Short answer: rarely, and for a public institution almost never. Recital 43 says consent is not a valid ground where there is a clear imbalance between data subject and controller, “in particular where the controller is a public authority”. Article 6(1) then closes the legitimate-interests route for public bodies acting in their public task. One basis is usually left standing.
This matters operationally rather than academically. A deployment recorded against the wrong lawful basis creates obligations the institution cannot honour, and the discovery usually happens at the worst moment — when a student asks to be taken out of a system that is embedded in their assessment.
What does the GDPR actually offer?
Article 6(1) provides six bases, and processing is lawful only if at least one applies:
- (a) Consent — the data subject has given consent for one or more specific purposes.
- (b) Contract — processing necessary for the performance of a contract to which the data subject is party.
- (c) Legal obligation — necessary for compliance with a legal obligation to which the controller is subject.
- (d) Vital interests — necessary to protect someone’s life.
- (e) Public task — necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- (f) Legitimate interests — necessary for the legitimate interests of the controller or a third party, except where overridden by the data subject’s interests or rights.
Then comes the sentence that decides most of this for a public university. Article 6(1) provides expressly that “point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.” Legitimate interests is not available to a public institution for the processing it does as part of its public task. That is a scope exclusion in the Article itself, not an interpretation.
Why is consent the wrong basis here?
Because of the imbalance between the parties, and the Regulation says so directly. Recital 43:
“In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.”
The European Data Protection Board develops this in its Guidelines 05/2020 on consent under Regulation 2016/679 (adopted 4 May 2020), section 3.1.1, “Imbalance of power”:
“Recital 43 clearly indicates that it is unlikely that public authorities can rely on consent for processing as whenever the controller is a public authority, there is often a clear imbalance of power in the relationship between the controller and the data subject. It is also clear in most cases that the data subject will have no realistic alternatives to accepting the processing (terms) of this controller. The EDPB considers that there are other lawful bases that are, in principle, more appropriate to the activity of public authorities.”
Read the second sentence carefully, because it is the operative test for a deployment: no realistic alternative to accepting the terms. A student whose supervisor’s feedback runs through a platform, or whose submission portal is that platform, has no realistic alternative. Their agreement is not consent in the Article 4(11) sense; it is compliance.
When would student consent be valid?
Where refusal carries no detriment — and the EDPB’s own worked example is from education. Its Example 4:
“A public school asks students for consent to use their photographs in a printed student magazine. Consent in these situations would be a genuine choice as long as students will not be denied education or services and could refuse the use of these photographs without any detriment.”
Apply that test to your deployment honestly. If a student declines the AI writing platform, can they complete the same assessment, receive the same supervisory feedback, and be marked on the same basis, with no additional burden? If the answer is yes, consent may be genuine. If the answer requires a caveat, it is not.
The EDPB draws the same conclusion in the employment context in stronger terms: given the imbalance, staff “can only give free consent in exceptional circumstances, when it will have no adverse consequences at all whether or not they give consent.” A doctoral candidate’s relationship to a supervising institution sits closer to that end of the spectrum than to a consumer’s relationship with an app.
What goes wrong if we choose consent anyway?
Four consequences, and each one lands on a different office.
- Withdrawal must be as easy as giving. The EDPB is explicit that where consent is obtained through a single click, it must in practice be withdrawable equally easily. If your consent flow is one checkbox at enrolment and withdrawal requires an email to a shared mailbox and a manual account deletion, the basis is already failing.
- Withdrawal must actually stop the processing. Which means you need a route through the assessment that does not use the platform — designed, staffed and documented in advance, not improvised for the first student who asks.
- Consent must be granular. Recital 43 presumes consent is not freely given if it does not allow separate consent for different processing operations. A single acceptance covering the writing tool, the similarity check and any analytics is one consent doing three jobs.
- You have volunteered an audit trail you must maintain. Demonstrating consent means holding a record, per data subject, per purpose, per version of the notice, for the lifetime of the processing.
None of those obligations exists in the same form under Article 6(1)(e). Choosing consent when a public-task basis was available is a self-inflicted operational burden, and it is the single most common finding when a deployment is reviewed after the fact rather than before it. The review itself is a documented procedure — see our data protection review before deploying an AI writing tool for the sequence and the artefacts each step produces.
So which basis should we use?
For a public university deploying a tool as part of teaching, assessment or supervision, Article 6(1)(e), public task, is normally the answer. Three things follow from choosing it.
- It must be grounded in law. Article 6(3) requires the basis for (c) and (e) processing to be laid down in Union or Member State law. In practice that is your enabling legislation, charter or statutory instruments, and it should be named in your record of processing rather than assumed.
- Necessity is the test, not convenience. “Necessary for the performance of a task” is a real threshold. If the same educational outcome is achievable without processing a given category of data, that processing is not necessary and the basis does not cover it.
- Data subjects gain a right to object. Under Article 21 the right to object applies to processing based on (e) and (f). It is not an absolute right — you may continue where you demonstrate compelling legitimate grounds — but it must be handled, and it is a different workflow from a consent withdrawal.
Private institutions are in a different position: Article 6(1)(f) is available to them, and contract may be arguable where the tool is genuinely part of what the student is enrolled to receive. The analysis differs by institution type, which is exactly why it should be written down rather than inherited from a peer’s privacy notice.
Does this change anything about the vendor?
Yes, in one specific way. The lawful basis governs the institution’s processing as controller. It does not license the vendor to do anything additional with the text, and it does not answer whether student work may be retained in a matching corpus or used to improve a model — those are separate permissions established in the contract and the data processing agreement, and the distinction is worked through in whether student work is used to train AI models.
The practical sequencing is: settle your own lawful basis first, because it determines what you are permitted to ask a processor to do on your behalf. An institution that has not settled it will negotiate a data processing agreement without knowing the boundary it is negotiating toward. The questions to put to a supplier at that point are set out in our procurement question bank.
Where should the decision live?
In the record of processing activities and in the student privacy notice, in the same words. Not in a slide deck, and not only in the DPIA. A basis recorded in one place and described differently in another is the finding a regulator writes up.
It also belongs in the institution’s AI policy, because the policy is what survives a change of supplier — the drafting components are set out in what a university AI policy should include.
If you would like to work through the lawful basis, the record of processing and the DPA against a specific deployment, request an institutional evaluation and we will go through it with your data protection officer.
Frequently asked questions
Can a university rely on student consent for an edtech deployment?
Rarely. Recital 43 excludes consent where there is a clear imbalance between data subject and controller, in particular where the controller is a public authority, and the EDPB states that other bases are in principle more appropriate for public authorities.
Which lawful basis applies instead?
Usually Article 6(1)(e), performance of a task carried out in the public interest or in the exercise of official authority. Article 6(1) expressly disapplies legitimate interests for public authorities acting in the performance of their tasks.
Does that mean legitimate interests is never available to a university?
Not never. The exclusion covers processing carried out by public authorities in the performance of their tasks. Processing outside that task, and processing by private institutions, is a different analysis, and it should be documented rather than assumed.
When is student consent genuinely valid?
Where refusal carries no detriment. The EDPB’s own example is a school asking to use student photographs in a magazine: valid so long as students are not denied education or services and can refuse without any detriment.
What does the imbalance-of-power argument actually turn on?
Whether the student has a realistic alternative to accepting the terms. The EDPB’s phrasing is that in most cases the data subject will have none.
If we use consent, what must we be able to do?
Let students withdraw as easily as they agreed, stop the processing when they do, take consent separately for separate purposes, and hold a demonstrable record per student per purpose.
Do we need an alternative route for students who decline?
If consent is your basis, yes — and it has to exist before the first student asks. An assessment that can only be completed through the platform is evidence that consent was never freely given.
Does Article 6(1)(e) need to be grounded in something?
Yes. Article 6(3) requires the basis for (c) and (e) processing to be laid down in Union or Member State law. Name the instrument in your record of processing.
What right does a student have if we use public task?
The Article 21 right to object applies to processing based on (e) and (f). It is not absolute, but it is a workflow you must be able to run, and it is not the same as a consent withdrawal.
Does the lawful basis settle what the vendor may do?
No. It governs the institution’s processing as controller. Vendor retention and any training use are separate permissions, established in the contract and the data processing agreement.
Is a DPIA required as well?
The lawful basis and the DPIA are different documents answering different questions. Selecting a basis does not discharge the assessment obligation, and the assessment does not establish a basis.
Where should the basis be recorded?
In the record of processing activities and in the student privacy notice, in consistent language. A basis described two different ways in two documents is a finding waiting to be written up.