Processing Personal Data in Primary School

This guide is a brief overview of the processing of personal data of primary school pupils in situations where teaching makes use of applications or technologies provided by external parties. It is aimed at primary education professionals — above all, teaching staff. The legislative review focuses on the EU General Data Protection Regulation. The guide is a general overview, not an exhaustive legal analysis.

Introduction

The use of various applications in primary education may be necessary for many reasons — media literacy, communication skills, digital skills education, and digital examinations are examples of justified uses. A digitalising primary school brings data protection issues to the forefront.

Children's personal data occupies a special position in data protection law. Their processing requires particular care — including in primary education. For data protection obligations to be met, it is important that teaching staff have up-to-date knowledge of data protection rules.

Every child has the right to privacy and the protection of their personal data. Other fundamental and human rights must also be taken into account: equality, non-discrimination, and the right to free primary education. For children's personal data, the best interests of the child must also be ensured in accordance with the UN Convention on the Rights of the Child.

The guidance in this guide applies to all personal data processing regardless of the technology used. AI applications are also subject to data protection rules. The EU AI Act is being prepared but will not, as a general rule, change the rules on personal data processing.

1. Processing Children's Personal Data in Primary Education

Children's personal data occupies a special position in data protection law and requires particular protection. The processing of personal data is part of everyday primary education.

Personal data means, in principle, any information relating to an identified or identifiable natural person — this person is referred to as the data subject. The concept is broad: an audio recording, a photograph, or an identifiable physical characteristic are all personal data.

Special categories of personal data enjoy stricter protection. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and genetic, biometric, or health data.

The controller is the party that decides on and is responsible for the processing of personal data. Controllership cannot be agreed upon — actual control is decisive. In primary education, the controller is the body that in the municipality is responsible for organising primary education — usually the board or equivalent body responsible for educational affairs. It bears responsibility for all data protection obligations and is responsible for ensuring that teachers and other staff receive comprehensive guidance on the requirements of data protection law.

1.1 The Controller Is Responsible for Upholding Data Protection Principles

Responsibility for upholding data protection principles lies with the controller. The principles are binding, and the controller must be able to demonstrate compliance.

The data protection principles are:

• Lawfulness, fairness and transparency — processing must have a legal basis and be carried out openly
• Purpose limitation — data is collected only for a specific, pre-defined purpose
• Data minimisation — only necessary data is collected
• Accuracy — data must be kept up to date and accurate
• Storage limitation — data is retained only for as long as necessary

1.2 The Legal Basis for Processing Is in Principle Statutory

The processing of personal data must have a lawful basis. Without one, processing is prohibited. The basis must be determined before processing begins and cannot change mid-process.

In primary education, the main basis is compliance with a statutory obligation: under Section 4 of the Basic Education Act (628/1998), the municipality is obliged to provide primary education for pupils of compulsory school age residing in its area. This obligation is elaborated in the objectives of Section 2 and in the national core curriculum issued pursuant to Section 14.

The lawful bases for processing under the GDPR are:

1. Consent of the data subject
2. Contract
3. Statutory obligation of the controller
4. Protection of vital interests
5. Task carried out in the public interest or exercise of official authority
6. Legitimate interests of the controller or a third party

The choice of legal basis affects the rights of the data subject. The choice is always made on a case-by-case basis before processing begins.

1.3 Consent as a Legal Basis and Children's Consent

Consent of the data subject is one of the lawful bases under the GDPR. It must be specific, informed, genuinely voluntary, and an unambiguous indication of wishes. In the public sector, the use of consent is problematic: the power imbalance between the authority and the citizen affects the genuine voluntariness of consent. The use of a child's consent raises additional specific questions.

Using a child's consent as the legal basis requires very careful prior assessment and informing the child in a manner they can genuinely understand.

2. Third-Party Applications in Teaching

Various applications are present in children's leisure time and increasingly in education. The use of applications and digital skills fall within the scope of media education under the curriculum. Technology can increase the accessibility of teaching materials and prepare children for digital environments. At the same time, personal data questions arise that cannot be ignored.

All third-party applications used in teaching that process children's personal data remain the responsibility of the organiser of primary education acting as controller.

In the best case, the organiser of primary education centrally manages all applications and devices used in teaching. This enables the controller to fulfil its obligations — including conducting a data protection impact assessment under the GDPR before introducing applications.

2.1 Legal Basis for Applications

The statutory obligation of the organiser of primary education to provide teaching does not automatically mean that all technology used in teaching is permitted on that basis. In light of current case law, statutory obligation may not be a suitable legal basis for third-party electronic teaching programmes or applications.

When considering the introduction of applications, the organiser of primary education must always determine: what is the lawful basis it can rely on?

2.2 Careful Provision of Information

The information obligations under the GDPR protect the rights of the data subject. Clear and timely information enables the data subject to exercise their rights. Pupils must be provided with information about the processing of their personal data in child-friendly language — including in connection with applications.

The special position of children under the GDPR requires that the vocabulary, tone, and style of information be adapted to the child's age level. Note that:

• Children must be provided with information even when the consent to process their personal data is given by a guardian.
• The special needs of other target groups must be taken into account — for example, information provided to persons with disabilities must ensure the accessibility of information.

3. Practical Examples

3.1 The City of Espoo Google Workspace Case

The case illustrates how important it is to assess the suitability of the legal basis carefully — especially for third-party applications. A standard data processing agreement is not sufficient as a safeguard when the data subjects are children and the controller's monitoring capabilities are limited.

3.2 Who Decides on the Use of an Application?

Current legislation leaves discretion in the choice of applications — neither the Basic Education Act nor the national core curriculum separately prescribe which applications are used in teaching. This does not mean, however, that responsibility does not exist.

The decision emphasises that the controller's responsibility extends from the very choice of application and the conclusion of cooperation agreements.

Summary

The use of applications, social media, and other technologies often involves the processing of personal data — in such cases, data protection rules must be complied with. The most important thing is to assess in advance what impact each technology has on the protection of personal data.

• Children's personal data requires special protection.
• The use of applications often involves the processing of personal data — data protection law must be taken into account.
• Compliance with data protection law is the controller's responsibility. The controller is also responsible for providing guidance to teachers and other staff.
• Careful advance planning of the use of applications and technology is of primary importance — it enables requirements to be taken into account from the outset.