An EdTech company deploys an LMS to 1,200 schools. Students aged 6–18 use the platform. The EdTech collects learning analytics, quiz scores, and behavioural inference (predicted learning style, risk-of-dropout score). It uses anonymised student data to improve its AI recommendation engine. The school's annual admission form included a clause about "educational technology services."

Who must obtain parental consent — the school or the EdTech?

The school is the primary Fiduciary. But when the EdTech independently determines how to use analytics data to improve its own product, it becomes a co-Fiduciary for that purpose — with its own §9 parental consent obligation. The admission form clause does not satisfy this requirement.

Can the EdTech use anonymised student data to train its AI recommendation engine?

§9(2) prohibits behavioural monitoring of minors. Using individual student learning patterns to train a recommendation model constitutes behavioural profiling. The safest implementation: aggregate at cohort level (Grade 7 students with pattern X), prove k-anonymity at minimum k=50, document the methodology in ROPA.

A parent withdraws consent. Must the EdTech delete the student's entire learning history?

EdTech's own analytics/product data: must delete. Academic records (assessment scores, attendance) that form part of the student's academic history: the school has a legitimate basis to retain under educational regulations. The EdTech should export this data to the school's own systems and delete it from its servers, or maintain it in a school-controlled partition where the school is Fiduciary and EdTech is Processor with no independent access.