"What am I allowed to do with AI?" is a simple question with a complex answer... AI tools are constantly evolving, so even a comprehensive guide is out of date the next day. That is why it is important for staff to understand the principles those decisions are based on.
Here are the two simple rules for keeping data safe:
WeST classifies its data into four categories: Public, Internal, Confidential, and Highly Confidential.
Most files and email will not have any obvious label to tell you its classification, but it is implied by the nature, source, and content of the data.
The majority of our work in WeST will be using Internal or Confidential data. The most sensitive data we work with is Highly Confidential. But we also work with large quantities of Public data which includes anything created by WeST for release (e.g. school newsletters), as well as anything anyone else has (legally!) made publicly available on the internet (including e.g. DfE national statistics).
The higher the data classification, the more damage is caused if a Data Protection breach occurs. Uploading and/or pasting data classified Sensitive or above into any platform or tool we do not have an approved Data Protection Impact Assessment for does constitute a Data Breach.
Click the image above if you would like a 2 minute breakdown of our Data Classifications, created by an AI.
The higher the data classification, the greater the risk, and therefore the fewer AI tools it is appropriate to use. In WeST, we have Enterprise-level Data Protection Agreements with companies like Microsoft and Google for Education, that allow sensitive data to be input into specific AI tools safely. Outside of those Agreements, it is essential we do not breach Data Protection by inputting and pupil or staff data.
If you are making lesson plans and resources, trying to get a summary of a long DfE publication, or working with any other Public data, it's absolutely fine to use whichever reputable AI tool you are most comfortable with, and best suits your needs.
It is when you want to work with any pupil or staff data, even if it is only names, that it immediately becomes essential to only use tools we have Data Protection Agreements for. Many software platforms and tools have AI built into them; every platform we use in WeST must have a Data Protection Impact Assessment (DPIA) completed to ensure it uses our data safely. So if an AI tool is provided for you by WeST/your school (e.g. Copilot), that will have a DPIA in place to ensure it uses data safely.
For all work purposes, WeST expects AI tools to be legal and appropriate for business use. Mainstream tools like Copilot, ChatGPT, etc., easily meet all of these criteria.
All AI tools used for any work purposes in WeST must fulfil all the following criteria:
