[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog-article-privacy-enhancing-technologies-v-osviti":3},{"uuid":4,"title":5,"subtitle":6,"content":7,"preview":406,"date_published":412,"date_pinned":412,"img":413,"alias":414,"is_published":415,"is_pinned":416,"type":13,"category":417,"category_name":418,"category_alias":419,"background_color":420,"preview_icon":13,"category_value":421,"external_link":13},"a6e3a77c-5b2f-4900-9e37-fad44006a200","What Are PETs, and How Are Privacy-Enhancing Technologies Used in Education?","How to analyze learning with less personal data. We examine minimization, differential privacy, federated learning, and the limitations of these approaches.",{"type":8,"content":9},"doc",[10,18,23,31,36,41,47,52,57,63,68,73,79,84,89,95,107,112,118,123,128,134,147,152,158,163,176,182,195,200,206,211,216,222,227,232,238,243,248,254,259,264,270,275,280,286,291,296,302,307,312,318,331,336,341,347],{"type":11,"attrs":12,"content":14},"paragraph",{"align":13},null,[15],{"text":16,"type":17},"An instructional designer wants to know which lesson most often causes students to stop learning. To answer this, they are offered a table containing every participant's name, address, payments, messages, and detailed activity events. Some of this information does not help improve the lesson. It only increases the amount of information that must be stored, explained, and protected. Learning analytics begins by defining the question and the evidence needed, rather than accumulating everything that can technically be obtained.","text",{"type":11,"attrs":19,"content":20},{"align":13},[21],{"text":22,"type":17},"Privacy-enhancing technologies, or PETs, help limit information disclosure during computation, sharing, or publication of results. However, no technology's name proves that a particular dataset has become anonymous or that any analysis of it is justified. A school needs a clear relationship between the learning objective, the threat to people, the protection method, and the quality of the conclusion. The solution must remain useful for learning and verifiable by the team responsible for its use.",{"type":24,"attrs":25,"content":28},"heading",{"align":13,"level":26,"id":27},2,"heading_2_1",[29],{"text":30,"type":17},"Start with the Decision That Needs to Change",{"type":11,"attrs":32,"content":33},{"align":13},[34],{"text":35,"type":17},"Frame the question as a future action: ‘Should we divide an overly long practical assignment into two parts?’ This may require aggregated data on starts, completions, and transitions between stages. Private correspondence or precise geolocation generally does not explain the structure of this particular task. Check each field against its contribution to the decision. If the team cannot identify that contribution, postpone collection until there is a justified need and agreed conditions for use.",{"type":11,"attrs":37,"content":38},{"align":13},[39],{"text":40,"type":17},"Also determine what level of accuracy is sufficient. Reviewing a curriculum may require only a consistent difference between several large cohorts. Helping an individual student requires different data and different access. Do not combine these tasks in one universal table. Individual support and an overall report have different users, periods of relevance, and consequences of error. These differences indicate where aggregation is appropriate and where responsible work with an individual record is needed.",{"type":24,"attrs":42,"content":44},{"align":13,"level":26,"id":43},"heading_2_2",[45],{"text":46,"type":17},"Describe What Needs Protection and from Whom",{"type":11,"attrs":48,"content":49},{"align":13},[50],{"text":51,"type":17},"Risks do not arise only from external breaches. A colleague may recognize someone in a small group, a partner may combine a report with their own list, and a reader of public statistics may infer a sensitive characteristic through several successive queries. Identify the potential recipient, the additional information available to them, and the unwanted inference. For an online school, these are practical scenarios: revealing participation in a remedial course, a private request, or an individual learning difficulty.",{"type":11,"attrs":53,"content":54},{"align":13},[55],{"text":56,"type":17},"A useful threat description includes a trust boundary. Can the server performing the calculation be trusted? Does the provider see raw records? Does a partner receive only the result? One method may protect the transmission channel well while leaving all information available to the recipient. Another conceals individual input values but still permits inferences from the output. Without a defined boundary, these different properties can easily be mistaken for the same level of privacy.",{"type":24,"attrs":58,"content":60},{"align":13,"level":26,"id":59},"heading_2_3",[61],{"text":62,"type":17},"First Remove What Is Unnecessary",{"type":11,"attrs":64,"content":65},{"align":13},[66],{"text":67,"type":17},"The simplest way to reduce disclosure is to prevent unnecessary information from entering the analytics dataset at all. An agreed age category may sometimes suffice instead of a full date of birth; the duration of a stage may replace the exact time of every click. But the transformation must fit the task: an overly broad category may hide an accessibility problem the team wants to identify. Both sides need checking: reducing data and retaining the signal for a specific learning decision.",{"type":11,"attrs":69,"content":70},{"align":13},[71],{"text":72,"type":17},"Separate operational systems from the analytics copy. In the former, an instructor may need a name to give feedback; in the latter, a stable technical identifier may be needed to count repeat attempts. The mapping table should not automatically travel with the analytics. This is an organizational restriction, not proof of anonymity: someone can still be identified if the key or enough additional attributes are available. Such a copy should be described according to its actual properties.",{"type":24,"attrs":74,"content":76},{"align":13,"level":26,"id":75},"heading_2_4",[77],{"text":78,"type":17},"A Pseudonym Does Not Eliminate the Possibility of Identification",{"type":11,"attrs":80,"content":81},{"align":13},[82],{"text":83,"type":17},"Replacing a surname with a random code makes identification less obvious, but a rare combination of course, time, city, and result may single out a particular person. Small groups and free text are especially risky. A student may describe their own story in a way that removing the name changes little. Before sharing, analyze the possibility of linking records, not just the absence of a contacts column. This possibility may differ substantially between recipients.",{"type":11,"attrs":85,"content":86},{"align":13},[87],{"text":88,"type":17},"Do not publish small report cells merely because each contains a number. If one person is the only member of a category, their result may become obvious. Simply suppressing a cell does not always help: its value can sometimes be reconstructed from the total and neighboring rows. Review the entire table and related publications rather than an isolated screen that looks safe during a demonstration of a new report.",{"type":24,"attrs":90,"content":92},{"align":13,"level":26,"id":91},"heading_2_5",[93],{"text":94,"type":17},"Differential Privacy Requires a Defined Guarantee",{"type":11,"attrs":96,"content":97},{"align":13},[98,105],{"text":99,"type":17,"marks":100},"NIST SP 800-226",[101],{"type":102,"attrs":103},"link",{"href":104,"title":13},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F226\u002Ffinal",{"text":106,"type":17}," describes differential privacy as a mathematical framework for quantifying privacy loss. It allows reasoning about the effect of an individual's participation on a released result. In practice, this requires a precise mechanism, a definition of the protected unit, and analysis of the implementation. Simply adding random numbers to a table is not enough to substantiate such a guarantee. You need to know exactly what it covers and under which conditions.",{"type":11,"attrs":108,"content":109},{"align":13},[110],{"text":111,"type":17},"For educational statistics, it matters whether the protection covers one event, one record, or a student's entire history. A person with many activities may affect a dataset differently from someone with one record. Repeated statistical releases also have a cumulative effect. Ask a specialist to explain the parameters, contribution limits, and accounting for repeated disclosures in plain language. A report editor should understand the consequences of changing a filter, rather than merely see a badge in the interface.",{"type":24,"attrs":113,"content":115},{"align":13,"level":26,"id":114},"heading_2_6",[116],{"text":117,"type":17},"The Margin of Error Must Be Visible in the Decision",{"type":11,"attrs":119,"content":120},{"align":13},[121],{"text":122,"type":17},"A protective transformation may make small differences unsuitable for drawing conclusions. If two modules differ only slightly, applying the mechanism does not justify declaring one problematic solely because of its ranking. Show appropriate explanations of accuracy and comparison limits. When data are insufficient, combine periods or formulate a broader question. Collecting more private information merely to produce a neater ranking is a weak justification for changing learning analytics.",{"type":11,"attrs":124,"content":125},{"align":13},[126],{"text":127,"type":17},"Test utility on an agreed reference dataset. Compare whether the protected result leads to the same justified pedagogical action as the permitted baseline analysis. Do not require every number to match exactly if that is not the objective. For example, consistently identifying a major systemic barrier matters more than reproducing an individual attempt precisely. This criterion helps assess the technology through the decision for which the team is implementing it.",{"type":24,"attrs":129,"content":131},{"align":13,"level":26,"id":130},"heading_2_7",[132],{"text":133,"type":17},"Federated Learning Keeps Data Local but Does Not Eliminate Every Leak",{"type":11,"attrs":135,"content":136},{"align":13},[137,139,145],{"text":138,"type":17},"In a federated approach, participants can train a model on local data and share updates instead of centralized copies of records. This changes the sharing architecture, but the updates themselves also need protection. ",{"text":140,"type":17,"marks":141},"The official DSIT and ICO tool",[142],{"type":102,"attrs":143},{"href":144,"title":13},"https:\u002F\u002Fwww.gov.uk\u002Fgovernment\u002Fpublications\u002Fprivacy-enhancing-technologies-cost-benefit-awareness-tool\u002Fcost-benefit-awareness-tool",{"text":146,"type":17}," explains why federated learning may need additional PETs. A school must not confuse the storage location of raw data with a complete description of the information available to another party.",{"type":11,"attrs":148,"content":149},{"align":13},[150],{"text":151,"type":17},"This approach may be appropriate for collaboration between institutions if they share a clearly defined task. However, it adds requirements for local infrastructure, feature alignment, update quality, and maintenance. If every school interprets ‘completed course’ differently, a distributed model will inherit that inconsistency. First align the meaning of the data and test a simpler way to answer the question. Deployment complexity is justified only by a specific need and demonstrated advantages for the chosen use case.",{"type":24,"attrs":153,"content":155},{"align":13,"level":26,"id":154},"heading_2_8",[156],{"text":157,"type":17},"Synthetic Data Are Useful for Development but Need Assessment",{"type":11,"attrs":159,"content":160},{"align":13},[161],{"text":162,"type":17},"Artificially created records are convenient for training analysts, demonstrating interfaces, and testing error handling. Often the safest starting point for these tasks is a manually constructed set of fictional situations that does not reproduce real histories. If, however, a synthetic dataset is learned from real information, its properties need checking. Differences in how rows look do not prove that the model has not reproduced rare records or retained the possibility of inferring a participant's private characteristic.",{"type":11,"attrs":164,"content":165},{"align":13},[166,168,174],{"text":167,"type":17},"The ",{"text":169,"type":17,"marks":170},"ICO technical review",[171],{"type":102,"attrs":172},{"href":173,"title":13},"https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002Fartificial-intelligence\u002Fguidance-on-ai-and-data-protection\u002Fhow-should-we-assess-security-and-data-minimisation-in-ai\u002F",{"text":175,"type":17}," considers disclosure risks and utility trade-offs. For an educational example, also check the pattern of results: synthetic data may poorly represent the very rare difficulties that interest you. Testing an upload form does not require statistically accurate learning trajectories. Conversely, research into unequal access cannot be replaced by an attractive demonstration dataset without an appropriate justification of its suitability.",{"type":24,"attrs":177,"content":179},{"align":13,"level":26,"id":178},"heading_2_9",[180],{"text":181,"type":17},"Secure Computation Answers Specific Questions",{"type":11,"attrs":183,"content":184},{"align":13},[185,187,193],{"text":186,"type":17},"Homomorphic encryption and secure multiparty computation can restrict access to input values during agreed operations. A school does not have to implement a cryptographic protocol itself. However, it needs to understand which operations are supported, who receives the output, and which assumptions underpin the protection. ",{"text":188,"type":17,"marks":189},"The ICO overview of PETs",[190],{"type":102,"attrs":191},{"href":192,"title":13},"https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002Fdata-sharing\u002Fprivacy-enhancing-technologies\u002F",{"text":194,"type":17}," helps distinguish classes of technology. The final choice depends on the task, implementation, and trust model between participants.",{"type":11,"attrs":196,"content":197},{"align":13},[198],{"text":199,"type":17},"Even concealed inputs can produce an excessively detailed result. If a partner receives the average grade for a group of one student, protecting the computation itself does not conceal that grade. The architecture needs to be combined with rules for permitted outputs, the number of queries, and access to them. This is why choosing PETs should not be left solely to procurement or the technical department. The instructional designer identifies the necessary learning insight, and specialists verify how to obtain it with acceptable protective properties.",{"type":24,"attrs":201,"content":203},{"align":13,"level":26,"id":202},"heading_2_10",[204],{"text":205,"type":17},"Build a Pilot Around One Report",{"type":11,"attrs":207,"content":208},{"align":13},[209],{"text":210,"type":17},"Imagine a school that wants to compare difficulties in practical assignments across several large cohorts. The team defines the minimum fields: assignment code, generalized cohort, and whether an assignment was started and completed. Free-text responses and contact details are excluded. First, the team checks the meaning of statuses, missing events, and repeat attempts. It then chooses a protected presentation method suited to the future recipients. This is a hypothetical design scenario, not a description of a measured effect at a particular school.",{"type":11,"attrs":212,"content":213},{"align":13},[214],{"text":215,"type":17},"The instructional designer receives an answer identifying assignments that need review, with an explanation of error margins and limitations. For individual assistance, the student support coordinator works in their own authorized environment and does not try to reconstruct names from the overall report. Different roles receive different tools for different tasks. This separation simplifies acceptance of the result: the question is whether an exercise can be improved, not whether the report retained every possible detail about every learner and all their actions.",{"type":24,"attrs":217,"content":219},{"align":13,"level":26,"id":218},"heading_2_11",[220],{"text":221,"type":17},"Agree on the Analytics Copy's Lifecycle",{"type":11,"attrs":223,"content":224},{"align":13},[225],{"text":226,"type":17},"Define dataset creation, access, updates, archiving, and deletion separately. If a source record is corrected, an old copy may continue affecting a report. If a partner finishes their work, their access should not remain undefined. Technical documentation should link datasets to a purpose and a responsible person. This makes dependencies discoverable when a process changes, rather than relying on the memory of an employee who once exported a table for an experiment and passed it to another department.",{"type":11,"attrs":228,"content":229},{"align":13},[230],{"text":231,"type":17},"The WeStudy LMS platform can be part of organizing the learning process, while the analytics-copy policy should be formulated separately for the actual use case. Do not attribute a particular PET feature to a learning system without checking its documentation and implementation. Record which data actually leave the primary environment, where they go, and who uses them. This map helps distinguish pedagogical need from unnecessary information accumulation under the pretext of future analytical possibilities the team has not yet defined.",{"type":24,"attrs":233,"content":235},{"align":13,"level":26,"id":234},"heading_2_12",[236],{"text":237,"type":17},"Assess Providers Through Specific Guarantees",{"type":11,"attrs":239,"content":240},{"align":13},[241],{"text":242,"type":17},"Ask what ‘private analytics’ means in their proposal. Is there a technical description of the mechanism, a threat assessment, rules for repeated releases, and an independent review of the relevant implementation? Does the claimed property extend to logs, backups, and support? Answers must concern your configuration. A general company certification or a marketing reference to encryption does not replace an explanation of what each participant in this particular process sees and how risks change after outputs are exported.",{"type":11,"attrs":244,"content":245},{"align":13},[246],{"text":247,"type":17},"In the pilot, assess the costs of computation, data preparation, and interpreting the result. A protected report that instructors consistently misinterpret needs improvement. Add explanations of missing values, margins of error, and invalid comparisons. Check whether the analysis can be repeated after a data update and the reason for a decision reconstructed. Privacy and utility do not compete in the abstract: the team must find a specific combination that supports learning and limits unnecessary disclosure of information about people.",{"type":24,"attrs":249,"content":251},{"align":13,"level":26,"id":250},"heading_2_13",[252],{"text":253,"type":17},"Do Not Turn a Protected Report into a Judgment of a Person",{"type":11,"attrs":255,"content":256},{"align":13},[257],{"text":258,"type":17},"Suppose statistics show more unfinished exercises in a particular cohort. This is a signal to review conditions, not proof that its participants lack motivation. The cause may be a different timetable, unreliable access to equipment, missing instructions, or the recording method. Privacy protection does not correct a mistaken causal explanation. An analytical signal should be followed by pedagogical analysis that neither labels people based on one aggregated metric nor attributes a group's characteristic to every member.",{"type":11,"attrs":260,"content":261},{"align":13},[262],{"text":263,"type":17},"To investigate the cause, first review the exercise itself and the event-recording procedure. Perhaps the completion button is hard to find, or results from another service arrive late. In that case, increasing the amount of personal data will not provide the needed insight. It is much more useful to correct the event definition and repeat the comparison. An additional survey or other information collection should address a new, specific question, be proportionate to it, and have a use for the answers that participants understand.",{"type":24,"attrs":265,"content":267},{"align":13,"level":26,"id":266},"heading_2_14",[268],{"text":269,"type":17},"Prepare the Team to Read Results with Limitations",{"type":11,"attrs":271,"content":272},{"align":13},[273],{"text":274,"type":17},"An analyst must be able to say that the available dataset cannot answer a question. This is a professional result if accompanied by an appropriate next action: a wider time window, a different grouping, or a qualitative review of an assignment. Do not incentivize employees to identify a precise personal factor every time. Such an incentive encourages gradual expansion of a dataset even though the original objective concerned learning design. A report should support justified changes rather than demonstrate the school's omniscience about every student's behavior.",{"type":11,"attrs":276,"content":277},{"align":13},[278],{"text":279,"type":17},"During internal training, offer two versions of a table: one with exact numbers from fictional data, the other with a protective transformation and appropriate explanations. Ask instructional designers to choose an action and state their confidence level. If they interpret a slight fluctuation as an unambiguous ranking of instructors, the problem remains even if the technology is correct. Change the presentation, instructions, or the report's task itself until the team can distinguish a sufficient signal from an unstable difference between similar values.",{"type":24,"attrs":281,"content":283},{"align":13,"level":26,"id":282},"heading_2_15",[284],{"text":285,"type":17},"Monitor How the Dataset Develops After Launch",{"type":11,"attrs":287,"content":288},{"align":13},[289],{"text":290,"type":17},"A new filter may change the risk more than a new algorithm. A report previously showed a large cohort; now it allows a rare program, a narrow age category, and a short period to be selected simultaneously. Check every such extension against the original threat model. Define a process for approving filters and releases so an interface editor does not accidentally invalidate assumptions underpinning the technical guarantee. This particularly concerns the ability to download results or compare periods using an external spreadsheet.",{"type":11,"attrs":292,"content":293},{"align":13},[294],{"text":295,"type":17},"Keep the change description understandable for a future team. Record the date, reason, new fields, recipients, and findings of the utility and risk review. A short record allows the decision's reasoning to be reconstructed months later, when the original participants are working on other tasks. It also helps reveal accumulating exceptions: each seemed small on its own, but together they created a much more detailed profile than the original learning question required or the pilot agreement allowed.",{"type":24,"attrs":297,"content":299},{"align":13,"level":26,"id":298},"heading_2_16",[300],{"text":301,"type":17},"Distinguish External Publication from Internal Support",{"type":11,"attrs":303,"content":304},{"align":13},[305],{"text":306,"type":17},"A public article about course results has a different audience from a student support coordinator's private workspace. Before publication, review tables, examples, and illustrative stories together again. Sometimes a textual description allows someone to be recognized even though the chart itself is sufficiently aggregated. Ask an editor to check precisely this possibility of combining information. An internal analytics dataset should not automatically be transferred to a presentation, partner report, or advertisement simply because the figures have already been calculated and look convenient to display.",{"type":11,"attrs":308,"content":309},{"align":13},[310],{"text":311,"type":17},"Individual support, by contrast, requires a responsible person who can explain the context and correct inaccuracies. An overall protected report should not be the sole basis for restricting a student's access or drawing conclusions about their needs. Provide a clear way to raise errors in data or interpretation. This helps use analytics as a source of questions about the learning process while retaining the ability to account for circumstances that no aggregate metric fully describes.",{"type":24,"attrs":313,"content":315},{"align":13,"level":26,"id":314},"heading_2_17",[316],{"text":317,"type":17},"The Initial Result: A Smaller Dataset and a Clearer Question",{"type":11,"attrs":319,"content":320},{"align":13},[321,323,329],{"text":322,"type":17},"Begin by taking stock of one regular report. Remove fields without a defined purpose, check identification risks, and record the necessary accuracy. Only then compare technological options. ",{"text":324,"type":17,"marks":325},"NIST Privacy Framework",[326],{"type":102,"attrs":327},{"href":328,"title":13},"https:\u002F\u002Fwww.nist.gov\u002Fprivacy-framework",{"text":330,"type":17}," is useful as a broader framework for managing privacy risks; it does not replace technical assessment of a specific mechanism. A school should understand which decision it wants to make, who has access to it, and what might go wrong for learners.",{"type":11,"attrs":332,"content":333},{"align":13},[334],{"text":335,"type":17},"If the WeStudy LMS platform is used in a learning program, connect analytics to a specific improvement in a lesson, practice activity, or support. Retain a short description of the purpose, minimum dataset, protection method, and utility check. Review the result after changes to the data composition or recipients. Well-designed analytics lets a team see enough to act responsibly without turning every learning interaction into a reason to collect a detailed personal history unnecessary for the question at hand.",{"type":11,"attrs":337,"content":338},{"align":13},[339],{"text":340,"type":17},"For the first learning cycle, a small, completed practical solution is enough. The team should demonstrate which fields it removed, which threat it reduced, and how it checked that the report still helps review learning practice. If these three answers remain unclear, more complex technology will not solve the problem of task definition. Return to the question, decision owner, and conditions of result use before expanding the pilot to new courses, external partners, or more detailed types of participant information.",{"type":24,"attrs":342,"content":344},{"align":13,"level":26,"id":343},"heading_2_18",[345],{"text":346,"type":17},"Sources",{"type":348,"content":349},"bullet_list",[350,363,374,385,396],{"type":351,"content":352},"list_item",[353],{"type":11,"attrs":354,"content":355},{"align":13},[356,361],{"text":357,"type":17,"marks":358},"NIST SP 800-226: Guidelines for Evaluating Differential Privacy Guarantees",[359],{"type":102,"attrs":360},{"href":104,"title":13},{"text":362,"type":17},".",{"type":351,"content":364},[365],{"type":11,"attrs":366,"content":367},{"align":13},[368,373],{"text":369,"type":17,"marks":370},"ICO: Privacy-enhancing technologies",[371],{"type":102,"attrs":372},{"href":192,"title":13},{"text":362,"type":17},{"type":351,"content":375},[376],{"type":11,"attrs":377,"content":378},{"align":13},[379,384],{"text":380,"type":17,"marks":381},"DSIT and ICO: Cost-benefit awareness tool",[382],{"type":102,"attrs":383},{"href":144,"title":13},{"text":362,"type":17},{"type":351,"content":386},[387],{"type":11,"attrs":388,"content":389},{"align":13},[390,395],{"text":391,"type":17,"marks":392},"ICO: Security and data minimisation in AI",[393],{"type":102,"attrs":394},{"href":173,"title":13},{"text":362,"type":17},{"type":351,"content":397},[398],{"type":11,"attrs":399,"content":400},{"align":13},[401,405],{"text":324,"type":17,"marks":402},[403],{"type":102,"attrs":404},{"href":328,"title":13},{"text":362,"type":17},{"type":8,"content":407},[408],{"type":11,"content":409},[410],{"text":411,"type":17},"How to choose privacy-enhancing technologies for learning analytics: from data minimization to differential privacy and federated learning.",1790926009,"https:\u002F\u002Fcloud.cs3.westudy.ua\u002Ffile?path=westudy_online%2Fpublic%2Fwestudy%2F85e51f0f-32e6-447c-a25e-78434128b4f7.webp","privacy-enhancing-technologies-v-osviti",true,false,"8aadcfd0-a55b-4965-a1ce-84f390be3859","EdTech та цифрові технології","EdTech_westudy","light","news.articles"]