Member

44: After Clause 92, insert the following new Clause— “Code of practice on Children's Data and Education(1) The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on the processing of data in connection with the provision of education.(2) Guidance under subsection (1) must include consideration of—(a) all aspects of the provision of education including learning, school management and safeguarding;(b) all types of schools and learning settings;(c) the need for transparency and evidence of efficacy on the use of AI systems in the provision of education;(d) the impact of profiling and automated decision-making on children’s access to education opportunities;(e) the principle that children have a right to know what data about them is being generated, collected, processed, stored and shared;(f) the principle that those with parental responsibility have a right to know how their children's data is being generated, collected, processed, stored and shared;(g) the safety and security of children’s data;(h) the need to ensure children's access to and use of counselling services and the exchange of information for safeguarding purposes are not restricted.(3) In preparing a code or amendments under this section, the Commissioner must have regard to—(a) the fact that children are entitled to a higher standard of protection than adults with regard to their personal data as set out in the UK GDPR, and the ICO’s Age Appropriate Design code;(b) the need to prioritise children's best interests and to uphold their rights under UN Convention on the Rights of the Child and General Comment 25;(c) the fact that children may require different protections at different ages and stages of development;(d) the need to support innovation to enhance UK children's education and learning opportunities, including facilitating testing of novel products and supporting the certification and the development of standards;(e) ensuring the benefits from product and service developed using UK children’s data accrue to the UK.(4) In preparing a code or amendments under this section, the Commissioner must consult with—(a) children,(b) educators,(c) parents,(d) persons who appear to the Commissioner to represent the interests of children,(e) the AI Safety Institute, and(f) the relevant Education department for each nation of the United Kingdom.(5) The Code applies to data processors and controllers that— (a) are providing education in school or other learning settings;(b) provide services or products in connection with the provision of education;(c) collect children's data whilst they are learning;(d) use education data, education data sets or pupil data to develop services and products;(e) build, train or operate AI systems and models that impact children’s learning experience or outcomes;(f) are public authorities that process education data, education data sets or pupil data.(6) The Commissioner must prepare a report, in consultation with the EdTech industry and other stakeholders set out in subsection (4), on the steps required to develop a certification scheme under Article 42 of the UK GDPR, to enable the industry to demonstrate the compliance of EdTech services and products with the UK GDPR, and conformity with this Code.(7) Where requested by an education service, evidence of compliance with this Code must be provided by relevant providers of commercial products and services in a manner that satisfies the education service's obligations under the Code.(8) In this section—“EdTech” means a service or product that digitise education functions including administration and management information systems, learning and assessment and safeguarding, including services or products used within school settings and at home on the recommendation, advice or instruction of a school;“education data” means personal data that forms part of an educational record.“education data sets” means anonymised or pseudonymised data sets that include Education Data or Pupil Data.“efficacy” means that the promised learning outcomes can be evidenced.“learning setting” means a place where children learn including schools, their home and extra-curricular learning services for example online and in-person tutors.“pupil data” means personal data about a child collected whilst they are learning which does not form part of an educational record.“safety and security” means that it has been adequately tested.“school” means an entity that provides education to children in the UK including early years providers, nursery schools, primary schools, secondary schools, sixth form colleges, city technology colleges, academies, free schools, faith schools, special schools, state boarding schools, and private schools.”Member's explanatory statement This amendment proposes a statutory Code of Practice on Children and Education to ensure that children benefit from heightened protections when their data is processed for purposes relating to education. Common standards across the sector will assist schools in procurement.