Yes. Oral exercises in Brian comply with the GDPR, the Swiss FADP, and the EU AI Act. Brian's AI evaluates what students say – not who is speaking or how they feel while doing so.
How an oral exercise works
The teacher sets a role in the AI Dialogue, such as a customer in a sales conversation. Students speak into the microphone, and the AI understands the content and responds in real time with an AI voice. Speech processing runs on Google's Gemini infrastructure (Vertex AI) in data centers in the EU. Google does not use the data to train its models.
Here, the voice is not a biometric feature
A voice recording is personal data, but not a special category of personal data. A voice only becomes biometric data when it is analyzed to uniquely identify a person (Art. 4(14) and Art. 9 GDPR, Art. 5 let. c no. 4 FADP). Brian does not identify students by their voice – they sign in with their Brian account as usual.
EU AI Act
- No emotion recognition: The AI Act prohibits AI systems in educational institutions that infer emotions from a person's voice (Art. 5(1)(f)). Brian's AI does not recognize emotions, moods, or attitudes. It processes the content of what is said and responds to it.
- Transparency: People talking to an AI must know it (Art. 50). Every oral exercise is clearly labeled as an AI Dialogue, and the counterpart speaks with an AI voice.
- The teacher steers the learning process: Annex III classifies AI systems that evaluate learning outcomes – including when these outcomes are used to steer the learning process – as high-risk. In Brian, the teacher steers the learning process, not the AI. Formative feedback and points are prompts for practice and do not count toward grades. The teacher decides what comes next and how performance is assessed.
GDPR and FADP
- Legal basis: The educational institution is the controller. It bases the use on its educational mandate or on consent.
- Decision of the educational institution: Oral exercises are a separate feature that each educational institution can turn off individually.
- Processing on behalf of the institution: Brian processes the data on behalf of the educational institution. Google acts as Brian's sub-processor.
- Data location: Processing takes place in EU data centers. For educational institutions in Switzerland, the EU is recognized as providing an adequate level of data protection.
- Data protection impact assessment: For use with minors, we recommend that the educational institution carry out a data protection impact assessment. Brian provides the necessary information.