With the shift to the online testing environment, the International Large-Scale Assessments (ILSAs) started to collect new category of personal data, namely log data (Case C-579/21), recording how participants interact with test platforms, which includes capturing clicks, keystrokes, time spent (Huber, K., Bannert, M.), navigation paths, and even pauses. While log data offers many benefits from predicting outcomes and design interventions (Arizmendi, C.J., Bernacki, M.L., Raković, M. et al.) to supporting research and innovation, the sharing and reuse of captured log data raise important data protection considerations (Aghili, R., Li, H., & Khomh, F. (2024). This contribution will focus on some of the data protection challenges under the General Data Protection Regulation (GDPR) when it comes to sharing and re-using log data in educational research and how IEA has addressed these challenges in TIMSS 2023. The first challenge relates to the principle of transparency (Article 5(1)(a) GDPR), including the data subject’s right to be properly informed about the processing of their personal data (Articles 12-14 GDPR). This can be problematic, because for various reasons, which will be discussed, study participants might not be adequately informed about the types of log data collected, how long log data will be stored, or whether log data may be shared with third parties or reused for future research. The second challenge relates to the principle of purpose limitation (Article 5(1)(b) GDPR), which states that personal data must be collected for specified and explicit purposes. Further processing of personal data is allowed for archiving purposes in the public interest, scientific or historical research or statistical purposes under Article 89(1), subject to appropriate safeguards and only if processed in a manner that is compatible with the initial purposes. The third challenge relates to the ever-present re-identification risk. Even when direct identifiers are removed, log data can remain personal data under the GDPR, as detailed behavioral traces may allow individuals to be singled out, especially when combined with contextual information or external datasets. The presentation concludes with insights from TIMSS 2023, showing how IEA strives to address those challenges via data protection declarations, whereby participants are informed about the processing of their personal data, as well as by implementing various safeguards to reduce the risk of re-identification, which are both technical and contractual in nature.

Case C-579/21, J.M. v Pankki S (CJEU, 22 June 2023) EU:C:2023:501 Huber, K., Bannert, M. Investigating learning processes through analysis of navigation behavior using log files. J Comput High Educ 36, 683–701 (2024), p684. https://doi.org/10.1007/s12528-023-09372-3 Arizmendi, C.J., Bernacki, M.L., Raković, M. et al. Predicting student outcomes using digital logs of learning behaviors: Review, current standards, and suggestions for future work. Behav Res 55, 3026–3054 (2023), p3026. https://doi.org/10.3758/s13428-022-01939-9 Aghili, R., Li, H., & Khomh, F. (2024). Protecting Privacy in Software Logs: What Should Be Anonymized? ArXiv. https://arxiv.org/abs/2409.11313, p FSE060:2 European Union (2016). General Data Protection Regulation (EU) 2016/679.