The background material compiles the knowledge base for AI recommendations and supports education providers and teachers in developing AI competence and utilizing AI locally.

The background material covers various themes and should be used as a whole.

The party responsible for deciding what kinds of digital services are used locally in education is the education provider. These digital services include various systems and applications utilising AI (hereinafter “AI systems”). It is important to note that the development, training and use of such AI systems usually require some degree of processing of the personal data of the education provider's staff and/or children and students. Personal data are all data relating to an identified or identifiable person. These include the names and contact information of persons and information related to students’ studies (including information on decisions issued to students, assessments and absences). It is important to note that the concept of personal data is broad and covers things such as images and the voice of the learner (such as speech or singing) when the image or voice can be linked to the learner. AI systems may also collect a wide range of data on their users and the use of the system (including through monitoring technologies), which are classified as personal data.

The key obligations of and requirements for education providers concerning the processing of personal data are laid down in the EU General Data Protection Regulation (2016/679) and the national Data Protection Act (1050/2018) that supplements it. Education providers are required to maintain written documentation proving their compliance with the obligations.

Back to top

The education provider is responsible for ensuring that the AI systems used in its operations meet the requirements imposed by data protection legislation if the use of the systems involves the processing of personal data. The compliance of such systems must always be assessed before their deployment. This is usually done during the planning of the procurement of an AI system by the education provider. The compliance assessment must be followed up and updated, as necessary. The system must comply with legislation until it is decommissioned. Education providers should therefore plan and prepare in advance operating instructions on how various AI systems can be deployed, how their compliance is ensured and how the process is reliably documented. When planning this process, education providers should take into account that there may be significant differences between AI systems as regards the processing of personal data. The level and complexity of automation of the technologies used in these systems may also vary significantly.  As such, it is important to reserve a sufficient amount of time to assess AI systems and to ensure that those participating in the assessment possess sufficient expertise in data protection and the AI system being assessed. 

When drawing up operating instructions, education providers should take into account that a general assessment of compliance with data protection legislation may not necessarily be sufficient in all situations.  This is because in certain situations, education providers are obliged to carry out a standardised data protection impact assessment before the deployment of an AI system. According to the General Data Protection Regulation, a data protection impact assessment is mandatory when planning the processing of personal data that is likely to result in a high risk to the rights and freedoms of natural persons. This may be the case when planning the large-scale processing of personal data and/or the processing of personal data on vulnerable persons, such as children. As a result, the threshold for carrying out a data protection impact assessment is usually easily met in education, although the emergence of a high risk must always be assessed on a case-by-case basis.    

The purpose of the data protection impact assessment is to ensure that the planned processing of personal data complies with legislation, that the associated risks have been identified and that the risks are at an acceptable level. The risks may vary greatly depending on the type of AI included in the system being assessed. The impact assessment also ensures that the education provider has taken adequate measures to reduce and/or eliminate risks. The impact assessment may also end up indicating that the education provider must request prior consultation from the supervisory authority, meaning the Data Protection Ombudsman, before the AI system can be deployed.  

If the education provider concludes based on either a general assessment or a data protection impact assessment that the processing of personal data carried out by the AI system does not comply with data protection legislation and that the system cannot be made compliant (by limiting the features of the system, for example), the AI system cannot be deployed.

The obligations imposed by data protection legislation and the preparation, content and prior consultation of impact assessments are covered in greater detail in the Finnish National Agency for Education’s data protection guide (in Finnish). The guide also provides information on document templates that can be used in the impact assessments. The templates can be useful for assessing data protection obligations even in cases where the data protection impact assessment is not mandatory. 

Back to top

From the perspective of the education provider, the deployment of an AI system is a procurement that may be subject to procurement legislation and local procurement instructions. It is therefore important for the education provider to ensure that the assessments mentioned in paragraph 5.2 can be carried out sufficiently early as part of the procurement planning.    

It is also important to note that although the procurement procedure for an AI system depends on the total value of the procurement, data protection legislation applies in full to all AI systems that process personal data. The education provider must therefore assess the compliance of the AI system with data protection legislation even if the system does not need to be subject to competitive tendering due to its low price or being free of charge.    

The education provider may need to test AI systems in the context of a project or pilot period, for example. However, data protection legislation does not include any exceptions for projects or pilots. As a result, the compliance of an AI system must be assessed even if it is only used for an individual project or pilot.

The education provider is responsible for the compliance of the AI systems that the education provider has procured for use in education and on the education provider's devices. The party responsible for the use of a learner’s personal device and its data protection is the learner or, if the learner is under the age of 15, their guardian.

Back to top