Education authorities or institutions, rather than the minister, would have the right to seek personal data on students, according to regulations issued to allay fears of the State snooping on schoolchildren.
A new legal notice substituting LN 76, published in March, which authorised the government to access students’ personal data for research purposes, will not come into force immediately in view of a public consultation period that expires on September 11.
The redrafted, more comprehensive regulations include safeguards meant to prevent the disclosure of sensitive information. Nevertheless, they will still apply to all educational institutions from pre-primary to university level.
Contrary to LN 76, which had been put on hold following a barrage of criticism, the new version makes no mention of the minister but says that data could be requested by education authorities or other institutions.
Safeguards to protect sensitive information
Commenting on the start of this consultation, Education Minister Evarist Bartolo said yesterday the government was bound to take action and address the “good number of students” who were finishing compulsory education without having necessary skills.
To implement the necessary measures, there would be the need to process students’ personal data, in accordance with the Data Protection Act, he added.
The draft legal notice was based on the recommendations of a working group chaired by the Data Protection Commissioner.
The Nationalist Party welcomed the move but noted that the consultation process was starting four months too late. It insisted that the education minister must not have the power to acquire sensitive and confidential information.
It felt that, even before the consultation period started, the government should have annulled LN 76. It criticised the government for being inconsistent, remarking that after introducing the regulations “by stealth” and voting against an Opposition motion to repeal it, the government had now decided to change it.
In any serious society, consultation was carried out before a decision was taken and not afterwards, the PN said.
Main proposals for information requests
• Authorities can only request sensitive personal data “if strictly required under a specific law or if it is in the best interest of the students, or if explicit consent by the parent/legal guardian is obtained”.
• Educational authorities are obliged to substitute any identifiable information by “pseudonymous data” to protect students’ identity.
• Personal data may be requested when implementing targeted policies to help students who do not achieve the levels in national assessments to progress to higher education. However, once the services are delivered, all personal identifiable data has to be rendered “anonymous, deleted or destroyed”.
• In the case of national initiatives on employment, only personal data of students over compulsory school age may be requested and any identifiable data of those who do not participate will have to be deleted, destroyed or rendered anonymous.
• Medical and student welfare data has to be stored separately and destroyed once students stop attending the educational institution concerned.
• Visual images may only be processed if educational institutions obtain the consent from students, parents or legal guardians.
• The disclosure of personal data from educational institutions to third parties require the student’s consent except for a number of cases. These include requests from education authorities, institutions where students would be transferred to, and examination authorities. Other exemptions apply to health authorities, hospitals, clinics and other medical professionals where students need medical attention, the police, social workers or support agencies in case of suspicion of claims that the student welfare is not being observed, the Employment and Training Corporation and courts.
• Any consent may be withdrawn in writing and the data controller shall stop processing such information and destroy it.
• Research involving the processing of sensitive personal data must have the approval of the Data Commissioner.