(by Davide D'Amico MIUR Manager and AIDR Director) With the provision of 26 March 2020, the Guarantor for the protection of personal data intervenes in the matter of the right to protection of personal data in distance learning to provide useful information to schools, universities students and families. The goal is to ensure "as conscious and positive use of new technologies for educational purposes".
In particular, the Guarantor dwells on the fact that schools and universities must not request consent to the processing of data of teachers, pupils, students, parents as it falls within the functions institutionally assigned to the schools and universities themselves.
However, schools and universities must pay particular attention to the choice and regulation of digital tools used for distance learning. In particular, these tools must be characterized by data protection measures from the design phase and by "default settings". And again, it is possible to exempt from the impact assessment for the treatment carried out by the individual educational institution as part of a video conferencing service or a platform that does not provide for automatic user control.
In the event that the selected digital platform involves the processing of personal data of students, pupils or their parents on behalf of the school or university, it is necessary to regulate the relationship with the supplier through a contract or other legal act as in the case most municipality of the electronic register, for which the supplier processes the data on behalf of the school.
The Guarantor's provision also provides that, in the event that it is necessary to use more complex platforms, with services that do not concern only teaching, however, only those functions strictly necessary for training must be activated with a configuration that minimizes the personal data to be processed. for example, avoiding geolocation, social login, etc. In this case, schools and universities will take care to ensure that the data processed on their behalf is used only with reference to distance learning.
In any case, the provision provides that the Guarantor supervises the respect of the discipline of protection of personal data by the suppliers of the main digital platforms for distance learning, with the aim of ensuring adequate protection of the processing of teachers' data, of the students and families.
Furthermore, it is specified that the data processing carried out by the platforms on behalf of the school or university must be limited only to the services necessary for the supply of on-line teaching, without further purposes specific to the supplier, who cannot influence the use of the services for any signing of the contract or the provision of consent for data processing, which concern the use of additional functions, not connected to the teaching activity.
Particular attention is then focused on the personal data of minors, for whom specific protection must be guaranteed, since they have less awareness of the consequences of the risks of their rights. It is therefore necessary to avoid preserving the use of children's data for profiling or marketing purposes.
Finally, the Guarantor focuses on the need to ensure the transparency and correctness of the treatment and in particular on the fact that schools and universities must inform the interested parties (pupils, students, parents and teachers) in a language that is easy for children to understand, with particular reference to the data processing carried out.
Access the provision of the Guarantor of 26 March 2020 n. 64 links:
https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9300784#allegato