The use of AI systems for educational purposes may lead to the processing of personal data of, for example, children, university students, persons with disabilities, persons in vocational training, lifelong learners, educators, or parents by a variety of actors, including national governments, public and private educational establishments, business enterprises such as providers of products or services, software developers and individuals such as teachers, legal guardians and peers. Processing a child’s personal data in educational settings has particular complexity due to the non-consensual setting, which may affect the freely given nature of consent, also considering that, as a general rule, children cannot enter into contracts.[1] The use of AI systems in the educational context therefore attracts consideration under Article 8 ECHR.

CM/Rec(2018)7, which provides “Guidelines to respect, protect and fulfil the rights of the child in the digital environment”, acknowledges that personal data can be processed to the benefit of children, but highlights that States should take measures to ensure that children’s personal data is processed fairly, lawfully, accurately and securely, for specific purposes and with the free, explicit, informed and unambiguous consent of the children and/or their parents, carer or legal representative, or in accordance with another legitimate basis laid down by law. The data minimisation principle should be respected, meaning that the personal data processing should be adequate, relevant and not excessive in relation to the purposes for which they are processed.[2]

States should ensure that the processing of special categories of data which are considered sensitive, should in all instances only be allowed where appropriate safeguards are enshrined in law. Profiling of children, which is any form of automated processing of personal data which consists of applying a “profile” to a child, particularly to take decisions concerning the child or to analyse or predict their personal preferences, behaviour and attitudes, should be prohibited by law. In exceptional circumstances, States may lift this restriction when it is in the best interests of the child or if there is an overriding public interest, on the condition that appropriate safeguards are provided for by law. Profiling must also be excluded with respect to young people and adults in educational contexts. AI system-based educational tools, such as real-time classroom analytics and student engagement tracking or proctoring AI that monitors students through facial recognition and behavioural tracking may interfere with the right to privacy. This concern extends not only to children but also to adult students and to educational staff subject to monitoring or performance assessment through similar technologies. Individuals should not be subjected to arbitrary or unlawful interference with their privacy. Any interference should be in accordance with the law, pursue a legitimate aim, be necessary in a democratic society and be proportionate to the legitimate aim pursued. Surveillance or interception measures may in particular heighten the risk of interference with the right to privacy and should be subject to effective, independent and impartial oversight.[3]