Why communicating up front beats reacting later

The transparency principle of the Personal Data (Privacy) Ordinance requires organisations to let data subjects know how their personal data is used. When a school uses AI tools to process students' work, results or behaviour records, parents, as guardians, have good reason to be informed. Rather than letting parents hear it in fragments from their children and then come with doubts to question you, it is better for the school to set things out clearly first.

Communicating up front has one more practical benefit. When something has been explained in advance, the school stands on firm ground if a query or misunderstanding comes up later; something never disclosed, once found out, makes even the most reasonable use look like concealment. The cost of communicating is low before the fact and high after it.

What the notice should cover

A useful parent notice does not need to read like a technical document, but it should cover three things: which AI tools the school uses, what student data those tools process, and what safeguards the school has in place. Which tools tells parents the scope; what data lets them judge how sensitive it is; what safeguards puts their mind at ease.

Keep the tone plain. Avoid piling on marketing words like 'innovative' or 'smart', and there is no need to overstate the results. Parents want to be informed, not sold to. Framing AI as a tool that assists teachers, with the final decision still in the teacher's hands, usually settles doubts better than any adjective.

When parental consent is needed

Not every use of AI needs written consent obtained one case at a time, but there are two situations where a school should be especially careful. One is where a new type of data is collected, such as voice or images; this kind of biometric data is more sensitive than a name or a grade, so notifying parents and obtaining consent through the school's established procedure is the safer course. The other is that students are minors, where personal data protection should be stricter to begin with, so when data can identify a student the bar for consent should rise accordingly.

In practice you can handle this in two tiers: everyday, low-sensitivity uses can be covered by a general notice, while uses involving a new data type or higher sensitivity get a separate consent slip. Working in tiers keeps things proportionate and stops parents from being buried under a pile of consent forms.

The skeleton of a notice

A notice does not need to be long. The skeleton below can be filled in to suit your school:

  • Purpose: in which subjects and in what way the school uses AI to support teaching
  • Tools and data: which tools are involved and what kind of student data they process (such as homework and answer scripts)
  • Safeguards: how data is stored, how long it is kept and when it is deleted, and whether it will be used to train models
  • The teacher's role: AI only does the first pass, and the final say on marks and judgement rests with the teacher
  • Parents' rights: how to make enquiries and how to ask to access or correct their child's personal data
  • How to get in touch: contact details for the teacher or department responsible

What to do when a parent objects

Even when communication is done well, the odd parent may still have reservations. The first step is to listen to the specific worry: is it a fear of a data leak, a fear that AI will replace the teacher's judgement, or a question about one particular tool. Different worries call for different responses, and a vague reassurance only comes across as brushing them off.

If a parent still does not want their child's data processed by an AI tool, you can offer an alternative: let that student take part under an anonymous account, or have the teacher handle that student's part by hand. Flexible arrangements like these usually break the deadlock, and they show that the school respects a parent's right to choose. A school willing to keep an opt-out option tends to find it easier to win overall trust.