A school district tutoring AI scrapes the LMS nightly without validating consent flags on student records. What should audit require?
Select an answer to reveal the explanation.
Short Explanation
Nightly scrapes that ignore consent flags are a privacy foul. Check allowable-use markers in the pipeline before student data feeds tutoring AI. Encrypting the nightly extract in transit is good security, but it doesn't confirm consent before ingestion.
Full Explanation
A school district tutoring AI that scrapes the LMS nightly without validating consent flags on student records risks unauthorized processing of student data for training or inference. Audit should require validating consent and allowable-use flags in AI data pipelines before ingesting student records so only properly authorized records enter tutoring AI workflows and missing or negative flags block use. Checking consent and allowable-use flags only during quarterly reviews after tutoring delivery fails by concept: post-delivery review cannot catch unauthorized records before they enter tutoring AI workflows, and consent must be validated before ingestion. Encrypting LMS extracts in transit to the tutoring platform fails by concept: transport encryption protects data while moving but does not validate consent or allowable-use flags before student records are ingested. Retaining tutoring interaction logs under the district retention schedule for model improvement reviews fails by concept: log retention addresses recordkeeping after use, not the pre-ingestion gate that blocks unauthorized student records. Exam caveat: AAIA AI data-management items on education pipelines treat automated consent/allowable-use validation as a core control—not quarterly post-delivery reviews, transit encryption alone, or log retention for model improvement. Operational check: integrate consent and allowable-use fields into the LMS extract, fail closed on missing/deny flags, log blocked records, periodically reconcile paper consents into the system of record, and sample tutoring AI training and inference sets for unauthorized student records.