National Code of Practice on privacy and ethics for using education data
It is 2020, which means that the zone Secure and reliable use of education data will start organising the development of a national Code of Practice on privacy and ethics for education data. In this blog, you can read what a Code of Practice is, why it is a useful tool for accelerating the use of education data at higher education institutions, and which initiatives already exist.
What is a Code of Practice?
A Code of Practice is a set of norms, values and rules that direct how people in a particular professional group behave in the practice of their work. These guiding principles are drawn up in a variety of other sectors. For example, the municipalities of Amsterdam and Eindhoven have formulated principles which are now adopted by the Association of Netherlands Municipalities.
A Code of Practice is not an alternative to, or a replacement of, the General Data Protection Regulation (GDPR). A Code of Practice tailors the GDPR to the specific context: in our case, the responsible use of education data in higher education institutions in the Netherlands. The Code of Practice will provide an overview of aspects that a higher education institutions must meet to be able to work with education data in an ethical and privacy-friendly manner.
Why a Code of Practice?
When working with personal data, many questions arise. How do you ensure data collection is of added value and that the privacy of the students is respected? Are you going to work on the basis of legitimate interest or consent? If you are going to work on the basis of permission, how do you deal with students who do not give permission? How do you keep control over data when you use tools from commercial parties? How do you involve all stakeholders and when is communication transparent enough? These are just a few examples of relevant ethical and privacy considerations.
There are currently concerns about the (further) use of education data in the Netherlands. These concerns are partly due to a lack of clarity about the use of education data. For example, it is not always clear how the use of data takes place, for what purpose(s) this is done, what risks the users face, what measures have been taken to address them, and within what frameworks the use occurs. Because at the same time many stakeholders in the field of education see opportunities to use education data for improving education – substantive and business-related – there is a strong need for transparency: why do institutions want to do more with education data? What do they do with the data? And how do they do that?
Institutions themselves also do not want to start their experiments until thorough consideration has been given to protecting the rights and freedoms of students. But how do you make sure you don’t miss anything? A Code of Practice is a tool to provide the desired clarity. It forms a framework for, for example, designing experiments with new use of education data or testing the use of education data for educational policy.
We do not start from scratch
In recent years, several higher education institutions and SURF have worked on developing a Code of Practice, for example at VU Amsterdam. SURF has also developed privacy guidelines for education data. Many educational institutions are currently working on this or want to start with it. The theme has also been included in the Strategic Agenda of the Ministry of Education, Culture and Science. In the past year, the Education data zone has mapped these initiatives and analysed them extensively. We found that the lack of a national Code of Practice is an obstacle to accelerating the use of education data. That is why we believe there is enough of a foundation and urgency to take the step to a national Code of Practice.
We do not create the national Code of Practice Education data on our own. We consult with relevant institutions, umbrella organisations and other organisations and bring them together if necessary. The main goal is for the Code of Practice to help institutions to realise their ambitions concerning education data. An important precondition and condition for success is that the standard is widely supported.
We start with a preliminary investigation, making a description of the intended result. This is followed by a stakeholder analysis and a concrete action plan. To make the process as transparent as possible, we will keep you informed of our progress.
Do you have any questions or tips? Please contact Iris Huis in ‘t Veld (firstname.lastname@example.org).