Data protection obligations now applying to education providers

In examining data protection obligations now applying to education providers, proportionality is demonstrated where learner safeguards and decision reliability correspond to the assessed risk.

Application of the evidence to data protection obligations now applying to education providers

The applicability described by the General Data Protection Regulation applicable from 25 May 2018 changes the implementation context for data protection obligations now applying to education providers. Entry into force or applicability establishes an operative reference point, but the resulting duties must still be traced to the persons, services and jurisdictions covered.

For data protection obligations now applying to education providers, the General Data Protection Regulation applies from 25 May 2018. Education providers processing personal data within its scope must connect each use to an appropriate legal basis and comply with principles governing fairness, transparency, purpose, minimisation, accuracy, retention and security. Rights and accountability are operational matters: notices, access controls, correction, supplier oversight, incident response and records of decision-making should function in practice.

In the context of data protection obligations now applying to education providers, the applicable expectation should be capable of consistent application.

In the present context, uncontrolled supplier access or transfer, inaccurate data affecting decisions and collection without a defined educational or legal purpose may produce acceptable aggregate reporting while individual learners remain exposed to material disadvantage. For data protection obligations now applying to education providers, the test should deliberately include exceptions and cases in which the expected outcome was not achieved.

Implementation requires more than dissemination. Responsible actors must understand the change, receive the authority and resources to apply it, and be able to identify cases that require advice, exception or escalation. Across the defined scope, the judgement should state its supporting evidence and any condition limiting application to the declared scope.

This may require data-quality and correction controls, a register of information assets and purposes, role-based access and access reviews, and lawful authority and consent records where relevant, supported by retention and secure disposal evidence and supplier and transfer arrangements.

Controls relevant to data protection obligations now applying to education providers

The assurance record for the policy position should retain the date of the evidence, the source responsible for it, the scope examined and the version of any instrument or definition applied. In the context of data protection obligations now applying to education providers, a later reviewer should be able to identify whether the condition changed or the evidential record was corrected.

• Assign accountable data owners before using it to determine a learner or provider outcome.
• Provide accessible correction and complaint routes before it is relied on for a decision with material effect.
• Minimise collection.
• Control third-party processing, with responsibility, scope and timing recorded.
• Verify accuracy where information affects learners.

Review criteria for data protection obligations now applying to education providers

In examining data protection obligations now applying to education providers, the method for implementation is to translate the policy objective into controlled procedures and decision criteria, prepare affected staff and learners, test readiness, monitor early cases and correct ambiguity promptly.

For decisions concerning data protection obligations now applying to education providers, a policy conclusion on the measure should state who is required or expected to act, the source of that expectation and the consequence of non-implementation. Jurisdictional variation should be identified wherever it narrows the reach of the conclusion.

• Are responsibilities and resources in place?
• What do early cases show?
• What operational decision changes?
• Where is implementation inconsistent?
• Have affected users received clear information?

Implications for data protection obligations now applying to education providers

Review of the measure should address both system-level conditions and institutional practice. For data protection obligations now applying to education providers, education information should be collected for a defined purpose, protected in proportion to its sensitivity and retained only for an authorised period. Across the defined scope, the allocation of responsibility should prevent gaps between system oversight and institutional operation.

For data protection obligations now applying to education providers, a clear objective, proportionate evidential basis and account of affected learners are required.