City X (Board for Growth and Learning) – Complaint Upheld (Finland, 2023)

A guardian complained to the DPA about the widespread visibility of pupils' personal data through the address book of MS Office 356 e-mail system that was used in primary education organised by the city. The personal data in question were a pupil’s 1) name, 2) role, 3) email address, 4) school and 5) grade level. The guardian argued that the personal data of pupils were visible to an unnecessarily large group for the purposes of organising education. The personal data of the pupils were visible in all primary and secondary schools in the city. The controller, which was the city organising the education, stated that it has a legal obligation to provide primary education. The controller argued that the implementation of MS Office 365 service is essential for organising primary education and to teach digital skills in schools in line with the national curriculum for primary education. Additionally, the controller argued, for example, that the visibility of the data in question is necessary, as identification of the right recipient before sending a message ensures data protection, integrity and confidentiality of the communication. The controller considered the risk of a messages going to the wrong person, when sending emails, to be greater than the risk of the information being visible to others. The controller also presented that messaging between pupils in different schools may occur for organising elective subjects, hobby and skills groups, and interdisciplinary learning units required by the curriculum. The guardian stated in their response to the controller, inter alia, that they are not opposed to the use of digital tools in education, but that the city had not justified why the personal data of minors should be visible to all users in all schools in the city. The DPA decided that the controller had violated Articles 5(1)(a), 5(1)(c), 5(1)(f) GDPR, and Article 25(2) GDPR when it made the personal data of pupils available in the address book of the e-mail system, so that the data were visible to the pupils, students, and staff of all primary and secondary schools in the city. The DPA viewed that the controller did not demonstrate the appropriateness and necessity of such wide visibility of its pupils' personal data for the purpose of organising primary education. In light of the principle of minimisation under Article 5(1)(c) GDPR, the DPA did not consider the controller’s arguments sufficient enough when the controller deemed the current practice was necessary to be in contact between persons attending different primary schools, as well as, between primary school pupils and secondary school students when it comes to the implementation of multidisciplinary learning units in accordance with primary education curriculum, and the activities of elective subjects, hobby groups and skills groups etc., nor when the controller deemed the visibility of data necessary because teachers need to communicate with the students they teach, which may be in different schools to themselves. The DPA viewed that it is not necessary for all pupils to be in contact with others outside their own school. Additionally, the DPA emphasised that the fact that if the system used does not allow to technically limit the visibility of personal data, is not a basis to process personal data more than what is necessary in tasks related to providing primary education. The DPA also viewed that placing the personal data visible in the address book in all other schools in the city, was against the principle of confidentiality under Article 5(1)(f) GDPR, and emphasied that in particularly when it was children’s data in question. Lastly, the DPA viewed that Article 25(2) GDPR requires the controller to use such it-solutions that are appropriate for the nature of the activities. The DPA issued a reprimand to the controller under Article 58(2)(b) GDPR and an order to the controller pursuant to Article 58(2)(d) GDPR to bring the processing operations into compliance with the provisions of the GDPR. Additionally, DPA emphasized that the controller should re-evaluate the availability of personal data of pupils in primary education in the email address book it uses. The controller should ensure that it no longer processes the data of its pupils in the address book of the e-mail system in such a way that they are visible outside its own school, unless there are grounds for a wider visibility in the context of organisation of education. The availability of the pupils' data in the e-mail address book must also be necessary and justified for organising primary education.