Processing of personal data of children in school, leisure and recreation

Apps and digital solutions that can be used in teaching can collect personal information about students during usage.

There are several risks associated with such electronic processing of personal data of children in school.

When a school or municipality decides which personal data should be processed and in which program, children have nothing to say about it and it is therefore imperative not to lose control of the children’s personal data and keep data collection to a minimum.

All data recorded must therefore comply with the basic requirements of data protection legislation, including:

• the processing of personal data is fair,

• the purpose is clear

• proportionality must be observed,

• personal data are correct and reliable.

Most of the time, the school has a legal obligation to register various information in such information systems and as long as the registration is within those limits, it is considered to be allowed.

Before personal data on students are registered in a digital information system, it must be ensured that it is authorized according to the Data Protection Act.

The controllers of the processing of personal data must also ensure that the security of the information is protected. For example, it must be checked whether the personal data is exported outside the European Economic Area (whether it is stored in a company in the US, for example).

Individual employees, such as teachers, should not implement apps, IT systems or other technological solutions without being sure that they are secure and have the right to process their children’s personal data, for example by submitting it to managers who can decide on the use.

The introduction of new technologies such as apps or information technology systems, may require the implementation of a so-called impact assessment on personal protection or advice from a data protection officer.

Parents and children, as appropriate, have the right to receive information about the processing of personal data of children that takes place with the use of the equipment.

See the Data Protection Authority’s website for further information.