The Government of Malta is, thus far, set on opening schools come end September. The debate on appropriate safety protocols is ongoing, and questions on how best to deliver lessons abound.

Suppose that half the cohort attends school in person and the other half listens in using an online communication platform. Lessons are recorded and can be shared, and the footage features the classroom and schoolchildren. Added to this are new practices that have emerged for collecting personal data, including daily temperature checks and performing contact tracing. Such practices ought to be in line with the requirements of the General Data Protection Regulation (GDPR).

Striking a balance between rights of students to privacy and a safe environment, is a consideration which should rank highly on the priority list of every school at the moment.

Privacy notices are one of the areas which must be revisited in the wake of these types of ‘new purposes of processing’. Where a new purpose for collecting personal data is contemplated by the school, this should be brought to the attention of the related data subjects prior to its processing.

Schools should also assess the lawful bases justifying each data processing activity. The GDPR provides data controllers with six lawful bases of processing, one of which is consent. When consent cannot be given freely, data controllers should consider using another justification. Subsidiary Legislation 586.07 on the Processing of Personal Data (Education Sector) states that educational institutions may process visual images if consent is obtained from the students (who are sixteen years and over) or from their legal guardians.

Unless the legislator was gifted with foresight, chances are that this law was not written with a pandemic in mind. Collecting consent for online learning might have to be studied further. One can understand that consent is required if the school were to market or commercialise its online classes, but what about those instances where this method is incorporated as a reasonable and legitimate tool to mitigate the risk of a spreading virus? Could a legal guardian refuse to provide consent for online classes and, if so, could the school reasonably be expected to provide an alternative? Can the school offer a genuine free choice here? From a legal perspective, schools might be better off with considering alternatives to consent, such as a legitimate interest to conduct online classes under the current circumstances.

With regards to best practices, a sensible way to approach this thorny issue is for schools to avoid delivering classes using platforms such as Instagram live, Facebook, YouTube, or Tik Tok. These platforms are public-facing online social media tools and the reasonable expectation here is that the personal data is not shared or live-streamed on such media.

Schools certainly have quite some homework cut out and this includes revisiting their privacy notices, providing information to students and legal guardians on how their data will be processed going forward, and seeking professional advice when uncertain of the position at law.

Dr Sharon Xuereb is a senior associate at Camilleri Preziosi, practising primarily in the fields of privacy and data protection, intellectual property, IT and electronic communications laws. Camilleri Preziosi provides regular advice in the fields of privacy and data protection law. The firm participated in various discussions and training programmes on the GDPR.

Independent journalism costs money. Support Times of Malta for the price of a coffee.

Support Us