Digital Schools and Data Protection

Many school principals, teachers and students wish for increased use of new media in school lessons, i.e. mobile devices for each student and digital textbooks, but above all also the merging of teaching and the internet. The concerns lie in data protection: how are personal data of students handled? A question that is discussed daily in the press for internet users and which gains in urgency in connection with the digital school because the underage students are particularly worthy of protection.

The digital school promotes media literacy among students and future leaders in society. The grand coalition has stipulated in its coalition agreement to develop and implement a "strategy 'Digital Learning', which uses the opportunities offered by new media for good education in a resolute manner." At Germany's largest educational trade fair, the didacta, which opened its doors in Stuttgart this year, one exhibition hall was dedicated solely to new technologies. Many hope for the fully networked classroom in which each student is equipped with a notebook and the teacher with a digital board (smart board/touch board). That is learning in the 21st century. But how does data protection stand?

The Minister of Culture of Baden-Württemberg, Andreas Stoch (SPD), has prohibited the use of social networks such as Facebook, Twitter and Google+ for official communication between teachers and students. This is justified by the fact that the providers of these services operate servers outside the EU, to which the data are transmitted. The level of data protection is not appropriate in the USA, for example, by comparison with that in Germany.

However, major international IT corporations and many other providers also offer quite different services for the education sector. These may include analysis tools for assessing student performance. But also such practical matters as online calendars for school classes or the possibility for teachers and students to work together on a document and see and save all changes in real time.

Frequently, these services are accessible via hosting or cloud computing on external data centres. This has the advantage that these services and the stored data can be retrieved from anywhere. Basically, all that is needed is a fast internet connection. Usage-dependent prices or even the free nature of the offers are in particular an argument in financing.

However, data protection experts criticise that the data, particularly of underage students, end up on external servers of external service providers. Frequently, the data centres are in the USA, where the level of data protection does not correspond to the EU standard. Student data would be disclosed to IT corporations for use for their own purposes, possibly for advertising purposes.

Possible Solutions

In some cases, the providers already provide possibilities to address the concerns of unequal data protection requirements. The existence of Safe Harbor certification is one thing. However, what is particularly addressed here are the written agreements on the provider's security concept, which it must maintain to protect personal data. Data protection obligations are assumed by the provider in a so-called 'Data Processing Agreement' and in contractual clauses in accordance with the so-called 'EU Standard Contractual Clauses'.

Conclusion

From the perspective of data protection, internet-based instruction and the integration of services from external IT companies present us with a major challenge. Anyone considering taking this step at school should in any case seek advice from a lawyer specialising in data protection law.