DPA case 07121-1/2020/638 – Order (Slovenia, 2020)

The IP was asked about the records kept by schools and teachers regarding the communication with students and their parents. Issues arised due to different reasons, such as when teachers had to call parents from their private numbers because they would not respond to the professional e-mails, and the fact that they should keep a weekly record of their correspondence. The IP first clarified that it can only give a general opinion and that it also addressed the questions to the Ministry of Education. It also clarified that the opinion does not address any aspect of employment context. It found that such processing may be based on Article 48 of the Labor Relations Act (ZDR-1) as long as it is necessary and a private number may be used by a teacher only upon agreement with the employer. Working from home due to the pandemic outbreak inevitably leads to broader use of new technologies. Recordings have become necessary. As for the processing of teachers' personal data, the IP found that teachers could withdraw their consent at any time according to Article 7(3) GDPR with regard to these recordings. For this reason is important to understand whether recordings should be considered to fulfill a "work obligation" according to ZDR-1. It is, thus, necessary that data controllers (i.e. schools) establish appropriate retention periods, provide adequate security for the processing of personal data and inform individuals of certain mandatory information as foreseen in Article 13 GDPR. All information should be given in a clear and transparent manner. As for the processing of pupils' personal data, the IP found that consent is not the appropriate legal basis. For this exceptional situation the only appropriate legal basis would be Article 6(1)(c) GDPR since the processing is necessary to fulfill legal obligations of the controller. The legal obligation is defined by various national laws in the field of primary and secondary education. The IP is of the opinion that