Processing of personal data of children in school, leisure and recreation
Distance education
It is clear that the special circumstances that existed due to the coronavirus pandemic changed the working and study environments where it was important to be able to use technical solutions, both for homework, teaching, exams and school-to-home communication. Such solutions are still used and it is important that such solutions meet the conditions set by law.
The Data Protection Authority's website provides guidance on the main points to consider when using technology solutions in distance learning.
Points to consider:
teachers, parents and students should be provided with good information on the tools and technical solutions to be used
it may be desirable to coordinate the use of technical solutions between schools
if administrators are not sure that the use of certain technical solutions is permitted and in accordance with the data protection laws, they should contact the local or school data protection officer as appropriate
it may be necessary to carry out a risk assessment before new technologies are introduced and introduce appropriate safety measures
teachers must examine the management's attitude to technical solutions before putting them into use
must always be used with the utmost care when processing sensitive personal data such as health
Security of personal data
The security of the information generated by recordings or streams must be strictly observed, such as the fact that it is not made available to the unauthorised.
When selecting equipment, the controller must take care to take appropriate technical and organisational measures, taking into account the nature, extent, context and purpose of the processing and the risk to the rights of the data subject; where appropriate, an assessment of the impact on the protection of personal data must be carried out.
It is important to consider whether a digital solution is hosted outside the EEA. Many cloud services are hosted abroad and it is therefore necessary to consider whether there is an adequate authority to transfer personal data out of the country or choose a solution that does not include such transfer.
