Educational institutions may use social media only if they make clear agreements with social media companies about what happens to student and faculty data. Do they fail to make such agreements? Then an educational institution had better not use the social medium in question, according to the Autoriteit Persoonsgegevens (AP).
So writes the AP in an advisory to an educational institution that wanted to use a particular social media platform. Among other things, the educational institution wanted to post their photos and stories on the social medium with the permission of students and teachers. For example, to attract new students and communicate with current students.
The AP notes in the opinion that there may be substantial risks. AP chairman Aleid Wolfsen: 'Social media are companies with their own interests. For example, selling advertisements based on accurate profiles of people. Perhaps including data about their health, political preferences and other very personal matters. Do you know for sure what that company does with the data of your students and teachers? And are you sure they are okay with that? That should be clear. If not: don't start it or stop it immediately. Because there's a good chance you're breaking the law.'
For example, it should be clear which party is responsible for compliance with the General Data Protection Regulation (GDPR). Who removes a photo as soon as a student wants it? Who ensures that the photo is not used for something else? Wolfsen: 'You have to know where to turn if you want to get your rights. Is that with your school or university? Or is it with the social media company? That has to be clear.'
It is also important that the platform keeps personal data secure. If it is outside the European Economic Area, then the level of data protection must be comparable to that of the AVG. There are several ways to ensure that personal data is secure, even in countries that do not have a law like the AVG. Often this involves the educational institution making agreements with the platform, but sometimes even that is not enough. Then it is forbidden to use the platform. In countries where the rule of law is not well guaranteed, it is very questionable whether such agreements will hold up. It is therefore very doubtful whether it is lawful to store personal data of people in the EU there.
Finally, it is important for an educational institution to properly ask students and faculty for permission to use their personal data. This means, among other things, that people must know exactly what they are giving permission for. So also what the social media company does with all your data. Does the company create a profile of you in order to sell it to advertisers? That has to be black and white. And people must be able to choose whether or not to give permission for each item. Otherwise the consent is invalid.'
The AP advises all educational institutions in the Netherlands to review their social media use. And where necessary to make agreements with the platforms they use. Wolfsen: "That has succeeded before in education, with the use of Google software. But if that fails, think about the security of the data of your students and staff. Take responsibility.'
