching aids in the education (Høiseth-Gilje et al., 2022). The Expert Group believes that work should be initiated to investigate how it can become more attractive for suppliers to offer more flexible pricing models. It may also be relevant to investigate whether such pricing models can be linked to the national service catalogue.

Most digital teaching aids are license-based, with an annual price per pupil. This means that there is a relatively high threshold for utilising resources, especially if there are individual teachers who wish to familiarise themselves with the resource, or a few pupils who need a resource for a shorter period of time (KS, 2021). In many cases, it may be preferable to use parts of multiple resources instead of having full access to a few teaching aids for all pupils in the municipality or at the school. A license-based pricing model also entails greater supplier power than is the case for printed textbooks, since access to the teaching aid ceases if the agreement is terminated or expires.

Suppliers of large, comprehensive selections of digital teaching aids are favoured based on the current market structure (Oslo Economics, 2022). Key reasons for this are the procurement legislation and pricing models, as well as high switching costs if you change suppliers. In practice, this means that the large publishers dominate the market. The consequences of such dominance are that the threshold is high for smaller actors, and that established actors have lower incentives to invest in innovation and development. This is particularly relevant for learning analytics, as such functionality can be both costly and competence-intensive to develop, as it is often based on artificial intelligence or other complex technologies.

A further challenge with a licence-based pricing model is that the municipalities find it difficult to combine with grant schemes for digital teaching aids (Oslo Economics, 2022). The reason for this is that the grants are awarded for one year at a time, and several municipalities are sceptical about entering into agreements where they cannot maintain the licence without grant funds due to high switching costs.

In the project Activity Data for Assessment and Adaptivity, a pricing model is tested whereby the participating schools only pay for usage, not access (KS, 2021). An evaluation of the lessons learned from this project will be relevant in a continued investigation of a usage-based pricing model. Such a model requires, among other things, clarifications on how use is to be measured, what impact it may have on the market, and how it can be developed in line with the procurement legislation. Experience from the Activity Data for Assessment and Adaptivity project indicates that there is great potential in using a national service catalogue to enable more flexible access to digital teaching aids and digital solutions using new payment models (Norwegian Ministry of Education and Research, 2023).

The Expert Group believes that a usage-based pricing model will to a greater extent ensure free choice for schools, teachers and pupils when using resources with functionality for learning analytics, and that national authorities should facilitate this.

14.1.3 Grant schemes

The Norwegian learning technology sector is nascent, and we believe it is a state responsibility to contribute to the establishment of a market with fertile ground for both large and small suppliers that ensure innovation and diversity, and that are developed with Norwegian schools in mind. This is particularly important in order to prevent a school-oriented sector from developing based on purely commercial mechanisms. A lack of financial discretion among those who purchase teaching aids increases the use of advertising-financed resources where the payment is pupils’ personal data (ICT-Norway, 2023).

The grant scheme for the purchase of digital teaching aids is a measure under the initiative The Technological Backpack8. The Norwegian Directorate for Education and Training has administered the scheme the aim of which has been to give pupils and teachers better access to a multitude of high-quality digital teaching aids (Norwegian Directorate for Education and Training, 2022b). This procurement grant scheme was implemented over the course of four years (2019–2022). Over the four years, NOK 289 million was allocated, and when factoring in the municipalities’ own contributions, teaching aids were purchased in the amount of NOK 571 million during this period. More than 300 municipalities have been allocated funding. In other words, the scheme has resulted in a substantial injection of funds into the market.

In 2018, another grant scheme was launched to develop digital teaching aids for the introduction of a new National Curriculum. The framework for the grant scheme was NOK 23.75 million. The objective of the grant scheme was for the pupils to have access to a multitude of innovative, high-quality teaching aids that support differentiated instruction, and a broader range of digital teaching aids in Nynorsk and Sámi.

In the final report for The Technological Backpack and the Action Plan for Digitalisation, the Norwegian Directorate for Education and Training concludes that there continues to be a need for a government funding scheme for the purchase of teaching aids and that these should be adapted to a hybrid school model involving both digital and printed teaching aids. The Norwegian Directorate for Education and Training also finds that the procurement support scheme provided better access to digital teaching aids in addition to contributing to stimulating the market and the supply of teaching aids.

The Expert Group believes that both the grant schemes for developing and purchasing digital teaching aids should be maintained and further developed. This especially applies where there is no basis for commercial development, and to safeguard pupils who receive instruction in Sámi or Nynorsk. The scheme for development should stimulate innovative use of artificial intelligence (AI) and learning analytics functionality, but also set requirements for data protection and responsible use of AI in line with the recommendations in Chapter 13.

14.2 The Expert Group’s proposal for support for assessing pedagogical quality in learning analytics

For learning analytics to be useful, schools and teachers must have a basis for assessing the quality of the actual analysis and the data included therein. The Expert Group finds that suppliers need clearer information about what the learning analytics is based on, and that better provision should be made to provide specific guidance to schools in assessing the quality of resources with functionality for learning analytics. The need for information applies not only to resources with such functionality, but also to the resources that could conceivably provide data for learning analytics. Assessing the quality of learning analytics is always about having a conscious relationship with the data on which the analysis is based.

Quality is an imprecise and context-dependent term. In this context, we are seeking to identify aspects of the learning resources that concern how suitable they are for different purposes in the instruction. This involves pedagogical and didactic aspects, but also technical aspects such as data quality and user-friendliness. In terms of academic quality, this depends on whether the resource is a teaching aid with pre-defined academic content or a resource such as a communication platform or a pure analysis tool. For learning analytics concerning pupils’ academic progress, the connection to the National Curriculum is always relevant. For learning analytics built into resources without pre-defined academic content, the relationship to the National Curriculum may be more indirect, e.g., if the functionalities support the principles and values.

The school sector is an attractive market for suppliers of learning technology, and the marketing of such products often emphasises a major impact on pupils’ learning outcomes: “Technology actors have far too often set the agenda, often with discourses characterised by simple solutions and quick fixes of complex pedagogical issues” (Erstad, 2022, p. 318). By facilitating support for schools to assess quality, they will have a better basis for critically assessing resources.

14.2.1 Criteria for pedagogical quality in learning analytics

Assessments of pedagogical quality and suitability of resources with learning analytics functionality should be performed in as close proximity as possible to those who will be using the resources. Relevant criteria for quality related to learning analytics should nevertheless be developed centrally to provide good support in this assessment process.

The Norwegian Directorate for Education and Training has developed guidelines to support teachers, school administrators and school owners in assessing and selecting teaching aids.9 In its digitalisation strategy for schools, the Norwegian Government specifies that it wishes to further develop and disseminate this service (Norwegian Ministry of Education and Research, 2023).

The framework in the guides contains statements expressing favourable qualities of teaching aids within the categories relation to the National Curriculum, pedagogical and didactic quality and prototyping and design. They also list some general quality characteristics of digital teaching aids (Norwegian Directorate for Education and Training, 2021b, Chapter 3.4):

utilises the advantages that digital platforms can provide
has a large repertoire of learning content and working methods
makes it easier for the pupil to use additional senses
safeguards the pupil’s privacy (if the teaching aid generates pupil data, it accounts for what data are collected, for what purpose, and who has access to the data)
has technological solutions that are based on a learning perspective that is in line with the values of the curriculum

The knowledge base for the guides emphasises that learning analytics reinforces the need to assess whether the teaching aids are based on a pupil and learning perspective that is in line with the intentions and values of the National Curriculum (Norwegian Directorate for Education and Training, 2021b).

The Expert Group believes that the content of this material constitutes a good framework for quality assessment, and that explicit criteria for quality in learning analytics should be included. However, we recognise that this measure is non-binding and assumes that the schools choose to avail themselves of it. In order to increase user-friendliness, support and accessibility, a good measure may be to incorporate the guides into a national service catalogue.

We also believe the quality criteria can be used by developers and suppliers to ensure that the resources offered to schools are in line with expectations for quality.

14.2.2 Sufficient information to assess pedagogical quality

Learning analytics is often based on processes and metrics that can be difficult for users to understand. This means that it is difficult for schools and teachers to decide whether the resource supports the values and objectives of the National Curriculum. Many digital teaching aids rely on simple behaviourist principles and individualisation of learning, without this necessarily being clearly stated (Erstad, 2022). In order for users to gain insight into the pedagogical standpoint embedded in the resource, the providers of learning materials must make available sufficient information about how content and functionality support teaching and learning. The main purpose of the information shall be to provide users with good prerequisites for assessing the pedagogical quality and suitability of the resource.

Such information aimed at users can be based on the principles behind explainable artificial intelligence10, which is about creating the conditions for understanding the algorithms on which artificial intelligence is based. This does not mean publishing or providing full insight into the code behind the algorithms or data sets, but rather shedding light on which data have had an impact on the analysis, and how important the various elements have been (Norwegian Ministry of Local Government and Modernisation, 2020). Suppliers must also be able to document that the technical specifications in the solutions correspond to the user-oriented information. These specifications will include more detailed information on data types and analytical methods.

There are many actors in the Norwegian market today who refer to their products as “analysis of learning”, “insight into the pupil’s learning”, “overview of what pupils have understood”, “overview of academic progress” and similar wording, without offering sufficient evidence for such claims (Egelandsdal et al., 2019). To remedy this, the Expert Group believes that the suppliers must justify the solutions they have chosen and explain how these solutions actually work.

The Expert Group believes that suppliers must be required to make such information available in order for resources with learning analytics functionality to be suitable for use in schools. Such information may also be required to be included in a national service catalogue. We stress that user-oriented information from suppliers must be adapted to the various target groups. For example, we believe it is unfortunate if the term learning analytics, which is poorly and diversely understood in the school sector, is used aggressively by suppliers of learning technology in their marketing.

14.3 The Expert Group’s proposal on competence development in good learning analytics

In order to use digital resources in ways that contribute to increased adaptation, documentation or variation in teaching, the teacher must become familiar with the academic and technical aspects of the digital resources. This requires a high level of didactic competence in addition to good digital competence and the ability to critically assess each tool.

In the first interim report, we describe how teachers are dependent on being able to critically assess all academic and pedagogical factors, and that they must have sufficient analytical competence to interpret pupil data and analysis representations. They must be able to make assessments about ethics and have a practical understanding of data protection and have the competence to support the pupils in interpreting analyses of their own learning. Comments we have received emphasise that it is important that teachers are enabled to assess the functionality and supporting data in the individual teaching aid, so that they can assess what a teaching aid tells us about the pupils’ academic level (Union of Education Norway, 2022).

14.3.1 Areas of competence for teachers

Competence in learning analytics is based the teacher’s professional digital competence11 and their academic and didactic competence. The new competence requirements that learning analytics entails can mainly be linked to the competence areas of critical appraisal, ethics and data protection, and analytical competence.

Critical appraisal

Teachers must be able to critically appraise the academic and pedagogical guidelines embedded in learning analytics. This first and foremost presupposes that information about these guidelines is available in the resource, but it also requires some technological competence and understanding of, among other things, how algorithms work and what kind of data are included in the analyses. It is necessary for teachers to be able to ask critical questions about how learning analytics supports the breadth of subjects and the variety of working methods for the pupils. This competence is also key to being able to guide the pupils in utilising feedback from learning analytics regarding them.

Ethics and data protection

Educators must have competence in ethics and practical data protection to determine the appropriate course of action based on the analysed data. The ethical competence related to learning analytics is based on the teachers’ professional ethics and integrity. They must also be familiar with the legislation governing learning analytics. The Expert Group believes it is particularly relevant for teachers to have a good practical understanding of the data protection principles, so that they have applicable knowledge to safeguard the pupils’ privacy at school. An example of an ethical and data protection challenge is that the distinction between school and home becomes blurred in digital learning environments. This must be addressed by teachers with a high degree of ethical awareness.

Analytical competence

Learning analytics provides teachers with different types of performance representations. These representations are often presented in the form of a visualisation, recommendation or report. It is important that teachers have relevant competence in order to understand the underpinning for the representation, and to be able to determine the significance of what the representation shows. This is part of what many refer to as analytical competence12, which in short is the ability to explore, understand and use data in meaningful ways. Such competence is key to assessing and translating analytical representation into pedagogical practice, and is highlighted as a core competency for teachers (Sampson et al., 2022).

14.3.2 Schemes for competence development among teachers

There are various schemes for competence development that can help enable teachers to include learning analytics in their practice in a suitable manner. We have chosen to describe three options for competence development, which are neither intended exhaustively nor are they mutually exclusive.

Basic education

Section 2 of the Regulations relating to the Framework Plan for primary and lower secondary teacher training on learning outcomes states that the candidate shall have professional digital competence.13 Similarly, section 2 of the Regulations relating to graduate teacher training states that the candidate shall be able to use digital tools in teaching, planning and communication.14 These provisions can be interpreted as including competence in learning analytics. However, there is a need to clarify this in the competence descriptions.

Supplementary and continuing education programmes

A wide range of supplementary and continuing education programmes are offered to teachers. The continuing education programmes are credit-conferring programmes, while the supplementary education programmes are competence-raising schemes that do not confer credits. Learning analytics is a relevant area of competence for such programmes, e.g., in connection with professional digital competence.

Competence packages

Competence packages are brief, independent courses and structured learning resources that teachers, school administrators and other target groups can use for self-development. The Norwegian Directorate for Education and Training has developed competence packages for teachers in various topics.15 This offer already includes a competence package for artificial intelligence in schools, but this package does not currently specifically address learning analytics.

14.4 The Expert Group’s assessments

The Expert Group believes there is a considerable need to develop clear frameworks for good learning analytics in primary and secondary education and training. Currently, large volumes of pupil data are collected and analysed without a clear purpose, and such frameworks can contribute to clarifying what kinds of data are needed and how to use the analyses to enhance learning. We stress that the purpose of the frameworks for good learning analytics is to increase and support the teacher’s scope of action, not to restrict it.

The Expert Group considers the planned national service catalogue for digital teaching aids to be a suitable instrument for establishing frameworks for good learning analytics. A national service catalogue provides a structure that furnishes schools with a necessary inventory of resources with learning analytics functionality. In addition, the Expert Group believes that the structure of the service catalogue can be utilised to establish a support system for assessing quality in learning analytics, and to facilitate a usage-based pricing model.

The Expert Group notes that a support system for assessing quality is not intended to serve as a national approval scheme for teaching aids. Such a scheme existed in Norway until the year 2000, but it was repealed in part based on grounds of safeguarding teachers’ free choice (Norwegian Directorate for Education and Training, 2021b). However, today’s market for teaching aids is different compared to when this scheme was abolished, and the need for centralised support to assess quality and suitability has grown.

The Expert Group finds that there is a need to develop competence development programmes for teachers and school administrators on learning analytics. We emphasise that expectations as to what kind of competence teachers should develop must be reasonable in relation to the profession. For instance, technological competence at an advanced level and complex data protection assessments must be managed at other levels in the sector. The design of the digital resources must also build on the current competence situation and practice.

14.5 The Expert Group’s recommendations

The Expert Group recommends that national authorities facilitate usage-based pricing models for digital teaching aids, and that a study be initiated on how trials involving usage-based pricing models can be scaled up.
The Expert Group recommends that the national service catalogue for digital learning resources supports good learning analytics in schools.
The Expert Group recommends that centrally defined quality criteria be developed for resources that have functionality for learning analytics. It is teachers, school administrators, school owners and developers who will use these quality criteria. The criteria can build on existing guidelines for assessing the quality of teaching aids.
The Expert Group recommends that suppliers and developers cooperate on using and further developing the quality criteria so that they offer guidance for product development.
The Expert Group recommends that suppliers be required to make available user-oriented information that justifies and explains how the resources work. Suppliers must also be able to document that the technical specifications in the resources correspond to the user-oriented information.
The Expert Group recommends a grant scheme for purchasing and developing digital teaching aids that have functionality for learning analytics. The grant scheme should stimulate innovative learning analytics functionality and artificial intelligence (AI), and must set requirements for data protection and responsible use of AI. Resources must also be required to comply with centrally defined quality criteria.
The Expert Group recommends that funding be announced for innovation, research and development of digital learning resources that have functionality for learning analytics and adaptivity, and funding for research on the use of such resources in authentic learning situations.
The Expert Group recommends measures aimed at student teachers, teachers, school administrators and school owners, so that they can develop competence in learning analytics. Competence in learning analytics and knowledge of artificial intelligence should be included in both basic education and supplementary and continuing education programmes.
The Expert Group recommends that school owners ensure that pupils receive adapted and comprehensible information so that they can consider issues relating to learning analytics. Furthermore, it is recommended that school owners regularly evaluate whether pupils experience that the school is safeguarding their right to participation.

15 Guidelines for good and justifiable learning analytics in higher education and tertiary vocational education

Good and justifiable learning analytics in higher education and tertiary vocational education can contribute to promoting student learning. Learning analytics is a new and complex field in university colleges, universities and vocational colleges.

The Expert Group’s perception is that there is great uncertainty in higher education and tertiary vocational education regarding the processing of personal data in learning analytics. There is also uncertainty as to what the pedagogical benefits of learning analytics might be. Consequently, there is a need to support and guide educational institutions in how learning analytics can contribute to improving study programmes in a way that safeguards students’ privacy.

The Expert Group is of the opinion that broad guidelines for good and justifiable learning analytics in higher education and tertiary vocational education should be developed. Educational institutions can then develop local guidelines based on their national counterparts. We also believe there is a need to develop guidance materials and competence development measures to support good practice and demonstrate the opportunities educational institutions have to use new tools to support student learning.

15.1 The need for guidelines for good and justifiable learning analytics

Higher education and tertiary vocational education are diverse sectors with considerable institutional autonomy. Broad common guidelines and clarifications of principle can nevertheless be of great benefit with respect to learning analytics. Both Sikt (2022) and Universities Norway (2023) have expressed a need for common guidance resources.

Ambiguous legal basis hinders initiatives and knowledge development

As the Expert Group shows in sections 10.4 and 10.5, the legal basis for processing personal data in learning analytics in higher education and tertiary vocational education is ambiguous. In order to familiarise oneself with the opportunities and challenges associated with learning analytics, it is necessary to explore learning analytics on a larger and smaller scale and gather experiences within secure frameworks. Uncertainty regarding what constitutes lawful and justifiable processing of personal data is currently an obstacle to exploring its potential and constitutes a significant barrier to learning analytics, especially in higher education: “An ambiguous legal basis for collecting data and conducting learning analytics prevents activities in this area from getting off the ground” (Sikt, 2022, p. 2).

New learning technology should be tested in realistic pedagogical practice in order for educational institutions to gain experience of opportunities and limitations. This is also true for learning analytics. Here, teachers and educational institutions should trial the existing opportunities they believe are relevant, and their experiences should be documented.

As shown in the overview of research on learning analytics in Chapter 3, few studies have been carried out in the context of ordinary pedagogical practice in Norway, probably because the scope of learning analytics is so limited. The knowledge acquired about learning analytics instead takes place under the auspices of individual teachers or in small-scale and targeted research projects where the researchers themselves often also introduce the technology and structure their teaching around the possibilities for systematically using student data. Experiences from these smaller projects rarely go beyond the research environments, and it is often unclear how transferrable the experiences are across different courses or programmes.

Clear frameworks and proposals for risk-reducing measures, especially with regard to data protection, will better facilitate testing of learning analytics in ways that can make useful contributions to quality assurance work, in the development of teaching practice and in support of students’ learning processes.

Guidelines complement regulatory legislation

In sections 10.4.4 and 10.5.3, the Expert Group shows that there is a need to clarify the legal basis for processing personal data in learning analytics in higher education and tertiary vocational education.

Even with a clearer legal basis, there will still be a clear need for guidelines, including to ensure adequate compliance and data protection practices. If a specification in the legislation allows for a more privacy-invasive processing of personal data in learning analytics than is currently the case, this will necessitate even greater requirements for justifiable frameworks surrounding practical use.

15.2 Three conditions for the guidelines

The Expert Group will highlight three conditions in order for the broad guidelines to fulfil their purpose. The first concerns the establishment of a common path for the sectors, while at the same time safeguarding institutional autonomy. Second, rapid technological development requires frequent updating of the guidelines, and finally the guidelines should cover all the learning analytics resources in use in higher education and tertiary vocational education. In other words, the guidelines should be flexible (to safeguard autonomy), dynamic (to accommodate change) and specific (to cover all resources used).

Common approach with local adaptation

Although the responsibility for good and justifiable learning analytics lies at the institutional level, a number of issues will be common to all educational institutions. It would therefore be appropriate to have a common approach for higher education and tertiary vocational education in line with the needs of the institutions, and with a strong degree of cooperation with and involvement on their part. It must also be possible to adapt the guidelines to local conditions.

Regular updating and evaluation

As the technology that enables learning analytics is rapidly evolving, it is difficult to predict what functionality and resources will be available in just a few years. Moreover, the variations in the pedagogical practice involving learning analytics are limited, which may change with increased experience. The guidelines must therefore be subject to regular revision and further development so that they are always relevant to the typical practice in the sectors. How learning analytics is carried out in university colleges, universities and vocational colleges should also be subject to evaluation, per se.

Encompassing all resources

Resources with functionality for learning analytics become available to educational institutions through procurement processes and self-development, either as joint services or at the institutional level. The guidelines should apply to all the different resources that can be used for learning analytics. Not least, they should also apply to resources that are openly available. The use of the latter entails a significant privacy risk, as ‘payment’ is usually made in the form of users’ personal data (NOU 2022: 11).

15.3 Examples of national and local guidelines

The UK and the Netherlands have developed common national guidelines for learning analytics in higher education (Sclater and Bailey, 2018; SURF, 2019). In the UK, a number of universities have adopted the national guidelines as their point of departure and developed local adaptations, including at Technological University Dublin16 and the University of Edinburgh17. The University of Aalto, Finland has also developed guidelines for learning analytics.18

At the University of Oslo, an inter-faculty working group has developed Learning analytics and quality in education at UiO: Proposal for a privacy policy, cf. Box 15.1. The Expert Group believes a good solution is to have working groups at the institutional level that can adapt the broad guidelines to local conditions. It is important that both employees and students are well represented in such working groups.

Textbox 15.1 Description of selected areas from the proposed privacy policy for learning analytics at the University of Oslo (Langford et al., 2022)

Data protection involves (1) personal data, aggregated and pseudonymised data, (2) students’ ethical rights, (3) processing in accordance with the right to privacy and (4) Article 5 of the GDPR on principles for the correct processing of personal data in line with the Regulation.

The legal basis in the GDPR and the principles of specific assessment concern (1) the basis for processing, where Article 6(1)(e) of the GDPR (“performance of a task carried out in the public interest or in the exercise of official authority”) is highlighted as the most relevant of the six principles, (2) the need to establish principles for determining whether Article 6(1)(e) constitutes a legal basis in specific contexts, (3) whether the legal obligations in the Universities and University Colleges Act are clear enough that Article 6(1)(c) (“compliance with a legal obligation to which the controller is subject”) may be used, (4) considerations when reusing data collected for another purpose, (5) requirements for privacy by design in systems with learning analytics functionality, and (6) requirements for data protection impact assessments.

Data subjects’ rights and participation concern (1) the right to information, (2) the right to rectification, (3) the right not to be subject to automated decision-making, including profiling, and (4) the right to object.

Student participation and teacher autonomy concern (1) the right of student bodies to be heard, (2) students’ right to information and reservations, (3) the implications of systematic quality assurance, including learning analytics, for instructors’ autonomy, and (4) how confidence in teachers should not be undermined by the results of the learning analytics.

Institutionalisation concerns (1) establishing a coordinated and comprehensive system for quality assurance and control of statutory requirements, ethical considerations and participation in learning analytics, (2) guidance to relevant actors on legal bases, (3) openness regarding what data are used, and (4) ensuring purposeful competence enhancement.

15.4 The Expert Group’s proposal for points in the guidelines

In this section, we will provide a brief, general description of five action points that we believe are particularly important to include in guidelines for learning analytics in higher education and tertiary vocational education:

data protection
participation
openness
free choice
procurements

15.4.1 Data protection

Learning analytics in higher education and tertiary vocational education will in most cases require the processing of personal data. In the context of quality assurance work, where data are often aggregated and processed in pseudonymised form, the data protection consequences are less significant. The right to privacy is regulated by the GDPR. However, procedures and measures must be established to ensure that this right is observed. We have identified the following four data protection principles that have proven to be particularly challenged in learning analytics and the use of artificial intelligence:

fairness
transparency
data minimisation
accuracy

In particular, the guidelines should set requirements that reduce the risk of breaches of these four principles and that are suitable for safeguarding the rights and freedoms of students.

Fairness

One of the prerequisites for ensuring fairness for students is that they are familiar with their rights to access, to rectify incorrect data and to erase data.

Transparency

The educational institution must facilitate openness and transparency regarding the processing of personal data. Such transparency implies

that there are comprehensible and adequate descriptions of what the individual resources actually do
that outlines of data flows and processing protocols are available19
that an explanation is given of how the algorithms in learning analytics weight different variables, how accurately the algorithm processes data and how reliable the result is
that it makes visible what and whence the information is collected, and how it is interpreted in the analysis
that an overview is provided of who has access to the collected data and can view the results of the analysis, and for which decisions the results are used.

Data minimisation

This principle concerns limiting the data that are collected and processed to what is necessary for the purpose of the learning analytics. A current challenge is that myriad data are collected about students’ digital activities the pedagogical value of which is unclear, e.g., regarding the time of day they log on to learning platforms and administrative systems. Technically, data minimisation can be ensured by, among other things, procedures for extracting data, filtering, various ways of anonymising data once the analysis has been performed, and barriers to linking to the collected data for other purposes.

Accuracy

To ensure accuracy in analyses, data sources may be required to undergo quality assurance and validation of relevance and validity prior to use in learning analytics. This increases the chance that the data included in the analyses are accurate. Without quality assurance and validation, there is a risk of bias in the analyses, which can be amplified if resources are used uncritically or fed flawed training data. Therefore, it will be relevant to require built-in regular testing for biases in the data material, the models or in the use of the algorithms. In addition, there may be a requirement to re-train the algorithms if the accuracy falls below a predetermined threshold.

15.4.2 Participation

Pursuant to Section 4-1 of the Universities and University Colleges Act, student bodies have the right to be heard in all matters concerning the students. This includes the use of students’ personal data in learning analytics. Regarding learning analytics, it is crucial that students can always trust that all analyses are conducted securely and responsibly, and that data are never used in other ways than as described in the purpose and legal basis.

Student participation is also important in order for students to be active participants in their own learning. Participation in learning analytics presupposes that students gain as thorough insight as possible into what data and analytical methods are used, and how they are used, so that they can benefit from the insight the analyses provide into their own learning and academic progress.

In their comments to the Expert Group, both the student unions and Universities Norway are specifically concerned with students’ involvement in learning analytics. The National Union of Students in Higher Vocational Education and Training in Norway (2022) is “very concerned with using the tool on the students’ terms, and actively facilitating good student participation in the processes associated with its use’ (p. 3). Universities Norway (2023) notes that “students must also be included when assessing the types of learning analytics that are needed and when, and therefore what types of data should be collected (p. 1).

The Expert Group notes that the guidelines for learning analytics must ensure that educational institutions can ensure students’ participation and information needs.

15.4.3 Openness

In order for students to be confident that the processing of personal data takes place in accordance with the stated purposes and according to the legal basis, they must have access to how it takes place. All this information should be public and easily accessible to students. The guidelines should therefore require educational institutions to state which data are collected from which sources, how they may be combined with other data, and what the data are specifically used for. It must be clear to students to what extent individual students can be identified based on the collected data, and who has access to these data. Students must be ensured access to all collected data about themselves if personal data and identifiable data are stored at the individual level. This follows from Chapter 3 of the GDPR on the rights of the data subject.

It should also be clear to students when collection takes place, and when they can use digital resources without being tracked at the individual level. There should be clear rules for when data about students can be collected. In conversations with the Expert Group, the National Union of Students in Norway and the Organisation of Norwegian Vocational Students have voiced students’ need to be able to distinguish between the student role and the role of private individual. This role is challenged by platformisation in higher education and tertiary vocational education as students and instructors have continuous access to each other and subject matter via the learning platforms. The student unions want both clear limitations on when data about them are collected and limitations on when they can receive notifications from the educational institutions’ systems. This can be done, e.g., by giving students the opportunity to regulate the times themselves or by placing restrictions on the system.

The Expert Group believes that it must be made clear in the guidelines what the students’ rights are, how they proceed to safeguard them, and how confidence can be instilled that the use of learning analytics takes place in accordance with the stated purpose and regulatory legislation.

15.4.4 Free choice

Educators have the freedom and responsibility to prepare the content and structure of instruction within the frameworks established by the institution. A key part of the role of an instructor is to assess which working and teaching methods are best suited for different courses. However, the decision as to which resources with learning analytics functionality should be available to all instructors at, for example, a vocational college, a department or a university, is subject to the institutional frameworks. The Expert Group believes that the guidelines drawn up for learning analytics must clarify how the trade-off between the two considerations is to be assessed at the educational institution. It is important to ensure that instructors have access to different resources, but also to safeguard their freedom and responsibility to independently prepare the content of the instruction.

It is also relevant to include in the guidelines what the scope of students’ free choice should be in terms of learning analytics. In this context, it is important to distinguish between different forms of learning analytics, as there is a difference between learning analytics with aggregated and pseudonymised data as a basis for quality assurance work on the one hand and individual follow-up of the learning process in the individual student on the other. The Expert Group believes that students’ free choice must be more comprehensively linked to the individual-oriented form of learning analytics, in that it may, e.g., be possible to opt out of the analysis of certain types of personal data. The degree of students’ free choice should also be linked to whether information about them is actually anonymised. This will contribute to confidence in learning analytics for students, without affecting the institution’s long-term quality assurance work.

15.4.5 Procurements

In input meetings with the Expert Group, representatives of the sectors have confirmed that the possibilities for learning analytics have not been specifically considered when purchasing resources that allow for such analyses. The foremost example of this is the learning platform Canvas, but it also applies to video platforms and other services. The learning analytics guidelines should support the sectors in developing learning analytics requirements for tender processes, where relevant. The requirements must be based on local academic discussions at the educational institutions regarding what kind of needs the instructors and educational institutions have, what types of analyses they want, and how learning analytics is intended to support learning processes and quality assurance work. There should also be requirements for privacy by design and information security in procurement processes.

15.5 The Expert Group’s proposal on the administration of the guidelines

Although the guidelines for good and justifiable learning analytics should have a common national path, they must correspond to local needs and the local academic profile. The Expert Group believes that the best solution is for the institutions to develop local guidelines based on their national counterparts. As technology changes rapidly, the national guidelines must be revised continuously, e.g., every five years. New statutory requirements may also necessitate a revision of the guidelines.

Relevant national actors to manage the development and administrative responsibilities are the Norwegian Agency for Shared Services in Education and Research (Sikt), the Norwegian Directorate for Higher Education and Skills, the interest group Universities Norway and the National Council for Tertiary Vocational Education:

The Norwegian Directorate for Higher Education and Skills has the overall national responsibility for administrative tasks in higher education and tertiary vocational education. The Norwegian Directorate for Higher Education and Skills shall have a strong legal professional environment in accordance with its assignment from the Norwegian Ministry of Education and Research and has the professional responsibility for information security and data protection. The Directorate is also responsible for implementing and following up the strategy for digital transformation in the university and university college sector, a strategy that encompasses many aspects relevant to learning analytics.
Sikt offers a range of services to the Norwegian knowledge sector with functionality and potential for learning analytics. Sikt is a resource environment in the areas of procurement, operations, data analysis and development of learning technology.
Universities Norway is a member organisation for Norwegian universities and university colleges. In its comments to the Expert Group, Universities Norway (2023) states that “if common guidelines or guides are to be prepared, the sector must be involved, e.g., via Universities Norway’s units” (p. 2). The strategic units20 are national coordination arenas for its member institutions.
The National Council for Tertiary Vocational Education is an advisory body appointed by the Norwegian Ministry of Education and Research. The Council is tasked with working on the further development of the tertiary vocational education sector and promoting cooperation between the sector and the working life. The Norwegian Directorate for Higher Education and Skills is the secretariat for the National Council for Tertiary Vocational Education.

15.6 The Expert Group’s proposal on competence development and guidance services

Learning Analytics uses different analysis and calculation methods to provide insight into student learning. In order to determine possibilities and limitations in specific contexts, there is a need for knowledge regarding how different methods and algorithms process data, and to be able to judge the results of such processing.

15.6.1 Competence development

In order to perform good and justifiable learning analytics, instructors must have sufficient insight into and understand the academic, pedagogical, ethical and technical aspects of the digital resources that facilitate learning analytics. This is part of the competence many refer to as analytical competence, which in short is the ability to explore, understand and use data in meaningful ways. This competence is highlighted as a core competency for instructors (Sampson et al., 2022). In the Expert Group’s first interim report, we describe how instructors must have sufficient analytical competence to interpret student data and analysis representations. They must be able to make assessments about ethics and practical data protection and have the competence to support students when interpreting analyses of their own learning. Developing students’ competence in learning analytics is part of the relevant subjects and courses at the educational institutions.

In reference to section 2-3 of the Academic Supervision Regulations, we find that pedagogical competence includes competence in utilising digital technology to enhance learning (NOKUT, 2020). Our assessment is that this also includes being able to actively and critically utilise the potential of learning analytics, including the necessary competence on data protection and ethical use of personal data.

Section 1-4, third paragraph of the Regulations concerning appointment and promotion to teaching and research posts21 refers to pedagogical competence requirements for a permanent position as førsteamanuensis (associate professor): “Completion of a separate programme (minimum 200 hours)/relevant courses and individual practical teaching, and acquired basic skills in planning, implementing, evaluating and developing teaching and supervision (basic competence for teaching and supervision at the university and university college level)”.

As a result of this competence requirement, institutions in higher education offer 200-hour courses in basic pedagogical competence. The Expert Group believes that competence in learning analytics should be systematically included in such training programmes and emphasise the possibility of better follow-up of students by means of learning analytics. We also believe that Universities Norway can contribute to coordinating this work nationally, e.g., through its guidelines for basic pedagogical competence in universities and university colleges22.

The Expert Group believes that it is necessary to investigate more closely how competence development in learning analytics can be ensured for instructors in tertiary vocational education.

In addition to incorporating learning analytics into general pedagogical competence, learning analytics should be included in various courses offered under the auspices of the educational institutions’ learning support units. The courses offered should be aimed at both instructors and different types of education administrators and support staff who assist instructors and who participate in quality assurance work.

15.6.2 Guidance Services

The Expert Group wishes to highlight relevant areas of learning analytics where there may be a need for various guidance services for the sectors:

good and user-friendly overviews of different types of supporting data available for learning analytics at the country’s educational institutions in different types of shared digital services, and of the types of analysis the services can perform. This should also include guidance on how educational institutions can legally share data with each other for quality assurance work.
guidance in drawing up guidelines at one’s own institution. An example of a similar guide can be found in Ireland.23
support system to assist educational institutions in preparing data protection impact assessments (DPIAs). This includes guidance for educational institutions, templates for data processor agreements and risk analyses, examples and information material.

Relevant actors for developing and administering such guidance services may be the Norwegian Directorate for Higher Education and Skills, Sikt, Universities Norway and the Norwegian Tertiary Vocational Education Council.

15.7 The Expert Group’s assessments

The Expert Group believes there is a considerable need to prepare broad guidelines for good and justifiable learning analytics in higher education and tertiary vocational education. Currently, learning analytics is mainly carried out for administrative purposes because uncertainties in the sectors regarding what is legal and justifiable stands in the way of learning analytics for more pedagogical purposes.

The Expert Group believes that it is crucial that questions regarding learning analytics are addressed on the basis of a comprehensive assessment of pedagogical, ethical, technological and legal considerations. Currently, all use of digital resources is often centrally regulated by institutions solely on legal grounds, and there are few guidelines for good pedagogical use. It is of course a basic premise that all processing of personal data should take place in accordance with the legislation, however, we believe that guidelines should also be drawn up that elaborate on what constitutes good learning analytics in pedagogical practice, so that technology can benefit students to a greater extent than is currently the case.

The Expert Group emphasises that the national, broad guidelines must be drawn up in close cooperation with the sectors, and that it is the responsibility of the institutions to make adaptations and develop local guidelines based on their national counterparts.

The Expert Group finds that there is a need to develop competence development programmes for instructors on learning analytics. It is natural to view this in the context of the training offered on basic pedagogical competence. The teacher and graduate teacher programmes have a special responsibility to ensure that their instructors have competence in learning analytics, since it is important that the students in these programmes acquire this competence through their education.

The Expert Group considers that there is a need for centralised guidance services that can support educational institutions in implementing risk analyses, data protection impact assessments (DPIAs) and data processor agreements in connection with procurement processes and system development projects.

15.8 The Expert Group’s recommendations

The Expert Group recommends that, in cooperation with the sectors, broad national guidelines for good and justifiable learning analytics be developed. It must be possible to adapt the national guidelines to local conditions. At a minimum, the guidelines should include the following action points:
- data protection
- participation
- openness
- free choice
- procurements
The Expert Group recommends that a government agency develop and administer the broad guidelines for good and justifiable learning analytics in close cooperation with sectoral actors such as Universities Norway and the National Council for Tertiary Vocational Education. The Expert Group emphasises that the responsibility for good and justifiable learning analytics lies with the institutions.
The Expert Group recommends that the broad guidelines be revised regularly in light of rapid technological developments and at least every five years.
The Expert Group recommends that the guidelines include common solutions, local resources and resources that are openly available online.
The Expert Group recommends that a government agency develop a support system to help educational institutions prepare risk analyses, data protection impact assessments (DPIAs) and data processor agreements. The government agency shall also assist educational institutions in connection with procurement processes and system development projects.
The Expert Group recommends that the guidelines account for what constitutes good learning analytics that promote student learning.
The Expert Group recommends that competence in learning analytics be included in training programmes for basic pedagogical competence in higher education and tertiary vocational education. In addition, the Expert Group recommends that learning analytics be included in various courses aimed at instructors, managers and support staff who assist instructors and who participate in quality assurance work.
The Expert Group recommends that teacher training ensures that newly qualified teachers possess the necessary competence in learning analytics and knowledge of artificial intelligence. The institutions must consider how they can ensure such competence in teaching and in learning outcome descriptions.
The Expert Group recommends that funding be announced for innovation, research and development of digital learning resources that have functionality for learning analytics and adaptivity, and funding for research on the use of such resources in authentic learning situations.
The Expert Group recommends that the institutions ensure that students receive adapted and comprehensible information so that they can consider issues relating to learning analytics. Furthermore, it is recommended that the institutions regularly evaluate whether students feel that the school is safeguarding their right to participation.

16 Financial and administrative consequences

The Expert Group recommends several measures that will have varying degrees of financial and administrative consequences. The recommendations pertain to the following action areas:

legal basis for learning analytics
code of conduct for data protection in primary and secondary education and training
frameworks for good learning analytics in primary and secondary education and training
guidelines for good and justifiable learning analytics in higher education and tertiary vocational education

The financial and administrative consequences of the Expert Group’s recommendations will depend on the design and scope of the measures that are decided to be implemented. Some measures entail changing administrative processes without significant additional financial costs, while other measures are assumed to be implemented through reprioritisation within current budgets.

Legal basis for learning analytics

The Expert Group recommends clarifying the legal basis for learning analytics in primary and secondary education and training, higher education and tertiary vocational education. The proposed amendments to the Education Act, the Universities and University Colleges Act and the Vocational Education Act, with regulations, are essentially a clarification of the current legislation and will not have significant financial or administrative consequences. The Expert Group believes that the Norwegian Ministry of Education and Research should be able to cover these costs under its current financial frameworks.

Code of conduct for data protection in primary and secondary education and training

One of the Expert Group’s recommendations is that a code of conduct be drawn up in cooperation with the sector to safeguard data protection and information security in primary and secondary education and training. Establishing this School Code of Conduct will entail developing and administering data protection requirements and national data impact assessments for resources with learning analytics functionality and preparing guidance materials for school owners, school administrators, teachers, pupils, parents, developers and suppliers. We also propose establishing a network for competence development and exchange of experience.

The financial and administrative consequences of this measure will depend on how the School Code of Conduct is designed and administered. The code of conduct for information security and data protection in the health and care sector is managed by a steering group with representatives from the health and care sector. The Norwegian Directorate of eHealth is the secretariat for the work of the steering group. A similar administrative arrangement and scope for the School Code of Conduct will probably require a secretariat composed of five full-time equivalent positions. Developing and regularly updating guidance materials for users in the school sector will require resources. So too will the outreach work and activities in the sector required through conferences and networks to establish and further develop the School Code of Conduct.

The Expert Group believes that, depending on the governance model (steering group, administration by a key actor or the establishment of a new body), the financial consequences will be in the range of NOK 10 million annually.

In the establishment phase, additional resources will have to be expected, as the development of national data protection impact assessments is groundbreaking work, and will require personnel resources and thorough processes in the early years.

Frameworks for good learning analytics in primary and secondary education and training

The Expert Group recommends that centrally defined quality criteria be developed for resources with functionality for learning analytics aimed at teachers, school administrators, school owners and developers. Measures for competence development in learning analytics aimed at student teachers, teachers, school administrators and school owners are recommended. The Expert Group recommends linking competence measures to ordinary schemes and instruments for basic education and supplementary and continuing education. Our assessment is therefore that the administrative and financial consequences of this undertaking will be small in relation to the overall scope of the current system.

The Expert Group recommends that national authorities establish a grant scheme to purchase and develop digital teaching aids with functionality for learning analytics. If this grant scheme is to stimulate innovative and responsible learning analytics and artificial intelligence, it must be of a certain size. We refer to the initiative The Technological Backpack where the goal was, among other things, to grant pupils access to good digital teaching aids. These measures were part of the digitalisation strategy Fremtid, fornyelse og digitalisering 2017–2021 [Future, renewal and digitalisation 2017–2021] for primary and secondary education and training]24. The Norwegian Government allocated NOK 450 million to the 5-year initiative.

The Expert Group believes the initiative involving a grant scheme to purchase and develop digital teaching aids needs to continue and be strengthened with functionality for learning analytics. We propose that such a grant scheme has a framework of NOK 100 million annually.

Guidelines for good and justifiable learning analytics in higher education and tertiary vocational education

The Expert Group recommends the development of broad national guidelines for good and justifiable learning analytics in higher education and tertiary vocational education. To ensure that the guidelines are implemented, a support system must be established to assist the educational institutions. Training must be offered to educators, managers and support staff who assist educators in the quality assurance work.

The support system shall also ensure that newly qualified teachers possess the necessary competence in learning analytics and knowledge of artificial intelligence. Developing such a support system will require financial and administrative resources and must be investigated further.

Research and development funding

The Expert Group recommends that innovation and R&D funding be announced for digital learning resources with functionality for learning analytics and adaptivity in primary and secondary education and training, higher education and tertiary vocational education. Funding shall encompass research on the use of such resources in authentic learning situations. We propose increasing allocations to existing research programmes (e.g., FINNUT) at the Research Council of Norway, where funding is earmarked for research on learning analytics. We propose an allocation of NOK 30 million per year for this measure.

Footnotes

See, e.g., section 32 of the Act relating to medical and health research (Health Research Act) and section 5-11 of the Act relating to tax administration (Tax Administration Act).

https://www.ehelse.no/normen

https://www.ks.no/fagomrader/digitalisering/felleslosninger/skolesec/

https://www.udir.no/regelverk-og-tilsyn/personvern-for-barnehage-og-skole/

https://www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/protokoll-over-behandlingsaktiviteter/

https://www.udir.no/kvalitet-og-kompetanse/laremidler/kvalitetskriterier-for-laremidler/https://www.udir.no/regelverk-og-tilsyn/personvern-for-barnehage-og-skole/veiledere/

https://www.ehelse.no/normen

https://www.udir.no/kvalitet-og-kompetanse/nasjonale-satsinger/den-teknologiske-skolesekken/

https://www.udir.no/kvalitet-og-kompetanse/laremidler/kvalitetskriterier-for-laremidler/

10.

Explainable AI.

11.

https://www.udir.no/kvalitet-og-kompetanse/profesjonsfaglig-digital-kompetanse/rammeverk-larerens-profesjonsfaglige-digitale-komp/

12.

Data Literacy.

13.

Regulations of 7 June 2016 No. 860 relating to the Framework Plan for primary and lower secondary teacher training for grades 1-7 and the Regulations of 7 June 2016 No. 861 relating to the Framework Plan for primary and lower secondary teacher training for grades 5-10

14.

Regulations of 18 March 2013 No. 288 relating to the Framework Plan for graduate teacher training for grades 8-13

15.

https://www.udir.no/kvalitet-og-kompetanse/kompetansepakker/

16.

https://www.tudublin.ie/media/website/explore/about-the-university/academic-affairs/quality-framework/blanch-qa/2MP46-Learning-Analytics-Policy-and-Strategy.pdf

17.

https://www.ed.ac.uk/files/atoms/files/learninganalyticspolicy.pdf

18.

https://www.aalto.fi/en/aalto-university/learning-analytics-policy-in-aalto-university

19.

https://www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/protokoll-over-behandlingsaktiviteter/

20.

https://www.uhr.no/strategiske-enheter/

21.

Regulations of 9 February 2006 No. 129 concerning appointment and promotion to teaching and research posts.

22.

https://www.uhr.no/temasider/karrierepolitikk-og-merittering/nasjonale-veiledende-retningslinjer-for-uh-pedagogisk-basiskompetanse/

23.

https://hub.teachingandlearning.ie/resource/developing-learning-analytics-policies-to-support-student-success/

24.

https://www.regjeringen.no/no/dokumenter/framtid-fornyelse-og-digitalisering/id2568347/

Next chapter

Previous chapter

Next chapter

Previous chapter

To front page

Go to the top

NOU 2023: 19

Learning: Lost in the Shuffle?— Use of pupil and student data to enhance learning

Part 3 The Expert Group’s recommendations and proposals

11 The objectives of the Expert Group’s recommendations

11.1 Safeguarding trust in the education sector

11.2 Risk reduction

11.3 Developing good practice

11.4 Overview of the content of the recommendations

11.4.1 The Expert Group’s four main recommendations on learning analytics

12 Legal basis for learning analytics

12.1 Some broad challenges

The signalling effect – a clearer legal basis is not meant as an invitation

The legal basis must take account of a rapidly developing technology

More complexity in the legislation can result in less predictability

12.2 The Expert Group’s recommendations on the legal basis for learning analytics in primary and secondary education and training

12.2.1 Provision on the processing of personal data in learning analytics

The provision should describe the processing

Necessity

Justification

Specify the purposes of the processing

1) Insight into the pupils’ learning

2) Feedback and suggestions

3) Work on quality development

Establish additional criteria for processing personal data in learning analytics

12.2.2 The Expert Group’s proposal on the legal basis for learning analytics in primary and secondary education and training

12.3 The Expert Group’s recommendations on the legal basis for learning analytics in higher education

12.3.1 Provision on the processing of personal data in learning analytics

The provision should describe the processing

Necessity

Justification

Specify the purposes of the processing

1) Active learning

2) Student follow-up

3) Quality assurance work

12.3.2 Specification of the provision on quality assurance work

12.3.3 The Expert Group’s proposal on the legal basis for learning analytics in higher education

12.4 The Expert Group’s recommendations on the legal basis for learning analytics in tertiary vocational education

12.4.1 Provision on the processing of personal data in learning analytics

12.4.2 Specification of the provision on quality assurance work

12.4.3 The Expert Group’s proposal on the legal basis for learning analytics in tertiary vocational education

12.5 Summary of the Expert Group’s recommendations and proposals on the legal basis for learning analytics

Primary and secondary education and training

Higher education

Tertiary vocational education

13 Code of conduct for data protection in primary and secondary education and training (School Code of Conduct)

13.1 What is a data protection code of conduct?

13.2 The need for a code of conduct for data protection in schools

13.3 Three conditions for the School Code of Conduct

Building on existing work

License-based and open resources

Autonomous systems

13.4 The Expert Group’s proposal for content in the School Code of Conduct

13.4.1 Specific data protection requirements in resources that have functionality for learning analytics

Fairness

Transparency

Data minimisation

Accuracy

13.4.2 Guidance material for school owners, teachers, pupils, parents, developers and suppliers

13.4.3 National Data Protection Impact Assessments (DPIAs)

Textbox 13.1 Project on national assessment of data protection consequences1

Sharing of municipally prepared DPIAs

13.4.4 Facilitation of competence development and exchange of experience

13.5 The Expert Group’s proposal on management of and participation in the School Code of Conduct

13.5.1 Management and coordination responsibility for the School Code of Conduct

Governance model

Coordination

13.5.2 Support for the School Code of Conduct

13.6 The Expert Group’s assessments

13.7 The Expert Group’s recommendations

14 Frameworks for good learning analytics in primary and secondary education and training

14.1 The Expert Group’s proposals for measures to increase free choice and equal access to learning analytics

14.1.1 National service catalogue

14.1.2 Pricing models

14.1.3 Grant schemes

14.2 The Expert Group’s proposal for support for assessing pedagogical quality in learning analytics

14.2.1 Criteria for pedagogical quality in learning analytics

14.2.2 Sufficient information to assess pedagogical quality

14.3 The Expert Group’s proposal on competence development in good learning analytics

14.3.1 Areas of competence for teachers

Critical appraisal

Part 3
The Expert Group’s recommendations and proposals

Textbox 13.1 Project on national assessment of data protection consequences¹