​DIAGNOSTIC MIS-"APP"

• Summary: Re-purposing of personal data – The instructor uploaded student photos for educational use, but the AI app used them in public promotional materials, which is a use beyond the original purpose. This represents a privacy and consent violation.

• Purpose Review – The school should ensure it clearly understands and controls the purposes for which student data is used, so that data isn’t used in ways students aren’t aware of or didn’t agree to. For example, vet the app’s data usage policies and obtain consent before any promotional use.

• High Risk – Using student personal data (names, photos) without permission for marketing is a serious privacy breach that could lead to legal and trust issues.
   

• Decision: The risk to student privacy is unacceptable, so the school should intervene. They might stop using the app or demand the vendor remove student data from promotional materials. By applying a Purpose Review safeguard and tightening data use policies, the council mitigates the high risk rather than accepting it. This decision protects students’ privacy and ensures data is only used with proper consent and transparency.