Student data stays out of the model

This track is for teachers, lecturers, trainers and school or campus admin staff. Every day you hold very personal data: students' names and classes, test scores, behaviour notes, sick notes, scholarship details, even family stories you hear in meetings with parents. All of it is personal data, and most of it belongs to children.

This module starts with one simple rule: student data stays out of the model. The general AI tools you use in a browser or app run on the provider's servers, often abroad. Text you paste may be stored, read by the provider's staff for safety checks, or used to train models if the settings allow it. You cannot take back text that has been sent. So the most important decision happens before you press send.

Data you must not paste: students' full names or nicknames, student numbers, photos, per-student grades, behaviour notes and sanctions, physical and mental health conditions, special needs, economic and family circumstances, and private messages from parents. A combination of details can also reveal identity. The sentence a student whose father just died and whose grades dropped names nobody, but at your school everyone knows who it means.

There is a legal reason too. Law No. 27 of 2022 on Personal Data Protection binds every personal data controller, including schools and campuses, public or private. The law classes children's data as specific personal data (Article 4(2)(e)), like health and biometric data. Article 25 states that processing of children's personal data is carried out specially, and requires the consent of the child's parent and/or guardian in line with the laws and regulations. Pasting student notes into an AI tool is processing, and parents never agreed to their child's notes being sent to an AI provider.

Law No. 14 of 2008 on Public Information Disclosure applies to public bodies. Public schools and campuses are included. A private school or campus is included too if even part of its funds comes from the state or regional budget (for example BOS school operational funds), public donations or abroad (Article 1 point 3), so most private schools are public bodies as well. Ask your institution if unsure. The law also excepts information that would reveal personal secrets. Article 17(h) points 4 and 5 name evaluation results on a person's capability, intellect and ability recommendations, and personal records related to formal and non-formal education activities. So for public bodies, grades and student records are indeed treated as personal secrets, and any school would do well to treat them that way.

The good news is that almost all the help you need from AI requires no student data. To write questions, you only need the topic and level. To write feedback, you can give the patterns of mistakes that often appear. To analyse test results, you can give aggregate numbers per question. Per-student data stays in the school's system.

What about replacing names with codes, such as student A, student B? That is pseudonymisation: the data can still be linked back to the child by whoever holds the code list, or by anyone who knows the class. Pseudonymisation lowers the risk, but it is not permission to paste behaviour or health notes. Use codes only for things that are not sensitive, such as example sentences from work you have rewritten yourself. Counselling, health or family notes are never sent at all, with or without codes.

One more thing: an AI tool provided officially by your school or education office, with a data processing agreement, may have different rules. Follow your institution's policy, and if there is no policy yet, assume the strictest rule.