Chapter 3. Student Data and Child Protection

Learning objectives

• Determine whether student writing and records constitute personal information based on whether they can be "easily combined with other information to identify an individual."
• Explain the requirements for legal representative consent, confirmation of consent, and easily understandable notice when processing the personal information of children under 14 years of age.
• Distinguish the legal grounds required when using student records beyond the purpose of collection or providing them to external third parties from the separate restrictions on school records.
• Verify the training use, retention period, entrustment relationship, cross-border transfer, and age criteria of external AI services.
• Select a method of using AI without inputting student information that fits instructional goals and circumstances.

Introduction

Exhausted while organizing end-of-term counseling logs, a homeroom teacher pasted a few pages of counseling logs into a free AI app on a personal mobile phone and entered "Summarize this." The teacher thought it was safe because names had been changed to initials. However, sentences such as "J, who began receiving meal support due to parental unemployment" and "the younger twin who transferred last year" remained in the summary as they were. This content was easily identifiable to anyone in the same class. Furthermore, that content was now on the server of a service that the school did not manage.

Student information must be handled with greater care than other personal information. Most students are minors who are in a position where it is difficult to choose whether or not to provide information to schools and teachers, and school records remain for a long time to be used for advancement and career paths. For this reason, the Personal Information Protection Act (PIPA) contains separate provisions for children, and the Elementary and Secondary Education Act separately restricts the external provision of school records.

Beginning with the conditions under which student information becomes personal information, this chapter examines the principles and legal grounds for processing, consent for children under 14 years of age, and restrictions on use beyond the purpose of collection and provision of school records. It then outlines how to read the data terms of external AI services, service age criteria and guardian notices, and methods for using AI without inputting student information.

Key concepts

When Student Writing Constitutes Personal Information

Article 2, Subparagraph 1 of the Personal Information Protection Act defines personal information as information relating to a living individual that falls under any of the following:

• Information that can identify a specific individual by name, resident registration number, image, etc. (Item a)
• Information that, even if it cannot identify a specific individual by itself, can be easily combined with other information to identify an individual (Item b). Whether it can be easily combined is determined by reasonably considering the time, cost, and technology required to identify the individual, such as the availability of other information.
• Pseudonymized information that cannot identify a specific individual without additional information, namely pseudonymized information (Item c)

What is critical in student writing is Item b. Even if names and student ID numbers are removed, if clues remain that allow anyone in the same class or grade to identify who it is—such as "parents running a laundromat in OO-dong," "the twin who transferred last year," or "having a leg cast after an injury last month"—that writing can still constitute personal information. Because a classroom is a small community, the "other information" to combine with is very close at hand.

Principles of Processing

Article 3 of the Personal Information Protection Act establishes the principles of processing. The principles most frequently relevant when using AI are as follows:

The scope of "processing" is also broad. Article 2, Subparagraph 2 treats collection, generation, storage, retention, processing, editing, retrieval, output, use, provision, disclosure, destruction, and other similar acts all as processing. The moment information is pasted into an AI service, that information is already being processed.

Legal Grounds for Processing and Schools

A legal ground is required to collect and use personal information. Article 15, Paragraph 1 provides grounds including consent of the data subject, special provisions in laws or statutory obligations, performance of affairs under the jurisdiction of a public institution, conclusion and execution of a contract, urgent interests of life, bodily harm, or property, legitimate interests of the personal information controller, and public safety such as public health.

Which grounds do schools use? Article 2 of the Enforcement Decree of the Personal Information Protection Act includes schools of each level established pursuant to the Elementary and Secondary Education Act, the Higher Education Act, etc., within the scope of public institutions. Therefore, schools can process personal information within the inevitable scope required to perform affairs under their statutory jurisdiction (such as education and maintaining school records). However, if a school introduces a new service outside its statutory jurisdiction—such as having students process personal information by signing up directly for an external AI learning app—another legal ground, such as consent, may be required.

When obtaining consent, the following four items must be notified pursuant to Article 15, Paragraph 2:

1. The purpose of collection and use of personal information
2. The items of personal information to be collected
3. The period of retention and use of personal information
4. The fact that the data subject has the right to refuse consent, and details of any disadvantages resulting from such refusal

No matter how thoroughly efficacy data for the app or the AI model name is described on the consent form, if these four items are missing, it does not constitute the notice required by law. In addition, asserting disadvantages such as "if you do not consent, you cannot receive a performance evaluation score" in effect coerces consent. It is proper to prepare alternative activities for students who do not consent.

Children Under 14 Years of Age

Article 22-2 establishes three rules for children:

1. Legal representative consent and confirmation (Paragraph 1). When consent under this Act must be obtained to process the personal information of a child under 14 years of age, consent must be obtained from the legal representative, and it must be confirmed that the legal representative has given consent.
2. Direct collection of minimum information (Paragraph 2). The minimum information necessary to obtain the consent of a legal representative—namely, the name and contact details of the legal representative—may be collected directly from the child without the consent of the legal representative (Article 17-2, Paragraph 2 of the Enforcement Decree).
3. Easily understandable notice (Paragraph 3). When notifying a child under 14 years of age of matters regarding the processing of personal information, an easily understandable form and clear, plain language must be used.

Methods for confirming consent are prescribed by Article 17-2, Paragraph 1 of the Enforcement Decree: notifying the legal representative via mobile phone text message that the indication of consent has been confirmed; receiving credit card or debit card information of the legal representative; mobile phone identity verification; obtaining a signature or seal on a written document; receiving a declaration of consent via email; obtaining consent by phone; and other methods equivalent thereto.

Do not confuse two points. First, Paragraph 1 requires obtaining the consent of the legal representative "when consent is required"; it does not mean that consent is required for all processing of information of children under 14 years of age. There are also cases where processing is carried out based on other legal grounds. Second, the fact that a legal representative has consented does not eliminate the duty to notify the child in an easily understandable manner. An information sheet that simply pastes a privacy policy written for adults does not satisfy Paragraph 3.

Use Beyond the Original Purpose and Provision

Article 18, Paragraph 1 prohibits personal information controllers from using personal information or providing it to a third party beyond the scope of the legal grounds for collection. Paragraph 2 provides exceptions, such as obtaining separate consent from the data subject, special provisions in other laws, or urgent interests of life, bodily harm, or property. Some exceptions apply only to public institutions, such as cases where affairs under jurisdiction prescribed by other laws cannot be performed without using or providing personal information beyond its original purpose and the matter has undergone deliberation and resolution by the Personal Information Protection Commission, criminal investigations, and court proceedings. When obtaining separate consent, the recipient, purpose of use, items, retention period, right to refuse, and disadvantages of refusal must be notified (Paragraph 3).

To take examples from the educational field: creating AI career recommendations from level test results collected for class placement and sending personalized notifications, or using conversation logs collected under the notice that they would be used for "answering learning questions" to predict the risk of dropout, constitute uses beyond the purpose of collection. Even if the purpose is well-intentioned, legal grounds must be established. The fact that information is "already lawfully held" does not serve as legal grounds for a new purpose.

School Records and Provision to Third Parties

In addition to the Personal Information Protection Act, school records are separately governed by the Elementary and Secondary Education Act. Article 25 requires the head of a school to draft and manage personal details, school register records, attendance records, acquisition of certificates and qualifications, academic development, behavioral characteristics and comprehensive opinions, etc., according to criteria prescribed by Ordinance of the Ministry of Education, and to draft and manage them via an educational information system.

Article 30-6, Paragraph 1 prohibits the head of a school from providing school records and health examination records under the School Health Act to a third party without the consent of the student (or the student and their guardian if the student is a minor). Exceptions include affairs of administrative agencies holding supervisory and audit authority, student selection by higher-level schools, cases where the records are provided in a form that cannot identify the individual for the purposes of statistical compilation and academic research, criminal investigations, court proceedings, and other cases pursuant to relevant laws. A person who receives such data shall not use it for purposes other than the original purpose (Paragraph 3).

Therefore, if an external research institute or edtech enterprise requests school record data citing "AI model research," it may only be provided with student and guardian consent or in a form that cannot identify the individual. Signing a non-disclosure agreement and restricting the number of viewers are good protective measures, but they do not substitute for statutory requirements.

Sensitive Information

Article 23 defines information regarding ideology, belief, trade union or political party membership, political views, health, sex life, etc., as well as other information likely to significantly infringe on privacy as prescribed by Presidential Decree (Article 18 of the Enforcement Decree: genetic information, criminal history records, biometric data generated for the purpose of identifying a specific individual, and information concerning race or ethnicity) as sensitive information, and prohibits processing it without separate consent or statutory grounds. When processing sensitive information, measures necessary to ensure safety must be taken (Paragraph 2).

Counseling logs and students' personal narratives often contain statutory sensitive information such as health and beliefs alongside sensitive private information such as family circumstances and emotional states. Even if the latter does not constitute statutory sensitive information, the harm of exposure is significant, so it should be handled with the same level of care. If you wish to perform summarization or analysis using AI, first ask: "Is sensitive content strictly necessary for this purpose?" If it is not necessary, do not input it. For analyses with a high risk of including sensitive information, such as predicting dropout, exclude health-related details and design the results to be used solely for support, not for adverse action.

External AI Services and Entrustment

When a school sends student writing to an external AI service to receive analysis or feedback, if the vendor processes the school's affairs on its behalf under the school's management and supervision, the vendor becomes a trustee. Conversely, if the vendor also uses the received student information for its own purposes, such as training its own models, you must examine whether this constitutes third-party provision rather than entrustment, along with the appropriate separate legal grounds. This is another reason to verify terms regarding non-use for training. Article 26 requires the following for entrustment:

Verifying data terms (training use, retention period) is not the end of the matter. Those conditions must be included in the entrustment document, the fact of entrustment must be disclosed, and compliance must be inspected. Furthermore, if an incident occurs, the school, as the truster, bears primary responsibility for response.

Five Questions for Reading Data Terms

When reading the terms of service and data processing terms of an AI service, check each of the following five questions separately:

1. Training use: Is input content used for model training or improvement? What is the default setting, and can it be turned off?
2. Retention period: How long are inputs and conversation logs retained, and when are they deleted? Even if not used for training, they may still be retained.
3. Account type: Are the terms for individual accounts and institutional contract accounts identical? Even for the same model from the same company, terms can differ depending on the contract.
4. Processing relationship and location: Does the vendor process on behalf of the school (entrustment)? Is data processed and stored overseas?
5. Age criteria: What is the minimum age permitted by the service and what are the requirements for guardian permission?

Cross-border transfer is not a matter of prohibition, but a matter of requirements. Article 28-8, Paragraph 1 in principle prohibits the cross-border provision, entrustment of processing, or storage of personal information, while establishing exceptions: separate consent of the data subject; special provisions in laws or treaties; entrustment of processing or storage necessary for the conclusion and execution of a contract with the data subject, where details of the transfer have been disclosed in the privacy policy or notified; cases where the recipient has obtained certification publicly notified by the Personal Information Protection Commission and has implemented all safety measures, rights protection measures, and measures to fulfill certified items in the destination country; or transfer to a country recognized as having a substantially equivalent level of protection. A contract solely between a school and a vendor does not satisfy the third exception. Both "it is categorically prohibited if servers are located abroad" and "it is completely fine even if abroad" are incorrect.

Promotional copy and certification badges are not the answers to these five questions. The answers reside in documents such as contracts, data processing addenda, and privacy policies.

Age Criteria and Guardian Notices

The age criteria in service terms are terms of use that schools must comply with independently of statutes. For example, OpenAI's educator guidance help page explains that users must be at least 13 years old and that users between 13 and 18 must have parental or guardian permission. In 2023, UNESCO published its guidance on generative AI in education and research, presenting an age threshold of 13 for using AI tools in classrooms and emphasizing data privacy protection and age-appropriate access.

Designing student activities based on this yields the following:

Having students share a single class account not only bypasses age criteria and guardian permission requirements, but also makes it impossible to monitor who inputted what. The fact that individuals aged 14 or older can consent to personal information processing on their own does not eliminate the guardian permission requirement in the terms of service.

Methods for Using AI Without Student Information

In many cases, you can receive assistance from AI without inputting any student information at all.

Moving to a free AI on an individual personal account simply because an approved school tool lacks desired features is not the answer. Even if names are changed to initials or training settings are turned off, the risk of identifying students through content and the risk of storage in an environment unmanaged by the school remain.

End of Processing: Destruction and Incident Response

Information that has become unnecessary upon the expiration of the retention period or achievement of the processing purpose must be destroyed without delay (Article 21, Paragraph 1). However, information that must be preserved pursuant to other laws and regulations is an exception, in which case it must be stored separately from other personal information (Paragraph 3). Records whose preservation is mandated by law, such as school records, must not be erased merely because an immediate purpose has been achieved. When using AI tools, include uploaded files, conversation logs within the tool, and downloaded outputs in the scope of destruction. During processing, take measures necessary to ensure safety pursuant to Article 29, such as formulating an internal management plan and preserving access logs.

The Personal Information Protection Act collectively refers to loss, theft, leakage, forgery, alteration, or damage as "leakage, etc." (Article 23, Paragraph 2). Upon becoming aware of leakage, etc., the personal information controller must, pursuant to Article 34, notify data subjects without delay of the items involved in the leakage, etc., the time and circumstances of the occurrence, methods to minimize harm, countermeasures and relief procedures, the department in charge of receiving reports, and statutory rights such as compensation for damages and dispute mediation along with methods to exercise them. Even when becoming aware of the possibility of leakage, etc. as prescribed by Presidential Decree, the controller must inform the relevant data subjects of information to minimize harm, etc. (Paragraph 2), take measures to prevent the spread of harm such as retrieval and deletion (Paragraph 3), and report to the Personal Information Protection Commission or a specialized institution if the requirements prescribed by the Enforcement Decree are met (Paragraph 4). In a school, reporting immediately to the Privacy Officer is the first step (Chapter 5).

Going deeper

Is writing with names removed anonymous?

Article 58-2 of the Personal Information Protection Act (PIPA) provides that this Act shall not apply to information that can no longer identify an individual even if other information is used, when reasonably taking into account time, cost, technology, and other factors. This is information commonly referred to as anonymous information. Meeting this standard in student writing is more difficult than one might think. In a small group such as a class or grade level, the topic of the writing, family stories, unique experiences, and even writing style serve as clues.

Therefore, in practice, rather than concluding that text is "anonymous," a two-layer protection is used: "processing writing from which clues identifying the student have been removed as much as possible, exclusively in tools approved and managed by the school." Because the first layer (removal of clues) may not be perfect, a second layer (approved tools, consignment contracts, retention periods) is put in place. Conversely, just because a tool is approved provides no justification for skipping the first layer. Minimal processing is a principle independent of the tool.

When terms-of-service age and statutory age differ

The baseline age under the Personal Information Protection Act (PIPA) is 14, whereas the terms of service of many AI services use ages 13 and 18 as their standards. The two standards answer different questions. The law determines "whose consent is valid," and the terms determine "who can use this service and what conditions are required."

Therefore, both standards must be satisfied. A 15-year-old student can personally consent to the processing of personal information under the Personal Information Protection Act (PIPA); however, if the terms require guardian permission for individuals under 18, guardian permission is necessary. A 12-year-old student cannot use the service, even if a guardian consents, if the terms prohibit use by anyone under 13. When exam questions present a student's age alongside terms conditions, apply the two criteria separately.

Whether to open student accounts or have the teacher demonstrate

The experience of students using AI directly holds great value in AI literacy education. This is because they can verify firsthand how outputs change as prompts are altered and when AI makes mistakes. However, student accounts bring with them costs in the form of age criteria, guardian permission, data conditions, and account management.

Teacher demonstrations achieve a significant portion of learning objectives without these costs. If students design prompts, the teacher inputs them on their behalf, and they critique the results together, the core competencies of prompt design and result verification can be cultivated. On the other hand, for hands-on practice where each student must undergo trial and error directly on screen (for example, interpreting programming errors), a demonstration is insufficient. The choice must be made by evaluating both "what the student must learn from this activity" and "whether the conditions for opening student accounts are met."

At work

Wildflower Elementary School: AI reading app and consent forms

Wildflower Elementary School sought to introduce an AI reading app for 96 fourth-grade students (aged 9–10). The app read book reports written by students, posed questions, and saved reading records. The vendor sent promotional materials claiming the app was "safely designed for educational use," along with case studies from other schools reporting increased reading volume.

The initial draft of the consent form created by the teacher in charge included data on the app's effectiveness, the AI model name, and the sentence: "If you do not consent, you cannot participate in the reading performance assessment." The head of the information department revised three things in this draft. First, the four items required by Article 15 (2) (purpose, items, retention period, right to refuse and disadvantages) were organized into a table. Second, the penalty statement upon refusal was deleted and replaced with guidance on alternative activities: "If you do not consent, you will carry out the same activity using a paper reading log." Third, the effectiveness data and model name were separated into reference materials.

Because all students were under 14 years of age, consent was obtained from legal representatives and verified through identity verification via the school's home correspondence system, among the methods prescribed in Article 17-2 of the Enforcement Decree. For the students, a separate one-page notice with illustrations was created, explaining in simple language "where and for how long the app keeps my book reports."

During the contracting process, it was confirmed that the vendor stored and analyzed student book reports on behalf of the school. Therefore, the school specified in the consignment document the prohibition of processing beyond the purpose and the retention period (deletion at the end of the school year), and disclosed the trustee in the privacy policy on the school website. The discarded options were "adopting the app immediately by trusting the vendor's promotional materials" and "substituting consent with a blanket notice under the principal's name."

Mountain Ridge High School: Reorganization after a personal account incident

At Mountain Ridge High School, it came to light following a colleague's objection that a teacher had input about 20 career counseling records into an AI on a personal account to summarize them. The teacher claimed that "names were removed," but the records contained students' health issues and personal family circumstances.

The school's privacy officer first verified the facts. They determined what records were entered, into which service, when they were entered, what that service's retention terms were, and whether chat logs could be deleted, and ensured that chat logs were deleted to the extent possible. Then, they initiated procedures to determine under the law whether this incident constituted a leak, etc., and whether notification to data subjects and reporting to authorities were required.

To prevent recurrence, the school made two changes. First, it included a table in the AI usage guidelines for teachers specifying handling methods by type of student information. Counseling records and health information were not to be entered into AI; student writing could only be processed in approved tools after removing clues; and data that could not identify individuals, such as item statistics, could be freely analyzed. Second, responding to staff feedback that the approved tool lacked a summarization feature, the school demonstrated during training how teachers could organize information by entering only generalized topic lists. The option discarded by the school was "completely banning AI use," as it judged that a ban alone risked driving teachers to use it in even less visible places.

Common mistakes

1. "Since names and student ID numbers were removed, it is not personal information." While it feels reassuring to have deleted easily removable elements, classmates can still identify who it is through clues within the content. If it can identify an individual when easily combined with other information, it is personal information.
2. "If the training setting is turned off, it is fine to enter it into a personal account." Being excluded from model training is different from not being retained, and the problem of moving data to an environment not managed by the school remains.
3. "Since the guardian consented, there is no need to notify the child separately." Legal representative consent and the obligation to notify the child in easily understandable terms are separate matters.
4. "If a student is 14 or older, their own consent is sufficient regardless of the terms of service." The statutory age of consent and the terms of service's requirement for guardian permission answer different questions. Both must be observed.
5. "Since it is information already held, it may be used if the purpose is good." Using information beyond the purpose of collection requires a legal basis, such as separate consent.
6. "If a non-disclosure agreement is signed, school records may be transferred." Providing school records to a third party requires the consent of the student and guardian, or statutory exceptions (such as an unidentifiable form for academic research).
7. "If the server is located overseas, it is absolutely prohibited." Cross-border transfer is permissible processing if statutory requirements are met. Both unconditional exclusion and unconditional permission are incorrect.
8. "Sharing a common account can avoid age issues." This circumvents age criteria and guardian permission requirements, and makes input management impossible.

Summary at a glance

Check the official docs

• National Law Information Center — Personal Information Protection Act, Article 2 — Check the definitions of personal information, pseudonymous information, and processing in the original text.
• National Law Information Center — Personal Information Protection Act, Article 3 — Read the eight paragraphs of processing principles.
• National Law Information Center — Personal Information Protection Act, Article 22-2 — Four paragraphs on the protection of children's personal information.
• National Law Information Center — Enforcement Decree of the Personal Information Protection Act, Article 17-2 — Check methods for verifying the consent of a legal representative.
• National Law Information Center — Personal Information Protection Act, Article 26 — Check consignment documents, disclosure, and supervision obligations.
• National Law Information Center — Elementary and Secondary Education Act, Article 30-6 — Read restrictions and exceptions regarding third-party provision of school records.
• OpenAI Help — How can educators respond to students presenting AI-generated content as their own? — Educator guidance detailing usage ages and guardian permission requirements.
• UNESCO — Governments must quickly regulate Generative AI in schools — Check age criteria (age 13) for classroom AI tools and calls for teacher training.

Self-check

3-1. State the factors that the Personal Information Protection Act requires to be considered when determining "information that can be easily combined with other information to identify an individual," and explain why the classroom environment makes this determination stricter.

3-2. Among the principles in Article 3 of the Personal Information Protection Act, choose three that are directly applied when deciding what to input into AI, and explain each in one line.

3-3. State the three rules of Article 22-2 concerning children under the age of 14, and provide two methods from the Enforcement Decree for confirming whether consent has been obtained from a legal representative.

3-4. State the four items that must be disclosed in a consent form, and state what must be prepared instead of penalizing students who do not consent.

3-5. Accurately state the exception related to research among the exceptions allowing school life records to be provided externally, and explain why a non-disclosure agreement cannot substitute for it.

3-6. State the five questions to check when reading the data terms of an AI service, and choose one question that cannot be answered solely by the statement "not used for training."

3-7. Explain with an example what it means that the statutory age of consent (age 14) and the age criteria in service terms of use answer different questions.

3-8. (Design task) Choose three AI use scenarios in your school where student information could be included, and for each, state which method from the "How to Use AI Without Student Information" table you would use and the reason why.

Hands-on tasks