Data Protection Impact Assessment: LearnSphere Horizon Privacy Notice

§1Overview of ProcessingHigh Risk

This Data Protection Impact Assessment evaluates LearnSphere Horizon, an educational technology platform deployed across primary and secondary educational institutions. The platform processes personal data relating to child users ranging from age 5 through 18, encompassing standard academic records, granular behavioural telemetry, and sensitive emotional wellbeing tracking. The processing is conducted continuously on a massive national scale, integrating automated decision-making and connected hardware sensors into the daily educational routine of minors. A formal DPIA is mandatory under Article 35(1) and Article 35(3)(a) of the UK GDPR, as well as Standard 2 of the Children's Code, due to large-scale profiling of vulnerable subjects. The evaluation establishes an acutely deficient compliance posture reflected in an overall score of 28/100, representing substantial systemic risk that requires immediate supervisory remediation.

§2Description of Processing and Data FlowsHigh Risk

LearnSphere Horizon ingests academic evaluations, city-level IP lookups, granular reading velocity, stylus pressure dynamics, and ambient classroom acoustic measurements captured via LearnPad connected tablets. In addition, the platform captures daily emotional sentiment through Wellbeing Pulse, which is analysed using proprietary algorithms to generate an EngagementScore and trigger automated Designated Safeguarding Lead escalations. Personal data flows outbound to commercial analytics consortia under Appendix A and feeds into automated university recruitment marketing pipelines for older pupils aged 16 and 17. The current legal architecture relies erroneously on Article 6(1)(f) Legitimate Interests for commercial data transfers and marketing profiling, subordinating the best interests of the child contrary to Standard 9. Furthermore, emotional wellbeing tracking constitutes health-adjacent biometric data processed without a valid Article 9 special category exception or transparent data retention ceilings.

§3ConsultationNeeds Review

Execution of this DPIA requires formal engagement across internal executive functions, technical engineering teams, educational partners, and child rights representatives. Mandatory internal stakeholders include the Data Protection Officer, Chief Technology Officer, Product Managers, and School Designated Safeguarding Leads. In accordance with UK GDPR Article 35(9), direct consultation must be conducted with child users and parent/guardian panels to assess developmental expectations and privacy harms. Stakeholder consultation sign-offs remain pending and are scheduled as explicit milestones: Technical Review [COMPLETION PENDING: DD/MM/YYYY], Safeguarding Consultation [COMPLETION PENDING: DD/MM/YYYY], and Parent/Child Focus Panels [COMPLETION PENDING: DD/MM/YYYY]. Formal ICO prior consultation under Article 36 is not initiated at this juncture, contingent upon the successful deployment of all risk treatments set out in the risk register.

§4Necessity and Proportionality AssessmentHigh Risk

The platform's processing operations severely fail statutory necessity and proportionality tests set out under UK GDPR Article 5(1)(c). While Section 3.4's safeguarding escalation mechanism fulfills a necessary statutory purpose, capturing ambient classroom acoustics and continuous stylus pressure via LearnPad is grossly excessive and disproportionate to educational delivery. Commercial data monetization through external analytics consortia and gamified retention mechanics (such as 7pm streak loss warnings) are completely unnecessary for core curriculum provision. Less privacy-intrusive alternatives, such as local client-side processing, non-compulsive study reminders, and aggregated institutional reporting, were arbitrarily bypassed in favour of intrusive tracking. Consequently, current processing fails to satisfy the Article 6 legal gateway, as commercial incentives have been unlawfully prioritised over the primary developmental welfare and best interests of the child.

§5Risk Register (Article 35 UK GDPR)8 Thematic Risks

ID / Theme	Risk to Data Subjects	Likelihood	Severity	Overall	Mitigations	Residual
R1 Mandatory Assessment Failure and Algorithmic Profiling	Operating live high-risk algorithmic profiling and emotional wellbeing tracking on children without completing a mandatory child-specific DPIA exposes minors to unassessed psychological, developmental, and discriminatory risks. Affects: Children and adolescent students (primarily ages 13–17) using LearnSphere Horizon · Art. 35(1) UK GDPR Art. 35 ICO Children's Code Std. 2 ICO Children's Code Std. 12 EU KIDS Act Criteria 1, 2, 5	high	high	high	Immediately suspend automated emotional profiling and algorithmic LearnerProfile sorting pending formal assessment. Complete, document, and publish a comprehensive child-specific DPIA tailored to developmental stages. Establish an algorithmic audit protocol to periodically evaluate algorithmic outputs for bias and developmental harm. Owner: DPO	medium
R2 Exploitative Nudge Architecture and Default Privacy Configurations	Deploying gamified retention mechanisms such as 7pm streak loss warnings alongside default open peer visibility causes excessive platform dependency, compulsive evening usage, and unauthorized exposure of minors' activity. Affects: All child users aged under 18 enrolled on the platform · Art. 25(2) UK GDPR Art. 5(1)(c) UK GDPR Art. 25 ICO Children's Code Std. 7 ICO Children's Code Std. 13 EU KIDS Act Criterion 4	high	high	high	Deactivate all compulsive engagement triggers, daily streak mechanics, and automated evening loss warnings. Reconfigure system defaults to the highest privacy state, ensuring social visibility and peer tracking are disabled by default. Grant child users aged under 16 direct technical capability to modify and tighten privacy settings within the platform interface. Owner: Product Manager	low
R3 Age Assurance and Youth Safeguarding Deficiencies	Relying on unverified date-of-birth self-declarations permits underage children to register without age-appropriate guardrails, exposing 13–14 year-olds to unrestricted screen time and lacking statutory protections. Affects: Children under 13 attempting registration and minor users aged 13–15 · Art. 8(1) UK GDPR Art. 8 ICO Children's Code Std. 3 EU KIDS Act Criteria 3, 7	high	high	high	Deploy robust, privacy-preserving age assurance mechanisms to verify age bands without collecting unnecessary identity documents. Implement restricted 'mini-accounts' for users aged 13–14 with a mandatory default one-hour daily screen-time limit. Integrate verified parental consent flows for all registration attempts by children below digital age of consent. Owner: Chief Technology Officer	medium
R4 Covert Parental Surveillance and Loss of Developmental Autonomy	Allowing parents to secretly monitor sensitive Wellbeing Pulse ratings and historical engagement telemetry via FamilyView infringes the child's developmental autonomy and destroys trust in mental wellbeing tools. Affects: Minor pupils participating in Wellbeing Pulse and emotional tracking modules (ages 11–17) · Art. 5(1)(a) UK GDPR Art. 5(1)(a) UK GDPR Art. 12 ICO Children's Code Std. 11 EU KIDS Act Criterion 8	high	medium	high	Implement prominent real-time in-app visual indicators notifying the child whenever parental oversight dashboards are active. Restrict parental visibility to high-level developmental milestones rather than unmediated raw daily emotional pulse records. Provide age-appropriate notifications explaining to minors exactly what information guardians can access under FamilyView. Owner: Product Manager	low
R5 Connected Hardware Telemetry and Physical-World Surveillance	Harvesting background classroom acoustic levels, stylus biometric pressure patterns, and reading velocity via LearnPad hardware without distinct notice or opt-outs constitutes intrusive, disproportionate physical surveillance. Affects: Students utilizing LearnPad connected hardware devices in educational settings (ages 5–18) · Art. 5(1)(c) UK GDPR Art. 5(1)(c) UK GDPR Art. 9 ICO Children's Code Std. 14 EU KIDS Act Criterion 8 PECR Reg 6	high	high	high	Disable ambient classroom microphone recording and stylus biometric pressure telemetry by default across all device profiles. Decouple core educational software functionality from secondary sensor harvesting to ensure hardware usability without surveillance. Introduce granular hardware toggles accompanied by separate, unbundled consent mechanisms administered via educational institutions. Owner: Chief Technology Officer	medium
R6 Commercial Data Sharing and Direct Marketing Profiling	Exposing student behavioural telemetry to commercial analytics consortia under legitimate interests and automatically routing students aged 16+ into university recruitment pipelines subordinates child welfare to commercial exploitation. Affects: Secondary school students aged 13–17, specifically older adolescents aged 16–17 · Art. 6(1)(f) UK GDPR Art. 6(1)(f) UK GDPR Art. 21 UK GDPR Art. 22 ICO Children's Code Std. 1 ICO Children's Code Std. 9 ICO Children's Code Std. 12 EU KIDS Act Criteria 4, 6	high	high	high	Immediately terminate all transmissions of pseudonymised behavioural datasets to commercial analytics consortia. Cease automated marketing profiling for university recruitment, replacing it with an unbundled, active opt-in directory model. Update records of processing activities to remove reliance on Legitimate Interests where commercial profiling impacts minors. Owner: Commercial Director	low
R7 Obstruction of Data Subject Rights and Unlawful Administrative Fees	Depriving minor users of self-service privacy tools, barring under-16s from exercising rights independently, and levying an unlawful £10 fee for written requests effectively extinguishes fundamental data protection rights. Affects: All child users and pupils registered on the LearnSphere Horizon platform · Art. 12(5) UK GDPR Art. 12(5) UK GDPR Art. 15 UK GDPR Art. 17 ICO Children's Code Std. 15	high	high	high	Immediately revoke the £10 subject access fee across all published policies and communication channels in compliance with Article 12(5). Develop age-stratified, self-service in-platform privacy controls enabling children to directly view, download, or delete their data. Revise standard operating procedures to recognise the independent exercise of rights by children possessing requisite maturity. Owner: DPO	low
R8 Opaque Transparency and Non-Compliant Tracking Technologies	Presenting complex legalistic privacy text to children and deploying pre-ticked cookie categories via browsewrap mechanics undermines lawful consent and leaves minors unable to understand how their data is exploited. Affects: All child visitors, enrolled pupils, and guardians accessing the web portal · Art. 12(1) UK GDPR Art. 12(1) UK GDPR Art. 13 ICO Children's Code Std. 4 PECR Reg 6	high	medium	high	Redraft the privacy documentation into age-stratified, bite-sized explanatory layers utilising visual and multimedia explanations. Dismantle browsewrap notices and replace non-compliant pre-ticked cookie banners with an active opt-in consent mechanism. Implement contextual, timely 'just-in-time' privacy notices at the point of collecting emotional, sensory, or profile data. Owner: Legal Counsel	low

§6Overall Residual Risk and ICO Prior ConsultationNeeds Review

Following the rigorous implementation of the eight corrective mitigation packages outlined in the risk register, the overall residual risk posture is reduced from high to medium. Specific high risks relating to commercial profiling (R6), nudge mechanics (R2), unlawful fees (R7), and covert parental inspection (R4) have been mitigated to low, while sensor harvesting (R5) and algorithmic evaluation (R1) remain at medium. Because no residual risk remains classified as high post-mitigation, mandatory prior consultation with the Information Commissioner's Office under UK GDPR Article 36(1) is not legally required at this stage. However, should executive leadership fail to implement the mandated mitigations—specifically the cessation of consortium sharing and removal of gamified nudges—the residual risk will revert to high, requiring immediate statutory referral to the ICO with an expected 8-to-14-week statutory determination period. This DPIA must be maintained under continuous oversight and formally reviewed on a minimum annual cycle, setting the next mandatory audit for 29/09/2027.

§7DPO Sign-offHigh Risk

Title	Data Protection Officer
Organisation	PrivaComply Ltd
Signature	[PHYSICAL OR DIGITAL SIGNATURE REQUIRED]

This formal sign-off records the independent evaluation of the Data Protection Officer and is a binding regulatory governance artifact that must precede any platform deployment. Reviewing Officer: David Anderson, CIPP/E, CIPM (Data Protection Officer)

Professional Qualifications: IAPP CIPP/E, CIPM. The DPO has independently scrutinized the risk register (risks R1 through R8) and concludes that operation under the current Privacy Notice represents an unacceptable compliance exposure. Date Signed: [AWAITING DPO SIGNATURE]

Statutory Review Date: [12 months from sign-off or upon material architecture change]. Note that formal DPO approval and human-in-the-loop sign-off of this DPIA represent a distinct legal governance milestone separate from operational compliance auditing.

📋 Data Protection Impact Assessment: LearnSphere Horizon Privacy Notice