The new European data protection regulation: implications for learner records and cross-border processing

The present attention to the new European data protection regulation follows the General Data Protection Regulation adopted on 27 April 2016 and requires a careful distinction between public commitment, institutional practice and demonstrated result. The immediate task for education authorities is to distinguish the policy objective from the legal and operational measures needed to give it effect. Learner protection and reliable decisions require controls commensurate with the nature and scale of risk.

Status and scope

For new European data protection regulation, the General Data Protection Regulation was adopted in April 2016 and is to apply from 25 May 2018. It establishes principles including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Education providers preparing for implementation should identify personal-data purposes, legal bases, individual rights, supplier arrangements, retention and security, particularly where data influence learner decisions.

In reviewing new European data protection regulation, education information should be collected for a defined purpose, protected in proportion to its sensitivity and retained only for an authorised period. Review should cover the stages at which learners receive information, provision, assessment, support and remedy.

• Provide accessible correction and complaint routes before it is relied on for a decision with material effect.
• Control third-party processing.
• Limit and review access.
• Verify accuracy where information affects learners before it informs a consequential decision.
• Assign accountable data owners.

Public-interest implications

The General Data Protection Regulation adopted on 27 April 2016 provides a policy reference for the new European data protection regulation. This distinction protects learners from overstated claims and enables providers to plan against a defined obligation.

Review of the arrangements should be based on a stated method rather than general assurance. A reliable record should identify what occurred, when it occurred, who was responsible, the authority for the action and any later correction. When examining new European data protection regulation, records should remain protected against unauthorised alteration while legitimate amendments remain visible. Decision-makers should receive an intelligible account of how the result was reached and where it should not be applied.

Institutional responsibilities

In work concerning new European data protection regulation, the applicable expectation should be capable of consistent application. Oversight should test whether formal commitments are reflected in decisions, resource allocation, provider conduct and accessible routes for review. Terms governing eligibility, support, assessment, reporting or review should prevent materially different treatment without recorded justification.

The principal risks in relation to the policy position are excessive access to learner information, collection without a defined educational or legal purpose, retention beyond an identified need, and secondary use without adequate authority. Within the scope under review, a weakness in one part of the control environment may obscure a related failure elsewhere.

• Is the record attributable?
• Can records be retrieved throughout the required period?
• Can an amendment be distinguished from the original?
• Are access rights proportionate?
• Are partner records subject to equivalent controls?

Continuing review

The evidential record for the new European data protection regulation should permit a reviewer to trace the matter from decision to outcome. This may require a register of information assets and purposes, incident response and notification records, retention and secure disposal evidence, and data-quality and correction controls, supported by lawful authority and consent records where relevant and supplier and transfer arrangements. Further cases should be examined when the initial sample does not represent the affected scope or confirm sustained correction.

Implementation of the issue can be tested without imposing unnecessary reporting. Responsible bodies should specify mandatory fields, source ownership, access rights, retention and correction procedures. In the context of new European data protection regulation, test a sample from creation through use, amendment, reporting and disposal, including records created during disruption or by a delivery partner. Information should not be treated as sufficient merely because it is already available; its relevance to the present question must be established.

Continuing review

The implementation record for the new European data protection regulation should identify the instrument being applied, its status, the competent authority, the affected jurisdiction and the action expected of each responsible body. Binding obligations should remain distinct from policy commitments and measures adopted by institutions. A staged implementation record should set out transition dates, interim safeguards and the readiness review point.

The analysis of the arrangements should remain within the limits of the evidence. In the context of new European data protection regulation, a policy direction should not be presented as a uniform legal obligation where national implementation differs. Providers remain responsible for identifying the requirements that apply to their own activities. Security, privacy and data quality are related but distinct. A secure record may still be inaccurate or used without adequate authority, and a lawful use may still be poorly governed.

In work concerning new European data protection regulation, the evidential trail should allow an affected decision to be identified, examined and corrected. In this case, the responsible body should be able to identify the evidence considered, the judgement made, the person or body authorised to make it and the action that followed. The record for new European data protection regulation should prevent a later amendment from being treated as if it applied when an earlier decision was made.

As regards new European data protection regulation, where responsibilities for delivery are shared with partners, suppliers or several public bodies, responsibility should be mapped across the complete service. Governance between participating bodies should make information duties and corrective authority explicit. Protection should operate across the complete service, irrespective of how delivery is divided.

In the context of new European data protection regulation, a clear objective, proportionate evidential basis and account of affected learners are required. An evidential gap in relation to new European data protection regulation should lead to a qualified conclusion and continued action, not administrative closure.