Some Student Data Should Never Become Digital

By: Charles Fadel, Center for Curriculum Redesign

Adapted from “Cognitive Security Architecture for Student Learning Data” 

Schools have been capturing student data for decades, and eventually will also use new applications such as Intelligent Tutoring Systems (ITS) that can adapt to each student’s pace, performance, and learning needs. But the key question becomes what kinds of student data they create, how long that data persists, and whether some information about a child should ever be digitized at all.

Student data is no longer limited to grades, attendance, test scores, or assignment completion. Modern learning systems can observe response times, hesitation patterns, engagement signals, repeated errors, abandoned tasks, and changes in behavior over time. From those signals, systems may infer far more sensitive conclusions: cognitive difficulty, emotional state, personality traits, anxiety risk, motivation, confidence, persistence, and other psychological characteristics.

That is where the line must be drawn.

The danger is not only a data breach, but a malevolent state that wishes to influence student development at scale, or freelance hackers. Breaches matter greatly, but they are not the only problem. A student profile can be collected lawfully, stored securely, and accessed only by authorized parties—and still be harmful. The harm also lies in the existence of a persistent, queryable psychological record of a child.

Children are not fixed objects to be classified. They are developing people. A label assigned at age nine can follow a student long after it has stopped being accurate. “Low engagement,” “anxiety-prone,” “poor executive function,” or “high cognitive difficulty” may begin as internal system inferences, but they can shape teacher expectations, intervention pathways, parent perceptions, and eventually the student’s own self-concept.

That is why the most important design question is not simply “How do we secure the database?” It is: “Should this information be in a database at all?”

The distinction between digital and analog records is therefore critical. Some information can reasonably be stored digitally, with strict limits: learning progress, pacing, and short-term engagement data needed for instruction. Other information should be session-only, meaning it may support immediate scaffolding but should not persist across time. And the highest-risk categories—emotional state, personality traits, anxiety or risk profiles—should not be digitally derived or stored. If such observations are needed, they belong with the teacher, in human judgment, and in analog form.

This is not nostalgia for paper or Luddite behavior. It is risk management.

A paper note in a teacher’s notebook is limited by design. It is not easily aggregated, queried, sold, copied into another system, merged with external data, or decrypted years later. It ages with context. It remains tied to professional judgment rather than automated classification. A digital record, by contrast, is durable, searchable, portable, and vulnerable to future uses no one can fully predict today.

The following table, extracted from Cognitive Security Architecture for Student Learning Data offers a practical boundary between acceptable digital learning data and sensitive student information that should remain analog.

The practical implication is straightforward: education systems should separate learning data from psychological profiling. A tutoring system may need to know that a student has not mastered fractions. It does not need to infer that the student is anxious, impulsive, disengaged, or low in persistence. The first supports instruction. The second risks turning a temporary developmental moment into a durable identity label.

Digital systems should therefore be built around data necessity, short retention, and strict inference boundaries. They should collect only what is needed for learning, retain it only as long as necessary, and block categories of inference that are too personal to justify. For the most sensitive observations, the safest architecture is not stronger encryption. It is non-digitization.

The point is not to reject intelligent tutoring or personalized learning. The point is to keep personalization educational rather than psychological. Students deserve support without becoming permanently profiled. They deserve learning systems that adapt to what they need today without building dossiers about who they supposedly are forever.

All student data should be protected.

Some should expire.

And some should never become digital in the first place.