Can I require a parent to sign a consent form for publishing their child’s image on the school website?
No. Consent must always be freely given. A parent is under no obligation to agree to the publication of their child’s image online.

When should informational clauses be provided to job candidates and prospective students?
The document outlining personal data processing rules must be provided at the moment when personal data is collected. If this is not feasible, it should be delivered at the earliest possible opportunity.

How do I know what personal data I am allowed to collect during the child admission process?
Articles 150 and 151 of the Education Law specify the required content of the application form and attachments, as well as the data necessary for enrolling a child. These documents clearly outline which personal data may be collected.

Can I create a general image consent form covering all promotional activities of the school?
No. Consent must refer specifically to each category of processing activity, including publication of image or audio-video material on clearly defined platforms or distribution channels.

Is a school nurse considered a data processor, and do I need to sign a data processing agreement?
If the school nurse is not employed under a standard employment contract with the school, she is an independent data controller. This is because her goal is to provide medical services, which constitutes a separate purpose of data processing from that of the school.

Are educational institutions required to maintain a visitor entry and exit log?
No. There is no legal obligation to maintain such records, although doing so may enhance the security of both individuals present on the premises and the personal data processed by the institution.

Does saving a list of students on a USB drive constitute data processing?
Yes. This is considered “recording,” which is a form of personal data processing.

Is a travel agency that organizes a field trip considered the data controller of students’ data?
No, provided that the agency organizes the trip solely at the school’s request and for a specific purpose (e.g., a trip to Poznań). In this case, the agency acts as a data processor.

Can the school display a list of students with dietary accommodations in the cafeteria?
No. This would disclose sensitive health data. The list should be stored securely (e.g., in a locked cabinet) and accessed only by staff responsible for preparing or serving meals.

Can students’ contest entries, including their names, be displayed in the school lobby?
Yes. This falls within the educational mission of the institution, including recognizing student achievements and fostering a sense of school community.

Does publishing photos of school competitions on the website qualify as exercising public authority?
No. Promoting the school online (e.g., on its website or social media platforms like Facebook or Instagram) is not part of its public mission. Such activities require separate consent.

Can a parent object to the public announcement of their child’s name during school ceremonies recognizing academic achievements?
Yes. However, the objection will only be upheld if the parent demonstrates that such disclosure would harm the child due to specific circumstances.

Is parental consent required on the child admission form for data processing purposes?
No. Consent is not the appropriate legal basis here. The correct basis is the performance of a public task by the institution.

Must each legal guardian receive an informational clause regarding the child’s enrollment?
Yes. Article 13 of the GDPR requires that each legal guardian be informed accordingly.

Does the school have to provide a privacy notice to individuals authorized by parents to pick up a child from after-school care?
Yes. Under Article 14 of the GDPR, the school must ensure each such individual receives information about the processing of their personal data.

Can I collect the PESEL number or home address of persons authorized to pick up a child?
Generally, no. In line with the principle of data minimization, only essential information should be collected. The institution must demonstrate a legitimate interest to collect such sensitive identifiers.

Can a homeroom teacher collect phone numbers or email addresses of students’ parents for contact purposes?
Yes. The principle of data minimization does not apply here, as the teacher must be able to contact parents. However, a parent may choose to provide only a phone number.

A teacher has applied for vacation subsidy from the school’s Social Fund (ZFŚS). Should they receive a new privacy notice?
No. The teacher should have already received a privacy notice upon employment, which included information on data processing related to the Social Fund.

Can video surveillance be installed in students’ changing rooms?
As a rule, no—unless it is necessary to ensure the safety of students and staff. In such cases, this must be agreed upon by the Parents’ Council, the Teaching Council, the Student Government, and the Supervisory Authority.

Must schools sign a data processing agreement with other schools that collect image consent forms on their behalf during interschool competitions?
Yes. If another school collects image consents at the request of the competition organizer, it acts as a processor, and a data processing agreement must be concluded.