The legal notice that created a stir last year over issues related to students’ data has been revoked and replaced with a new one that includes safeguards meant to prevent the disclosure of sensitive information.

Published in The Malta Government Gazette last Friday, Legal Notice 19 replaces Legal Notice 76, which was put on hold last April in the wake of a public outcry after it became known that it empowered the Education Minister to acquire sensitive and confidential information on students.

The new legal notice now falls within the framework of the Data Protection Act rather than the Employment and Training Services Act. This follows the intervention of the Data Protection Commissioner after the widespread controversy.

The new legal notice prohibits the educational authorities from asking for any data of students younger than 16. It also lays down that any sensitive personal data can only be requested from schools with the explicit consent of a parent or legal guardian.

The education authorities are now empowered to process students’ personal data “in the best interest of the students” and can also process personal data of parents and legal guardians “to carry out their functions as provided under the Education Act”.

The authorities are only allowed to request identifiable data to assist them in taking the necessary measures in the interest of students in the implementation of initiatives and only data of students over the compulsory age of education may be requested.

It also empowers them to request education institutions to provide information and personal data of students and parents.

Sensitive data shall only be requested with the consent of the parent but the legal notice does not define what such sensitive data includes.

According to the legal notice, if the processing of personal data is required for research or the compilation of statistics, all identifiable data has to be rendered anonymous unless it is proven that the identification of the data subject is required to fulfil the purposes of research.

In such cases, personal identification data will be limited through pseudonymous data, which means that any identifiable fields are replaced by artificial data and will only be traceable in cases where specifically required.

Academic progress, information related to students’ welfare and their medical data can also be processed by the education authorities, provided the data is held in separate distinctive files and in a secure manner.

If the students are following compulsory schooling, the data may be forwarded to other educational institutions, always in the best interest of the students.

A clause in the new legal notice lays down that access to the personal data of students and that of parents and legal guardians should be restricted to those employees who really need it.

A spokesman for the Education Ministry said when contacted that the latest legal notice was compiled following a wide-ranging consultation process after a draft was prepared by a working group specifically set up for the purpose.

The group, tasked with examining the safeguards needed when handling students’ personal data, was chaired by the Data Protection Commissioner.