Schools as Data Controllers and Data Protection Commission’s Toolkit
Reading Time: 5 minutes
Authors:
Date: 25 February 2025
Recently, the Data Protection Commission (DPC) published a Data Protection Toolkit for Schools (the Toolkit) in Ireland. This Toolkit is published in alignment with the 2022-2027 Regulatory Strategy that mentions the protection of children’s personal data as a priority for the DPC. The above two documents are also supported by the Fundamentals Guidance that has been published by the DPC on the data protection rights of children.
The Toolkit is broken down into guidance, frequently asked questions, and templates. While the Toolkit is neither an exhaustive document, nor does it aim on becoming a one-stop-document, it certainly provides basic information on how school’s should process children’s personal data in a secure and compliant manner. This article will summarise the Toolkit published by the DPC and indicate specific areas where the schools may need expert support when processing children’s personal data.
Obligations of a School as Data Controller:
The DPC states that any decision regarding the processing of personal data that is to be taken by a school should be based primarily on the best interests of the child. This is further crystalised in the statement:
“child protection/welfare measures should always take precedence over data protection considerations affecting an individual”.
However, the DPC goes on to state that,
“schools must conduct a balancing test to ensure that a child’s data protection rights are protected, even in certain cases where the child protection/ welfare takes precedence”.
This in itself safeguards the child from further harm and helps to prevent a potentially high-risk data breach.
From the above positions, it is evident that the role of schools is complex and requires careful and case-by-case analysis. This analysis may be unique for each child as the situation that every child is in may be contextually diverse. In general data protection terms, a school is a separate data controller and legal entity. Therefore, the school is responsible for carrying out the following assessments and obligations:
1. Appointment of a Data Protection Officer (DPO):
| Article of GDPR | Explanation |
| Article 37 |
|
| Article 37(1)(a) |
|
2. Select an appropriate lawful basis when processing personal data:
| Article of GDPR | Explanation |
| Article 6(1) | A data controller must decide on what basis personal data is being processed. While the GDPR provides for six options to select from the DPC opines that the following may be most relevant:
|
3. Select an appropriate lawful basis when processing special category data:
| Article of GDPR | Explanation |
| Article 9 | Special category data (SCD) is data that is more sensitive in nature and requires a higher level of protection. GDPR provides a list of data types that are classified as SCD. These include genetic data, biometric data, health data (may include but not limited to physical or mental health concerning or allergy information), and religious beliefs. |
| Article 9 (2) | Where SCD is processed, schools have an obligation to identify a suitable lawful basis from the list stated in Article 9(2). |
4. Use of technology providers and Data Protection Impact Assessments (DPIA):
| Article of GDPR | Explanation |
| Article 35 |
|
| Article 28 |
|
5. Data Subject Rights:
| Article of GDPR | Explanation |
| Articles 13 to 22 | Children are data subjects and thus have the same rights as an adult under the GDPR. Therefore, schools as data controllers have an obligation to ensure the data subject rights are enforced and requests are resolved within statutory timelines, even during school holidays periods. |
| Schools must note that Ireland does not have a legal age for children to exercise their legal rights. The Data Protection Act 2018, Section 29 states that a child is anyone below the age of 18 years. | |
Apart from the above obligations, the DPC also recommends that schools have certain basic policies, such as a data protection policy, a children friendly privacy notice, a social media policy, a CCTV policy and a data retention policy.
Our Advice:
Most of the above obligations may involve a very specific assessment on a case by case basis. However, they do have technical data protection elements that may benefit from the appointment of a data protection expert as the DPO.
The below tasks may be discharged effectively by a DPO to mitigate any reputational loss and regulatory scrutiny or enforcement action:
- Spread the word (i.e., raising awareness/training)
- Update policies
- Update Privacy Notices & review how consent is sought, recorded, and managed.
- Prepare procedures for reporting data breaches and data subject rights.
- Develop DPIA procedures and identify members of staff who can help conduct assessments (i.e., IT leads).
- Create Record Of Processing Activities to map the personal data held on pupils, staff, and volunteers.
Expert legal advice may also be necessary for the purposes of assessing the status of a school and its classification as a public authority under the GDPR.
While satisfying data protection obligations as a school or an educational institution may seem challenging, our data protection and cyber-risk service has extensive experience in navigating complex compliance requirements and assisting organisations in adapting to evolving regulatory landscapes. Our expertise ensures that your organisation stays ahead of regulatory changes, fostering resilience and trust in a rapidly changing digital world. If you’d like to know more about how our data protection experts can support your organisation, check out the specialist services we provide.
