New data rules important for educational traceability

Safeguards introduced in new data rules for educational traceability • Video Ray Attard

Education minister Evarist Bartolo and civil liberties minister Helena Dalli said the government had strengthened data issues on children and schools with a new legal notice on data collection for educational purposes.

An education working party chaired by the commissioner for information and data protection, composed of stakeholders from state and non-state sector as well as higher education and tertiary institutions held several meetings discussing the data collection of pupils and their parents.

Bartolo said that the final draft of the legislation reflected the wide consultation process from all stakeholders.

The education ministry has since repealed a controversial legal notice allowing the education department to collect personal data pertaining to students and their parents, and instead replaced it with new rules that introduce data protection safeguards.

The new rules introduce the concept of prior checking, where a notification has to be made to the Information and Data Protection Commissioner, when educational authorities are processing data related to students or their parents and guardians.

Helena Dalli emphasised that the previous legal notice had been carried out following approval by the former Data Protection Commissioner. "At no instance did the government try and carry out any form of data collection process of students which breaches their data protection rights," she said.

Dalli praised the importance of tracebility studies which can serve as key indicators to legislators in different areas such as lack of women’s participation at work.

Education minister Evarist Bartolo found himself embroiled in a controversy over Legal Notice 76: an initiative aimed at granting his ministry unfettered access to personal data of all Malta’s school-age students, and which sparked outrage for its apparent invasion of privacy on a nationwide scale.

The minister claimed that the data was needed to evaluate education problems. “We needed that data for policy-making purposes. It is not enough for me to know that we have 600 fifth formers who do not continue their studies every year. It’s important for us to know who those 600 are, so that we can talk to them personally; so that we can approach them, work with them to be able to get them back into schooling, or to get them to train more.”

The new rules specify that personal data of parents can be collected “where specifically required in the best interest of the students… to carry out their functions as provided under the Education Act.”

Education authorities must submit written requests to educational institutions to furnish personal data in relation to students attending such educational institutions, but sensitive personal data shall be requested only with the explicit consent of the parent or legal guardian.

In the case of data regarding educational attainment and ability, educational institutions shall substitute “identifiable data” with pseudonymous data: personal data that can no longer be attributed to a specific student. The rules also stated that follow-up action is carried out by the educational institutions which transmitted the data as instructed by the education authorities.

The legal notice states that the data must be used only for reconciliation purposes; no results associated to identifiable students are requested, and all personal identifiable data has to be rendered anonymous, deleted or destroyed, immediately after the reconciliation exercise is conducted.