The third post in our COVID-19 and exams series takes us to Norway, and a decision from that country’s Data Protection Authority, Datatilsynet, which has potential ramifications for students across Europe and the rest of the world. Read the first and second posts here.
On 8 August 2020, the Norwegian Data Protection Authority (DPA) issued a draft decision ordering the International Baccalaureate Organization (IBO) to redo its award of final grades for International Baccalaureate (IB) students.
The IBO is a global organization that provides teachers and schools four programs for students, based on age and educational needs, to help develop independent critical thought and logic. IB programs have been part of school curriculums in Norway since 1978, and there are currently 41 schools in Norway that offer some type of IB curriculum; altogether IB programs span more than 150 countries and their diplomas are highly regarded by universities worldwide.
The Norwegian DPA decision was due in part to the lack of final IB testing because of COVID-19. In a normal non-coronavirus year, students’ final grades are primarily based on a final exam. In response to the global pandemic, the IBO compensated by creating a model that focuses on three factors of historical data: student coursework, teacher-delivered predicted grades and school context. However, the IBO did not disclose how each of these factors were weighted in determining students’ final scores. Many Norwegian students believe that these IBO-generated grades were well below what they reasonably expected to receive.
So, how did the DPA end up issuing a draft decision that could affect the grades of IB students around the world? And why was a privacy authority, rather than an educational authority, students or parents, taking on the IBO? Though the DPA made a decision about Norwegian students’ grades, the DPA demonstrated a violation of General Data Protection Regulation (GDPR), an EU regulation dealing with the rules concerning control, processing and fundamental rights individuals have in regard to their personal data. Privacy and the protection of personal data is seen as a fundamental right in the EU. Since students’ IB grades are considered personal data, they fall under the umbrella of GDPR and it is for local DPAs to address complaints dealing with privacy violations. People in other EU jurisdictions will be able to look at the Norwegian DPA decision as a way for them to petition their local DPA about similar issues they have with the IB results. IB students outside of the reach of GDPR will need to identify ways that the IBO’s predictive test strategy, characterized by students as unfair and inaccurate, violated local laws or other legally protected rights.
When the predictive IB scores were released, complaints were made to the DPA to investigate based on GDPR requirements regarding profiling (automated processing of personal data for evaluation purposes), fairness (considering expectation, non-discrimination, power balance, ethical and fair algorithms), transparency (clarity in how data is being interpreted) and accuracy (as personal data must be accurate, if inaccurate it must be erased). Accuracy matters even with the assessment of students’ academic work according to interpretation of GDPR rules.
When the IB grades were released in July, the world caught a glimpse of the fallout that would ensue with A-levels and Scottish Higher grades in August. Much like the systems used for awarding final grades in the UK and Ireland, the IBO used a model that incorporated historical data to adjust overall results. (The IB system differed in that the adjustment took place after external examiners reviewed course work submitted and graded by students’ teachers, whereas in the UK and Ireland coursework was not graded by external examiners.) On results day, thousands of students and their teachers were horrified to discover the grades awarded were lower than anticipated.
But where and how would these students protest? Many took to Twitter, but as the IBO is an international educational organization, with its HQ in Switzerland, assessment managed out of the UK and other offices in Singapore, the Netherlands, and the United States, it was always going to be much harder for students to coalesce in protest. Furthermore, as the IB is a system that operates outside any national educational system, no single politician could be held responsible for the issue.
Ultimately, it was this transnational aspect that the DPA argues gives it authority to issue its ruling in terms of fairness, accuracy and transparency. For the fairness prong, the DPA said that the students did not have a reasonable expectation of fairness with these scores. The fact that grades were not given based on demonstrable academic performance and the IBO adjusted final grades based on how other students performed previously in certain schools, the school context was seen as unfair. If you were unlucky enough to be a good student in a school that did not have high-scoring students previously, your score would be lower with this evaluation. This is also unfair because some schools have had IB programs longer than others. With a longer history of test scores, a school’s IB final averages have the potential of being higher compared to schools with newer programs that do not have the same representative or historical data showing a high trend in IB grades. IBO also indicated that students from different time zones would have adjusted scores, meaning that students from different parts of the world were assessed differently under this predictive method. According to the DPA, the IBO methods and formula for calculating final grades were not adequately transparent considering the importance of these grades for a student's future.
The DPA suggested that for any new model used for predictive grades, the IBO needs to provide specific details and an explanation of how each factor will be weighted in calculating a student’s grade. For accuracy the DPA found that when evaluating the grades under GDPR, they were not sufficiently accurate because they took into account school context, which might not accurately reflect a student’s actual ability or how they would perform on the exam. All of these issues culminate in undo adverse effects for students.
Based on the DPA’s decision, the IBO cannot use the predictive grades model in the future when awarding grades to Norwegian students due to its violation of GDPR. For the students who have already been awarded grades, the IBO must find a new way to assess the students in a more fair and transparent manner.
One of the huge ironies of this saga is that the IBO defended its awarding model because it had Ofqual’s blessing. Not only is this the same organization that ultimately withdrew the algorithm used in England but by 12 July—only six days after the IB results were published—Ofqual was reported to be investigating the IB grading process
Clare O’Hare is a lawyer and doctoral candidate at the University of Notre Dame Law School. Clare’s research focuses on the growth of specialized commercial courts in the context of cross-border commercial litigation. Clare is a Graduate Fellow at the Nanovic Institute for European Studies and an active member of the Keough-Naughton Institute for Irish Studies’ Graduate student Working Group.
Abena Amparbeng is a 3rd-year law student at the University of Notre Dame Law School, where she is focusing on privacy and cybersecurity. She is currently organizing the 11th annual symposium for the Notre Dame Journal of International and Comparative Law, focusing on privacy and surveillance. Abena received her MS in Africa and International Development at the University of Edinburgh. She completed her undergraduate degree at the University of South Carolina in International Studies with a minor in Japanese language.