Sharing student data.

Who can view student data?

Parents and students can see the student file and student data. Some school staff and school management can view the data. The school must ensure not every staff member can look at the student file. Only staff involved with the student and who need the information can view the file. A psychological report can only be seen by staff involved in the research. The school must keep a register of who views which data and when.

Permission needed

Sometimes the school wants to share certain student data with someone. For example, when testing for dyslexia. The school can only share this if the student or parents have given clear (and written) permission. From 16 years old, the student decides. For students under 16, parents act as legal representatives. When permission is given, the school must make sure that:

• The permission is given freely. Parents or students should not be pressured by possible consequences of refusing.
• The permission is actively given. The school must be able to prove this. The school cannot assume permission if you do not respond to, for example, an email.
• You are well informed. You know exactly what you are giving permission for.
• The permission is only used for that specific purpose.

The rights around the student file (right to see, copy, correct, add etc.) are mainly rights of the student. For children under 16, parents act as legal representatives. This means from 16 years old a student can decide about their student file and must ask to see it themselves. The parent can only access the full file with the student’s permission. The school still has the duty of care, based on the law, to inform parents about their child’s school progress as long as the child is a minor, up to 18 years old.

Cooperation with other organizations

Sometimes a school uses a third party who processes data for them. This is allowed. Think of digital teaching methods, the book supplier, or a digital student monitoring system that parents can see. Even then, the school is responsible for good data security. It is important to make good agreements about cooperation. That is why it is required to make a processor agreement. This lists the agreements. For example, about reporting a data leak or deleting data. Preferably, the school uses a pseudonym. The provider of teaching materials then does not have the name of a student, only a number. Only the school can link results to the student with that number.

Exceptions

In some cases the school must share information by law. Permission is not needed in the following cases:

• When a student goes to another school, an educational report is always sent to the new school.
• When applying for a declaration of admissibility for special primary education, learning pathway support, or practical education track.
• When requested by the Education Inspectorate.
• In emergencies, such as suspected child abuse.

School participation council

Parents talk about policies on privacy and personal data use. The school participation council has the right to agree on the rules about using personal data. If the school wants to set or change rules, the school participation council must agree.