School needs to better protect student data
New European rules give parents and students more control over their personal data from 25 May. The Education Magazine answers seven questions about the consequences for teachers.
Picture: Len Munnik
Why a new law?
It is not that new at all. In 2016, the European Parliament already approved the General Data Protection Regulation (GDPR), regulations that must protect the personal data of all citizens in the European Union in a uniform and better way. Organizations, such as schools, were given two years to comply with this law. From May 25, the AVG will replace all national privacy legislation, such as 'our' Personal Data Protection Act. Schools that fail to comply with the rules risk a hefty fine.
What data is it?
In the first place the name and address details: names, addresses, telephone numbers and e-mail addresses. What is new is that the e-mail addresses of your work also fall under personal data. All this information may therefore not simply be distributed in a school guide or in a class list without permission. In addition, it concerns data such as social security number, religion or medical data. Even stricter rules apply to this type of sensitive information.
What is changing?
A school is obliged to substantiate why it wants to collect data from students and for how long it wants to keep it. In addition, you may not request more data than is strictly necessary and after termination of use, everyone has the right to 'be forgotten'. This means that a school must also delete the data. The school must also ensure proper security of the student administration and student tracking systems and must have records of who read or modified which files.
Requesting permission more explicitly is another point, for example when using photos. For students under 16 years of age, a signature from the parents is required. It must be clear what they agree with (specific purpose), consent must be requested every year and can just as easily be withdrawn. So it is not: once given, it remains given.
What does this mean for your work?
Each school must make clear agreements about who has access to student data, when and for what purpose. You may only access data that is relevant to you, unless otherwise agreed. As a teacher you are only allowed to access the data of your class and an internal supervisor is only allowed to access the files of students who need extra care or guidance. A substitute only has temporary access to relevant information: for the duration of his contract.
What about social media and app groups?
The privacy of WhatsApp, for example, is not guaranteed: because data such as telephone numbers are visible to every participant. Teachers must ask students or their parents for permission to share data via WhatsApp. In addition, agreements must be made with providers of apps and social media about what they do with data. That doesn't seem easy, but an app like Parro is in any case safer.
Who controls what?
The school is responsible for safeguarding the privacy of students and has to carry out risk analyzes. The so-called privacy covenant helps schools to make agreements more easily with suppliers and publishers about how they handle student data safely. The new 'data protection officer' (DPO) will play a major role in this. The Dutch Data Protection Authority supervises compliance with this privacy legislation. The supervisor can ask the DPO for text and explanation and has the power to impose fines.
What can I do myself to ensure privacy?
First of all, be careful with login details: use a good password that consists of several letters and characters, keep that secret, and replace it every so often. Check whether the connection you are using is secure. A public WiFi connection in the library or at the station is easy to tap. Before sending personal data, think carefully about the purpose and to whom you are sending it: are the recipients allowed to have this information? Finally, do not use USB sticks for sensitive information, as they will often get lost.
Op www.knowledgenet.nl contains five rules of thumb for dealing with student data and an online approach for schools. The website www.autoriteitpersoonsgegevens.nl offers a teaching package for groups 7 and 8. Look at www.sambo-ict.nl for information about privacy in secondary vocational education.
