Transparency

The General Data Protection Regulation imposes specific requirements with which all those who process personal data must comply (see Articles 12, 13 and 14). These requirements include, among other things, that the data subject must be informed of the fact that personal data is being processed, how the personal data is processed and who the data controller is. This information must be easily accessible and must use clear and plain language. This especially applies to information provided to children.

The specific requirements for information that follow from the GDPR are considered minimum requirements. In some cases, it is necessary to provide additional information to comply with the fundamental principle of transparency, which was a topic for discussion in the AVT project.

Information adapted to users

It can sometimes be challenging to provide an intelligible explanation for how a system based on artificial intelligence processes personal data. For the AVT project, the age range of its users further complicates this situation. This system may potentially be used by children as young as six at one end of the range and by graduating pupils in upper secondary school at the other. The youngest children, especially, do not have the ability to understand how their privacy may be affected nor the ability to protect their own interests. Their parents must therefore also receive information, so that they can protect their children’s interests.

As data controllers, the municipalities are responsible for complying with this information obligation. Norway has 356 municipalities, all with different prerequisites for implementing a learning analytics system. For that reason, the partners involved in the AVT project want to prepare an information packet, which includes some general information about learning analytics. In this context, they have prepared draft templates of written and graphic material that municipalities may use in their information activities. In the sandbox, we evaluated this information material and discussed potential solutions for how this information can be adapted to suit the needs of the different user groups.

For compliance with the information obligation, it is important to keep the intended recipients in mind. We cannot always know in advance who the recipients of the information are, e.g. because the controller does not always know who the users of a service may be. The AVT project has the benefit of having a clearly defined group of users for the learning analytics system. Their challenge is the considerable range of ages and levels of development within this group. One central discussion in the sandbox was how the AVT project can provide information that is simple enough for the youngest pupils, while also meeting the information needs of older pupils and parents.

These sandbox discussions can be summarised as follows:

• Use a language that takes into account the youngest pupils – adults also appreciate information that is simple and easy to understand.
• All of the information required by law must be included, but not necessarily in the same place and at the same time. Adults and children alike can lose heart if the document or online article is too long. One guiding principle may be to not only focus on what the pupils/parents need to know, but to also take into account when they need this information.
• It could be beneficial to provide information in layers, where the most basic information is presented first, while at the same time, giving the reader an opportunity to read more detailed information on the various topics. Take care to ensure that important information is not “hidden away” if this approach is used.
• Consider whether it would be appropriate to provide (or repeat) information when the pupils are in a setting where the information in question is relevant, e.g. with the use of pop-up windows.
• Use different approaches – what works for one group may not necessarily work for another. The AVT project has included text, video and images in their information material, and feedback from data subjects indicate that different user groups respond differently to different formats.
• Be patient and do not underestimate the complexity and demanding nature of trying to understand how the learning analytics system works, as well as the purpose and consequences of implementing this type of system. This applies to both children and adults.

The AVT project will continue its work on issues related to the obligation to provide and need for information after the sandbox project is completed.

Explaining the system’s underlying logic

For automated decisionmaking systems subject to Article 22 of the Regulation, it follows expressly from the GDPR that the data controller must provide relevant information about, among other things, the system’s underlying logic. Whether it is necessary to provide information about this logic if the processing does not entail automated decisionmaking or profiling, should be assessed on a case-by-case basis, based on whether it is necessary to ensure fair and transparent processing.

As previously mentioned, the learning analytics system in the AVT project is a decision support system, not an automated decisionmaking system subject to Article 22 of the GDPR. In the sandbox, we have not concluded whether the AVT project is legally obligated to provide information about the underlying logic of the learning analytics system. We did, however, discuss the issue in light of the objective of the sandbox, which is to promote the development of ethical and responsible artificial intelligence. In this context, we discussed how explanations that provide users with increased insight into how the system works, could increase trust in the system, promote proper use of the system and uncover potential defects.

But how detailed should an explanation of the system be? Is it sufficient to simply provide a general explanation for how the system processes personal data in order to produce a result, or should a justification for every single recommendation made by the system also be provided? And how does one provide the youngest pupils with a meaningful explanation? This sandbox project does not offer any final or exhaustive conclusions on these issues, but we did discuss benefits, drawbacks and various alternatives for solutions.

For the youngest pupils, creativity is a must when it comes to explanations, and these explanations do not necessarily need to involve text. For example, the AVT project created an information video, which was presented to various stakeholders. The video was well liked by the children, but garnered mixed reviews from the adults. The children thought it explained the system in a straightforward way, but the adults found it did not include enough information. This illustrates firstly, how different the needs of different people are, and secondly, how difficult it can be to find the right level and quantity of information. The AVT project has also considered building a “dummy” version of the learning analytics system, which allows users to experiment with different variables. This way, users can see how information fed into the system affects the recommendations in turn made by the system. Visualisation is often quite effective at explaining advanced technology in a straightforward manner. One could have different user interfaces for different target groups, such as one user interface for the youngest pupils and another aimed at older pupils and parents.

A privacy policy is useful for providing general information about the processing of personal data by the system. As previously mentioned, we have also discussed whether individual justifications for the system’s recommendations should be provided. This would be information about how the system has arrived at the specific recommendation and the data this recommendation is based on. Individual justifications could be easily accessible by users, but do not necessarily have to be presented alongside the recommendation. There are many benefits to providing justifications for the system’s recommendations. If pupils and teachers gain a broader understanding of how the system works, it could increase their trust in the system. The justifications could also make teachers better able to truly assess the recommendations made by the system, thus mitigating the risk of some using the system as an automated decision-making system. Finally, justifications may help uncover flaws in the system.