AI in education: the importance of transparency

When schools consider using AI-based tools and products, many experience the stages of intrigue, caution, optimism and concern. Sometimes one after the other – sometimes all in one!

Intrigue as to the capability of the software and whether it delivers the world on a plate as is seemingly often promised. Caution when thinking of the legal and regulatory risks, on top of the impact on students if things were to go wrong. Optimism when schools realise there are often ways of onboarding and using AI that are GDPR-compliant, and can genuinely help teachers focus more on the child at the end of it all.

But concern remains, and doubt can creep in. One nagging question that stays with headteachers and senior leadership: what will people think about it? Or more specifically, what will parents and carers or pupils themselves say?

A refresher – where might AI be used in schools?

To understand specific concerns and how transparency becomes front and centre, we need to remind ourselves how and in what situations schools are starting to use generative AI. Creation of lesson content (while this should still always be reviewed by teachers for accuracy and relevance) is usually fairly safe in a data protection context, as it should not require the input of personal data to produce the output. But there are many examples that do fall within scope of the UK GDPR, including:

• Use of EdTech providers supporting AI-based revision and homework solutions
• Report and email writing
• Providing tailored feedback to students on their work/progress
• Supporting the taking of meeting minutes and actions

Parent concern and school fear?

Bearing these potential uses in mind, apprehensive or otherwise negative reaction from pupils, parents and carers is of course possible. Previous DfE and DSIT (Department for Science, Innovation and Technology) research revealed that while AI is a “hot topic” among student and parent communities, overall understanding of the landscape does not currently run deep. The findings also suggested that while parents see that there are opportunities for AI to support teachers in their role, they are generally more hesitant around pupils engaging with AI tools directly. While this is all caveated by the realisation that opinions are ever-fluctuating as new information becomes available and the landscape evolves, it does show the “hearts and minds” challenge that the education sector – maybe more than any other – is facing in respect of AI-use.

This can all serve to temper a school’s initial excitement and enthusiasm for new use of generative AI to support their day-to-day activities. What will parents say when we tell them how we’re planning to deal with the minutes and actions for their Stage 2 complaint meeting? How will they react when they find out their child’s homework feedback is now AI-supported?

The temptation may then be not to engage with parent communities. Not wanting to “make a fuss” over something that should (in the school’s view) benefit a pupil’s attainment anyway. But this approach, both legally and morally, is not an option for education settings.

Transparency and data protection

Transparency, in respect of what personal data is to be processed and how the data will be handled, underpins the UK GDPR. It is one of the GDPR’s core principles, set out as early as Article 5: “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.” This is supported by recitals elsewhere in the legislation, as is the more prescriptive “right to be informed.”

In other words, if we are using generative AI to process peoples’ personal data, we need to let people know what we are doing before it starts happening. To comply with data protection law and to allow the most positive engagement with student and parent communities, schools should follow these steps:

• Tell pupils and parents what we are proposing to do with AI on a given initiative
• Tell them why we are proposing to do it (i.e. what we hope it will achieve and why it would be an improvement on the current way of doing things)
• Explain how it will actually work, i.e. what will the AI-based product do with the personal data and what outputs will it produce
• Often, it may also be appropriate to give them the opportunity to feed back on the proposals – it is possible parents may have some ideas that could help the school refine or improve the initiative, and shows we do care about their views and buy-in

This final point above on “consulting” with data subjects does not mean the education setting is giving parents or pupils a veto on an AI-supported initiative. The school, as the data controller, retains responsibility and accountability for the decisions made to process personal data (and the ways in which they do it). Rather, we are getting an understanding of how the initiative sits with them, and as well as taking on board parent/pupil views where appropriate, it gives the school a great opportunity to address any misconceptions there may be about the AI-based tool.

Wider benefits of transparency

Transparency on use of AI to handle student, staff and parent personal data has benefits beyond compliance with the letter of the law. Being open with data subjects about the setting’s application of Gen AI can improve trust and relationships between all stakeholders involved with the school. When people are assured we aren’t doing things covertly, and are instead committed to engaging and taking parents with us on these initiatives, the setting, over time, can reasonable expect fewer complaints and criticisms in this area.

Further, it is important to remember that most schools are subject to the Freedom of Information Act 2000, so the ability to hold back on AI transparency for any significant period of time is limited anyway, or removed entirely. Schools should also remember that consultation with data subjects (staff, students and parents) is embedded in the Data Protection Impact Assessment (DPIA) risk assessment process. DPIAs, as discussed in a previous article, are a legal requirement to complete whenever we’re proposing to onboard some form of AI that will be used to process personal data.

From whatever angle schools choose, transparency as to our AI-based activities in advance of the processing is always better than being forced to explain the situation to someone in the aftermath.

Adam Halsey is a Schools’ Data Protection Officer at Invicta Law.

Invicta Law, in partnership with EIS, provides a dedicated DPO Service for schools, offering practical advice on data protection, DPIAs and emerging issues such as the use of AI. Find out more about the EIS DPO Service.