New legal notice on student data ‘enhances safeguards on use of data’

A new legal notice on the collection of student data has introduced important safeguards on how the data collected is to be utilised, addressing concerns raised by education professionals and parents on the rights of students, and minimising risks of the data being collected abusively.

Legal Notice 76 of 2014 sparked uproar by granting the Education Minister direct access to student data, a point that has now been addressed through the new legal notice.

The new legal notice now regulates the processing of personal data by education authorities and educational institutions for statistics and research purposes: for statistical purposes, identifiable data must be made anonymous; where the research purpose requires a follow-up action with the students, this would be carried out through pseudonymous data. In other words, only those students who need to be targeted will be identified.

The goal behind the legal notice was to address the long-term problem of early school leavers and dropouts, as well as students who leave the educational system with little or no qualifications and skills.

This would be carried out by collecting information on students to ensure that those who were vulnerable – those who do not further their education or who do not register for work – would be tracked down, provided counsel and guidance and assisted through the various schemes for young people, including Jobs+.

Through the legal notice, the government could create a “student profile”, containing details of the students from the first day they enter childcare up to University, tracing their scholastic career.

But critics of the original legal notice, including digital rights expert Antonio Ghio, argued that the initiative should not prejudice the fundamental right to citizens’ privacy.

“The apparent creation of this Student Profile from the day a child enters into childcare up to leaving the educational machine, poses Orwellian fears which LN76/2014 is further fuelling as opposed to addressing,” Ghio had written in his online blog.

The bone of contention was the risk of abuse of the students’ database and the original legal notice that empowered the minister to directly control it – something which education minister Evarist Bartolo has now said won’t happen due to the changes to the law.

“The new legal notice delineates the safeguards which shall be implemented, recognises the legitimate need for authorities and institutions to process the personal data of students, and where necessary, that of parents and legal guardians,” the Ministry for Education told MaltaToday.

The new legal notice goes beyond what had been originally proposed in LN76 and regulates data protection and data processing in the educational sectors, also regulating what processes can be carried out by educational institutions and the Employment and Training Corporation (ETC).

The powers enjoyed by the education authorities and the ETC were already conferred by virtue of the 2006 amendments to the Education Act, while the powers accorded to the ETC have been exercised since 1990.

“In this sense, the legal notice delineates how the wide powers of the education authorities are to be exercised. The legal notice also limits access to personal data only to professional employees who by virtue of their role and responsibilities need to process such data,” the ministry explained.

By way of example, the ministry said that in the case that a student needs to be contacted and encouraged to take revision classes for failing SEC examinations, it will be the educational institutions who will contact the student with the information.

A second specific target policy is in the case of the Jobs+ initiative and the students who specifically fall within the parameters of the target policy will be identified.

“There are safeguards for the provision of this data in that identifiable data is only requested if it is strictly required to take the necessary measures in the interest of the students in the implementation of such national initiatives; only data of students over compulsory school age may be requested; and identifiable data of students who eventually do not participate in such national initiatives are deleted or rendered anonymous,” a legal advisor to the ministry said.

There are instances where the legal notice provides that consent is to be obtained, granting a new right to students who have reached 16 years of age. 16-year-old students will be eligible to give consent for processing of their personal data, thus enjoying all the rights afforded to data subjects as provided under the Data Protection Act.