Data protection in e-learning

Data protection in e-learning is a hot topic: Having arrived in the information society of the 21st century, the handling of electronic data is undergoing a change in character. Gone are the days of the uncontrolled counter-world on the World Wide Web. In the internet, as well as in the world outside of it, data storage is becoming increasingly prevalent. RFID chips on goods, biometric recognition systems, video surveillance, and telecommunications monitoring awaken a sense of unease in many.

Data protection concerns also affect users of e-learnings. In professional development, one does not want to fall into an unavoidable data collection trap.

On the other hand, the raw material of data is the substance that e-learning and science need to live and develop. As Jan Hansen, Managing Director at the Hessian Telemedia Technology Competence Center - httc e.V., and Nadine Hatteh of the Darmstadt University of Applied Sciences, Institute for Information Law, explained in their report "Data Protection in E-Learning – On the Relationship between Control and Trust in the Information Society," control mechanisms for solving this fundamental conflict of interest are anchored in the Federal Data Protection Act, the Telemedia Act, and EU law: "The EU Directive 95/46/EC of the European Parliament on the protection of individuals with regard to the processing of personal data and on the free movement of such data of October 14, 1995, already contains the dual objective in its name: to protect two opposing areas." (See Data Protection in E-Learning, p. 331)

Employees with trust in the protection of their data can start e-learning with motivation.

Find out here how you as a company can

• ensure the success of your e-learning measures while taking data protection guidelines into account
• give your employees certainty regarding data protection in e-learning

The right to informational self-determination

Among individuals, the need to retain control over their own sensitive and valuable data is rising, a fact also understood by Jan Hansen and Nadine Hatteh: "Who likes the idea that data about their own personal circumstances circulates without control? If those affected see that data about their personal circumstances circulates unhindered as the subject of scientific research or as participant data in an e-learning event, this can be perceived as a threat by those affected." (Data Protection in E-Learning, p. 330)

Freelance journalist Nicola de Paoli wrote an article for the trade magazine "Personalführung" issue 08/2012 on the topic of "E-Learning and Data Protection." In it, she described which data are theoretically available to companies during the implementation of e-learning measures: "During e-learning training courses (...) numerous data are collected that provide information about which employee participated with what result, how often they repeat individual training contents, and how long they spent on a learning task." Accordingly, labor lawyers see data protection as one of the biggest problems with e-learning, quoted de Paoli Professor Dr. Stefan Nägele, specialist lawyer for labor law at the Naegele Law Firm for Labor Law: "Some programs place the employer, at least theoretically, in a position to carry out a personality screening of the employee."

However, the "right to informational self-determination" (see Wikipedia), which was formulated as a fundamental right by the Federal Constitutional Court in 1983, prohibits the arbitrary collection and use of data.

When it comes to data protection issues of e-learning in companies, it is much more about who is allowed to see what. Access rights can be assigned precisely, and which data may be collected and how is clearly regulated by law. Science, research, and teaching are free (Art. 5 Para. 3 Basic Law (GG)): "The Basic Law also grants the freedom of scientific research and teaching, which protects the scientist or teacher 'when finding information, interpreting it, and passing it on.' Without information, research and teaching cannot exist." (Data Protection in E-Learning, p. 330)

E-learning events are organized and conducted based on learning management systems. Equipped as adaptive systems, these allow the structure of the offered learning content to be adapted to the needs of the user based on user behavior and user contributions. But is this type of data collection and evaluation allowed? The data protection rules on this issue have a compromise character.

2 ways to circumvent data protection: Anonymization and pseudonymization

As electronic information and communication services, LMS systems fall under the Telemedia Act (see § 1 TMG): "Even permission to create user profiles is formulated in the Telemedia Act if the data is used for the needs-based design of telemedia services. However, the data may only be used for market research in anonymized or pseudonymized form." (Data Protection in E-Learning, p. 337)

By anonymizing and pseudonymizing data, restrictions can be circumvented: "With anonymization, all data that allows a reference to individual persons is dispensed with. With pseudonymization, the name is replaced by an obvious fantasy name. All further references to an individual person are removed. This ensures the protection of the person concerned, and the data can be used and passed on in full freedom." (Data Protection in E-Learning, p. 333)

5 Principles of Data Protection Law:

1. Prohibition with reservation of permission: "Everything is prohibited unless it is exceptionally permitted." (Roßnagel, A., Handbook of Data Protection Law, Verlag C. H. Beck, 2003) The use of personal data is permitted only in 2 cases: Either there must be a legal permission to use data about another person or their explicit consent must be present. (Art. 7 clause a of the Directive)
2. Data minimization: Only the data that is actually needed may be used. (Art. 6 Para. 1 clause c of the Directive)
3. Proportionality: The use of data must be necessary, suitable, and appropriate. (Art. 6 Para. 1 clause c of the Directive)
4. Purpose limitation: Data may not be collected in stock and not used for arbitrary purposes. (Art. 6 Para. 1 clause c of the Directive)
5. Transparency: Data users must comprehensively inform affected persons about the type, scope, and duration of data usage. (Art. 10-12 of the Directive)

Regulations may deviate from one another in the individual state data protection laws. Within cross-state e-training measures, the strictest data protection law is to be applied.

Our tip: Gain the trust of your employees. Work with the highest possible transparency so that e-learning is accepted by employees and works councils in your company.

Data protection in e-learning – an overview of trust-building measures:

1. Involvement of employees in the planning of e-learning by concluding works agreements. These should explicitly mention:
2. Purposes and learning objectives of e-learning
3. Groups of persons who have access to data from e-learning: clearly defined roles, areas of responsibility, access rights
4. Exclusion of the use of data for behavior monitoring and personnel measures such as warnings and transfers
5. Anonymization/pseudonymization of evaluations and performance monitoring
6. Transfer of standards of documentation for in-person seminars to e-learning
7. Restriction of documentation to employee name, the name of the training, and the training result

Protection of confidential information - the keeunit guarantee!

With keeunit, your confidential company and personnel data are secure, because all transmissions take place encrypted according to the SSL standard. Are there learning contents that should only be accessible to a certain group of people? No problem. With keeunit, you simply set up your courses so that every participant only receives the content intended for them. Our learning management system is also hosted 100% in Germany.

We at keeunit are happy to advise you on data protection when introducing mobile learning. With our experience, we support you in works council meetings and data protection formulations. Write to us or call us.