Remote learning presents new challenges for the education system—in terms of teaching methods, digital tools used, and student performance assessment. However, it is important to remember that this extraordinary situation does not exempt educational institutions from complying with data protection regulations.
Legal Basis for Processing Students’ Data When Using Remote Learning Methods
As a result of the current circumstances and the obligation to conduct education remotely, schools have had to seek new means of communication between teachers and students. This has necessitated the use of new tools—such as online platforms, apps, or even social media. In many cases, it is necessary to create individual accounts for each student, which involves the sharing of personal data. This raises the question: should the school obtain parental consent for such data processing?
It is important to note that schools process personal data in the exercise of tasks carried out in the public interest (Article 6(1)(e) GDPR), which includes providing educational and caregiving services.
Therefore, consent is not required for this type of data processing—because these services are mandatory and not voluntary. The obligation to conduct educational activities using remote learning methods or other appropriate means is set out in the Regulation of the Minister of National Education of 11 March 2020 on the temporary limitation of the functioning of education system units due to the prevention, counteraction, and control of COVID-19.
That said, the choice of tools should be thoughtful. Schools should assess the transparency of the selected applications and aim, where possible, to limit their number to avoid the excessive creation of student accounts and minimize the number of entities with access to students’ data.
It is essential to remember that data processing based on the public interest applies only to data strictly necessary for achieving this goal. For example, to create an account and maintain communication with a student, their name, surname, and class are sufficient—an image would be considered excessive. This does not mean, however, that the school cannot use the student’s image at all.
Student’s Image – Is Parental Consent Required?
While math or biology assignments can easily be verified based on written submissions, tasks in art, technical subjects, or physical education pose greater challenges. Additionally, maintaining a sense of community among students and teachers remains an important concern.
One solution has been for parents to document students’ work by taking photos, which are then sent to teachers—these photos often feature the students themselves. Sending such photos does not raise concerns, as it serves to document completed tasks. However, problems arise when these images are published on the school’s website or Facebook page. Publicly sharing a student’s image is not essential for the purpose of delivering remote education. Therefore, such processing is not justified by the public interest and requires parental consent.
Teachers uploading student images must verify whether and to what extent consent has been given. This consent should specify on which websites or platforms the school is authorized to share the image. Consequently, if the school introduces a new channel for communication—such as creating a Facebook fanpage—and plans to post student photos, it must obtain prior consent for such use.
Similarly, if a student’s parent appears in a photo, their image also requires explicit consent for public use.
Given that collecting written consent may be difficult under current conditions, it is acceptable—and even recommended—to obtain consent via electronic communication (email, e-register). This consent may be one-time (e.g., “May I post a picture of Piotr from his PE class on our Facebook profile?”) or general (covering all such activities). In the case of general consent, we suggest using a template prepared by the Data Protection Officer (copying its contents into an email or e-register message and requesting confirmation from parents).
Summary
It is essential to keep in mind that personal data processing by an educational institution for remote learning is based on fulfilling a task in the public interest (Article 6(1)(e) GDPR). However, only the data strictly necessary for this purpose should be processed—following the principle of data minimization.
Conversely, the processing of images for use on social media or the school’s website is not essential for this goal and must be based on consent (Article 6(1)(a) GDPR). Such consent must explicitly cover the website, portal, or platform on which the institution intends to publish the student’s image.