Four pathways
There are four recommended routes to approve the use of a technology for a particular purpose. It is not the technology itself that determines the pathway, but the purpose for which it is to be used. As such, the same technology may be assessed under more than one pathway for different purposes.
So, the purpose must first be defined, as this will determine the pathway based on whether the university is considered to be acting as a controller or processor of personal data, or not.
Pathway 1
If all students are required or expected to use the same technology in order to meet course requirements:
- The technology needs to be thoroughly assessed and approved for compliance with GDPR, university policies and standards; and
- The university will need to enter a contractual arrangement with the service provider as they will act as a processor of personal data on behalf of the university.
Pathway 2
If any students are expected or encouraged to use the technology in order to meet subject-specific or associated professional expectations:
- The technology needs to be evaluated for compliance with GDPR, university policies and standards; and
- Prior to enrolment, course documentation must explain clearly:
- if there is any relationship between the technology service provider and the university, including whether the university has any influence or control over the ways in which the technology handles users’ personal data;
- how the student may be expected to engage with the technology as part of the course; and
- the student’s rights and responsibilities in relation to their use of the technology, including options and implications of participation or non-participation.
Pathway 3
If all students are required or expected to participate in a regular or sustained digital activity such as blogging, group project communications, or curating a portfolio, there must be an appropriate technology approved for this purpose under pathway 1 or 2.
However, the student may choose to use an alternative technology provided that they do so in accordance with the six principles.
Pathway 4
If there is an opportunity to engage with externally hosted technologies, but an internal alternative would not be possible e.g. use social media to participate in an event, or experiment with a teaching approach, this is possible on an occasional basis in accordance with the six principles.
The pathways are intended as a guideline for institutions to assess and adapt to reflect their policies and operational context.
