Educational institutions, such as universities, universities of applied sciences, vocational colleges and schools for secondary and primary education process a great amount of personal data related to pupils, students and staff. In many cases, these data fall within the category of sensitive personal data.
Challenges within education
Schools often work with digital systems, such as testing programs and pupil or student tracking systems. For the purpose of providing appropriate education or to facilitate students with a disability, schools also process data on health. There is a stricter regime for this kind of data than for other personal data; these so-called special (sensitive) data should therefore be better protected. Furthermore, schools must provide a wealth of personal information to municipalities, partnerships, the student loans agency, accreditation bodies and supervising bodies, such as the Inspectorate of Education. Furthermore, schools and their pupils, students and staff often use social media, for example by taking pictures in the classroom and distributing them via social media, or if the teacher creates a group chat.
Just like every organization that processes personal data, schools also have an accountability obligation. This means that schools must record their processing operations and list them in their register of processing operations. They must be able to demonstrate the technical and organizational measures they have taken to protect the personal data of pupils, students and staff, and the extent to which these measures are effective. In case of high-risk data processing, schools must carry out a data protection impact assessment (DPIA), and determine how the risks can be contained.
We specialize in providing guidance to schools with regard to data processing. We do this, among other things, through our accountability review. This review creates an account that the school board can present in order to show the extent to which the organization meets the requirements of the relevant laws and regulations.
Want to know more?
Contact us. We are delighted to meet you.