Digital Privacy in Education: Surveillance, Data Governance, and Privacy-Respecting Alternatives in Japan and Beyond

Digital technologies are now embedded in educational administration, teaching, assessment, and communication, but the expansion of educational technology has also intensified the collection and analysis of student data. This critical narrative review examines digital privacy in education through scholarship on learning analytics, surveillance, platformization, children's rights, data protection, and educational technology governance. It combines international literature with a focused analysis of Japan, where the GIGA School Program accelerated one-device-per-student computing and where education data are governed through the Act on the Protection of Personal Information (APPI), MEXT guidance, and decentralized local procurement. The review argues that the main privacy risks are not limited to discrete data breaches. They include function creep, opaque third-party tracking, coerced participation, behavioral profiling, disproportionate surveillance, and weak institutional accountability. Japan has strengthened its formal governance framework, including updated MEXT guidance on educational data, yet implementation remains distributed across schools, municipalities, vendors, and other actors. The paper proposes privacy by design, data minimization, stronger procurement and impact-assessment practices, meaningful student participation, and greater consideration of auditable and locally controllable software architectures. Free and open-source software can support these goals when appropriately governed, but should not be treated as automatically private or secure. Digital privacy is therefore best understood as a condition of trustworthy, rights-respecting education rather than as a narrow technical compliance issue.