The State Data Inspectorate has received many requests in order to clarify the compliance of the remote learning organization with the General Data Protection Regulation. Requests for clarifications were sent both by worried parents for possible minors privacy breaches, both to education institutions and municipalities which are trying to find best solutions in order to continue to organize the remote working without compromising the quality of the training.
The Inspectorate has concluded that, even if a lot of preoccupations have been exposed about the personal data processing for one aim, these preoccupations are connected to two related processing activities:
- remote training;
- registration of the training process.
Talking about the organization of the remote training, the Data Inspectorate explains that the legal basis applicable to the personal data processing for the online lessons could be the article 6, paragraph 1, letter e) del GDPR (the process is necessary for a public interest or lawful processing by the data controller).
The implementation of the legal basis according to the article 6, paragraph 1, letter e) of the GDPR it is possible only if the personal data processing is carried out for the execution of a delegate tasks into the legislative act and by keeping in mind the proportionality of the tasks which are carried out and interests of people which data will be processed.
In accordance to the subparagraph 27.1 of the Cabinet Regulation n. 360 of the 9th June 2020 “Epidemiologic security measures in order to limit the diffusion of the Covd-19 infection” the educational institutions (except colleges and universities) can determine the procedure with which the educational program can be carried out by a partial or a completely remote process.
The Data Inspectorate keeps in mind the interaction of a teacher with its children and students which can be an important element into their educational process. While participating face-to-face in lessons, all the participants can see and listen to themselves, by getting closer to the condition of an online learning to lessons can help professors of using the existent work with students in new contests.
Consequently, the Data Inspectorate explains that in order to prevent the Covid-19 infection diffusion into the society, by following the basic principles established by the above mentioned legislation, the educational institutes can establish procedures for the organization of online lessons on the website including the identification, it is necessary ask students to use video cameras during the lesson.
Talking about the registration of the learning process, it is noticed that, similar considerations are worth for the determination of the legal basis and the compliance with the requirements for its application.
In addition to what has been mentioned above, it is important to assess who offers the record, what is directly visible (different considerations can be applicable to the record in which the professor is explaining the topic, but if the other students and their reaction to the new subject are visible also people, how long and for which aims it will be available the obtained record).
In view of the above and other considerations regarding recording and its availability, the school has the right to choose to record the learning process. However, the school must be able to justify the necessity of this choice for a safe and high quality learning process. Again, the school should establish in an internally binding document (procedure, order, etc.)
The terms for keeping the record, the right of access to the record (who can view it), as well as other (security) and organisational requirements to prevent unauthorised access, modification, copying, distortion and other uses of the record are not consistent with the intended purpose of the processing of personal data.
In addition, the Inspectorate draws attention to the fact that it is also important that students are careful not to disclose unnecessary information about themselves, their own and their family’s living conditions, etc. during online classes. Therefore, the Inspectorate draws attention to the fact that most remote communication platforms have features that allow you to blur, replace or otherwise change the background image when participating in a distance learning lesson.
For example, MS Teams needs to select the “Background Filters” option when connecting to a meeting and turning on the camera (this option will be available in the desktop software). After the background settings are available in the right-hand panel, you can blur the background settings here; choose an image from the options offered; or you can add a new background from your computer using *.jpg or *.png files. Using this feature can hide the background from prying eyes. The inspectorate encourages you not to select images that are offensive to other meeting participants by using the feature.
In addition, we point out that the school must find a solution to guarantee the rights of the persons concerned, including informing the parents of the children about the recording of lessons.
The Inspectorate draws attention to the fact that if the learning process is recorded by parents or pupils, such processing must ensure compliance with the Rules.
Parents, pupils and third parties will not be able to use Article 6(1)(e) of the Regulation, but detailed information on video surveillance by private individuals can be found in the Inspectorate’s guidelines for private video surveillance of cameras-installation-and-video-surveillance-individuals-private individuals, in which case the recommendations expressed in the guidelines can also be used to obtain a study record.
Regulation 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 /CE.