Ministry of Education and Religious Affairs – Complaint Upheld (Greece, 2022)

The DPA examined the compliance of the Ministry of Education and Religious Affairs (the controller) with the recommendations of Decision 50/2021 on the compatibility of distant learning in the primary and secondary education sector, with the provisions of the legislation based on the processing of personal data. In the original decision, the DPA had found four different shortcomings. First, no detailed investigation had been carried out into the legality of the purposes of processing on the part of the controller, in particular in relation to consent to access information stored on a user's terminal equipment when this is not necessary for the provision of the service requested by the user. Second, the information provided to data subjects was less than that required by the GDPR, and the information was not provided in an intelligible and easily accessible form with clear and simple wording, especially if it was also addressed to children. Third, the security measures in place, although in the right direction, needed to be made accessible to every teacher, and it must be ensured that all teachers involved in the distance learning process received the minimum required information. Fourth, a proper assessment of the transfer of data to countries outside the EU had not been carried out, especially in light of the CJEU's decision in case C-311/18 (Schrems II). The DPA had issued a reprimand for each of the above discussed shortcomings. As a response to the DPA's decision, the controller adopted a number of supplementary measures in order to comply with the relevant data protection legislation. Among others, it conducted a more detailed analysis on the lawfulness of the purposes of processing. The controller also drafted a new information document regarding the processing activities, in a way that would be comprehensible for pupils, students as well as parents and staff. Moreover, new security measures were introduced next to updated supplementary measures with regards