Schools and other educational institutions process sensitive personal data of children, parents and staff on a daily basis. This involves not only great responsibility, but also complex laws and regulations and specific policies. Consider student records, which include results, guidance information and medical data. Sharing these records between schools requires explicit parental consent in many cases, and once a student leaves school, this data may be kept only for a limited time before it must be deleted.

But it goes beyond student records. Absenteeism records, the use of camera surveillance in school buildings, data collected through digital platforms, and staff privacy also fall under the scope of the AVG. At a time when digital learning tools, online testing platforms and adaptive learning software play a central role, it is crucial that schools carefully assess what data is collected, how it is processed and with whom it is shared. Suppliers of such digital learning resources must comply with the Education Privacy Covenant, including drafting processor agreements and following clear agreements on data processing.

The General Data Protection Regulation (AVG) sets strict requirements in this regard, such as the mandatory appointment of a data protection officer, maintaining a processing register and reporting data breaches. For educational institutions, this means that privacy policies should not be a paper exercise, but an integral part of daily practice.

The file Youth & Education provides education professionals, administrators and policymakers with an up-to-date and practical overview of how to protect privacy in education, with a specific focus on handling child data, using digital technology and safeguarding the rights of both students and staff.