Learning analytics profiling by university

Short answer

Yes, a university in England and Wales can, in principle, use learning analytics and AI to identify students who appear disengaged, at risk or likely to fail. This kind of profiling is lawful if the university complies with data protection law. But it is not unrestricted. You have significant rights over how your personal data is used, and there are important limits on decisions that are made about you by machine alone without meaningful human involvement.

The legal framework

The main law is the UK GDPR and the Data Protection Act 2018, now amended by the Data (Use and Access) Act 2025. Building a profile of you from data such as virtual learning environment logins, library use, attendance, submission timing and assessment marks, and then attaching a label like “disengaged”, “at risk” or “likely to fail”, is “profiling” and is processing of your personal data. It is allowed only where the university can satisfy the ordinary data protection requirements.

The university must have a lawful basis for the processing. For a public university this is usually “public task” or “legitimate interests” rather than consent, although the choice of basis matters and affects your rights. It must also comply with the core principles: the processing must be fair, lawful and transparent, limited to what is necessary, accurate, and kept no longer than needed.

Transparency is central. The university must tell you, normally through a privacy notice and often a specific Learning Analytics privacy notice or code of practice, what data it collects, why, how any risk scoring works in general terms, who sees it, and how long it is kept. Many universities have adopted a Learning Analytics Code of Practice reflecting sector guidance from Jisc; the existence and content of that policy is a good starting point for understanding what your own institution does and what it has committed to.

Solely automated decisions with significant effects

The strongest protection applies where a decision that produces legal effects or similarly significant effects on you is made by fully automated means with no meaningful human involvement. This was Article 22 of the UK GDPR, and following the Data (Use and Access) Act 2025 the rules are now set out in the reformed automated decision-making provisions (the new Article 22A to 22D framework) and updated ICO guidance.

The key practical questions are:

1. Does the label or score produce a legal or similarly significant effect on you? A dashboard flag that simply prompts a tutor to check in with you is usually not significant. A score that automatically triggers withdrawal from a course, exclusion, loss of a bursary or a fitness to study process could be.

2. Is the decision solely automated? If a human being reviews the flag and exercises genuine judgement before anything happens to you, it is not a solely automated decision, and the special restrictions do not apply in the same way. A rubber-stamp of the algorithm’s output does not count as meaningful human involvement.

Where a decision is both solely automated and has a significant effect, it is restricted. The university generally may only do it under limited conditions, and where it does it must give you safeguards: information that the decision was made this way, the right to obtain human intervention, the right to express your point of view, and the right to contest the decision. If special category data (for example health or disability information) feeds the model, the restrictions are tighter still.

In practice most university learning analytics is designed as decision support for staff rather than automated decision making, precisely to stay outside the strictest rules. Whether that is true in your case depends on how the system is actually used.

Your rights in this situation

You can make a subject access request to obtain the personal data the university holds about you, including analytics data, the risk labels or scores applied to you, and meaningful information about the logic involved where automated decision making is engaged. This is free and the university normally has one month to respond.

You have a right to be informed, so you can ask for the privacy notice and any learning analytics code of practice that applies to you.

You can challenge accuracy. If a label is based on incomplete or misleading data, for example it treats non-attendance at optional sessions or working offline as disengagement, you can seek rectification and point out the real explanation.

You may have a right to object to processing based on public task or legitimate interests, and a specific right to object to profiling. The university must then stop unless it shows compelling legitimate grounds. Where the basis is consent, you can withdraw it. Some universities offer an opt out of the analytics; check the code of practice.

Where a solely automated significant decision is involved, you can require human intervention, put your side, and contest the outcome as described above.

Equality and fairness considerations

If the analytics disadvantage a group defined by a protected characteristic, for example if disability related patterns such as reduced online activity are read as risk, the Equality Act 2010 is relevant, including the duty to make reasonable adjustments for disabled students and the public sector equality duty for public universities. Models that produce discriminatory or unfair outcomes can breach both the fairness principle in data protection law and equality law.

Ordinary explanations to keep in mind

It is worth distinguishing a genuine legal wrong from routine practice. A university flagging a student for a supportive conversation is generally a legitimate student welfare and retention activity, not unlawful surveillance. The processing becomes questionable mainly where it lacks transparency, where the data is inaccurate or applied unfairly, where consequences are imposed automatically, or where the university cannot point to a valid lawful basis and a published policy.

Practical next steps

1. Read your university’s privacy notice and Learning Analytics Code of Practice, and its student data protection and fitness to study or academic progress policies, to see exactly what is collected and what any label can trigger.

2. Ask, in writing, whether any label or score has been applied to you, whether decisions about you are made solely by automated means, and what human review exists. Request a copy of the relevant policy.

3. Make a subject access request if you want to see the actual data and any profiling applied to you.

4. If the data is wrong or the interpretation is unfair, write to correct it and, if appropriate, object to the profiling or ask for the analytics opt out.

5. Use the university’s internal complaint procedure if you are not satisfied, then the Office of the Independent Adjudicator for Higher Education for unresolved student complaints.

6. For data protection concerns specifically, you can complain to the university’s Data Protection Officer and then to the Information Commissioner’s Office.

Key missing facts

The answer turns on details you have not yet given: which university and its published policy, what the label actually triggers (a supportive check in versus an automatic consequence), whether a human genuinely decides, what data feeds the model, and whether any disability or other protected characteristic is involved. If you can tell me your institution and what happened or what you fear will happen, I can give a more precise view.