IDPC raises awareness on AI data protection concerns for students including higher education settings

21 May 2025

Dr Marco Fagnano, legal counsel at the Information and Data Protection Commissioner (IDPC), delivered a presentation at the MDIA’s Digital Innovation Hub (DiHubMT), offering guidance to licensed higher education stakeholders on the use of AI systems in admissions, grading, and academic development. The session focused on compliance with the EU AI Act and the General Data Protection Regulation (GDPR).

Dr Fagnano outlined how GDPR principles—such as lawfulness and purpose limitation—apply in educational settings, providing practical examples based on local legislation. He highlighted the high-risk nature of AI applications like biased admissions, automated grading and behavioural monitoring, which can significantly affect students’ future prospects and infringe their fundamental right concerning data protection.

Educators were urged to critically assess AI-driven decision-making, particularly regarding progression or support access, and to comply with Article 22 of the GDPR by avoiding decisions made solely by automated or autonomous means. He stressed the need for human oversight, accountability, and mechanisms to prevent bias or discrimination, especially against vulnerable or disadvantaged students.

Ultimately, Dr Marco Fagnano emphasized that AI should support—not replace—human judgment, ensuring human intervention to prevent long-term academic or professional prejudice, which must remain a key priority with the adoption of AI. 

As part of its supervisory role under the AI Act, the IDPC is raising awareness ahead of the entry into force of the AI Act in close coordination with the Malta Digital Innovation Authority (MDIA), targeted at Education institutions and bodies.