The Privacy Paradox of Attendance Monitoring

I don't know when educational institutions began taking 'registers' to record which students were attending class - and which not - but I suspect it is a very ancient practice.

Why do they do it? Well, in many cases there is a requirement of attendance and consequent sanctions for non-attendance. In schools, this may be a requirement imposed by the state. Just today there was a UK news headline: 'Headteachers should pick up absent pupils from home, says education secretary'.

There are clearly good and bad reasons for this level of state interference in the education of children, but whatever the reasons, it requires schools to know who is there, and who is not.

The situation with universities is rather different. Some courses we teach are accredited by professional bodies who impose attendance requirements. After all, you wouldn't really want to find out that your surgeon or dentist had skipped class! But the majority of courses have no such external constraints.¹ So why do we continue to do it?

One reason may be to do with the age-old question of 'who is paying for this?' Consider an analogy: if you pay for your own gym membership, then it is entirely up to you whether you ever work out; but if someone else is paying, they may want to know that you are using it (otherwise they will stop paying).

Duties of Care

In the UK at least, the 'Student Loans Company' - an organisation named at birth in the hope that one day it might be privatised - isn't interested in attendance. What they want to know about is attainment: have the students taking out loans got good enough marks to progress towards a successful completion of their programme? They don't care whether the student achieved those marks by diligently attending classes or by last minute cramming. The loan is for the product, not the process.

And yet we still worry about attendance! The reason for this is that we have a duty of care towards our students. Of course they are adults and they are free to make personal and lifestyle choices. Our duty of care is limited to their ability to complete their studies successfully. If their mental or physical health, their personal or financial circumstances, are impacting on their ability to study, then our duty of care is to offer support and advice which will help them study effectively.

Non-attendance is often - though not always - a sign that something is not going well for a student, in which case we will want to contact them to find out what is going on² and offer them the appropriate support: academic, pastoral or clinical. Insofar as we have a duty to offer that support where it is needed, we fulfil that duty better by using non-attendance as an early warning sign.

The Paradox

We aim to identify and contact non-attending students in order to offer them help. That requires some form of attendance monitoring of all students, because the only way to identify who is not in class is to find out who is in class and compare that to who should be. The only way to get the data we want about some students is to collect data from other students.³

So what is the basis of consent for us collecting data about students who did attend?

The Limits of Consent

In January my Department moved from the traditional system of the lecturer making a record of who was there (a great way to learn names), to a system of students 'signing in' by scanning a QR code and completing a form. For the students, complying with our attendance monitoring went from passive to active.

Not being entirely comfortable with this change, I discussed it with the students I was teaching. When I explained why we collected the data, they were very happy to take part because they saw the benefit to others. Much like those of us who complied with Covid regulations requiring us to check-in to bars and restaurants, they could see that the system was in the common good and the particular loss of privacy was worth that benefit.

Of course, some students will consent because their school experience has normalised the practice and they have not reflected on their increased maturity and autonomy as university students. Others will consent because they are motivated by approval and think they will get approval for having a good attendance record. But neither of these are the bases of consent that a 'place of higher learning' should be seeking.⁴

If contribution to the common good is the basis for consent to attendance monitoring, what limitations does that place on what we can do with that data? Obviously (I hope), we shouldn't keep it any longer than is necessary to extract the information we are really interested in and we shouldn't use it for any other purpose.

What other purposes might it be used for in a university? Well, data driven organisations might use it to build individual profiles of their students, combining it with other data, such as prior attainment, grades, library usage, and demographics. This might be used to tailor 'educational services' to students, to market further courses, to improve 'business processes', or to assess equality and inclusion. It might even be used to determine space usage and appropriate classroom sizes. Sadly it is likely also be used as some sort of proxy for teaching quality, with lecturers who receive low 'attendance scores' having their performance questioned.⁵

Clearly these are things that a university might want to do. I am not going to question here whether they should want to do any or all of these things, and focus instead on whether they have permission to use student attendance data as part of those data-driven optimization projects.

Of course not

Universities have become data rich very quickly. Students (and staff) can be tracked as they move around campus by the devices they carry logging in to the WiFi network, they can be tracked through all their engagement with online services, from library to student records to even just browsing the website for information (thanks to the magic of cookies and the majority of them having 'dark pattern' cookie consent). And all this data is just so tempting.

As such, universities are in the position of Big Tech a decade ago. And they could follow the same route, seeking apparent consent through obscurity (in privacy policies), coercion (condition of using the service) or manipulation (dark patterns). And the edutech companies they contract with will encourage such practices as 'industry norms'.

Or they could not. They could live up privately to their public values and collect as little data as possible, thoroughly anonymise it as quickly as possible, and be completely transparent about what they are doing, offering ways to opt-out.

Attendance

What would a seriously privacy-friendly approach to attendance monitoring look like? Here are three suggestions:

• At the end of each class, the only data that should be retained is the identities of those absent (and perhaps the proportion who attended).
• Once those absent have been contacted and the duty of care discharged, either by an excuse or an explanation, such as illness, which moves the interaction on to another process, the information that they missed that specific class should be deleted.
• Before processing for any other purpose than duty of care to the absent individuals, data must be sufficiently anonymised so that even in conjunction with other data, such as timetables and transcripts, it does not allow the inference that a particular person was or wasn't at a particular place at a particular time.