Parental concerns about children’s privacy are rising due to the growing use of diverse educational technologies to collect detailed information about their children. Schools collect lots of personal information from students without the knowledge or consent of their parents.
As soon as your child enters pre-school, information is collected about him or her. The quantum of information grows throughout the child’s school life. This information, whether collected by schools directly or by third parties, is often merged and analysed via algorithms to profile a student’s skills, strengths, abilities and interests, and to predict future outcomes.
How this sensitive data may be used, with whom it can be shared, and how it can be protected are questions on many parents’ minds. Finding answers can be hard – schools often find themselves caught in the middle.
Children’s school records contain highly sensitive information and even information about their family. The contents of student files are likely to have an impact on the overall educational experience of a child, and their current and future privacy as well.
It is therefore prudent for parents and school owners, administrators and managers to be informed about the laws and policies that govern student information. In Ghana currently, there are no specific laws, guidelines, directives, regulations or policies that entreat schools to manage student data (at least, not that the writer is aware of).
Although no such explicit regulation of student data exists, we can comfortably rely on the Data Protection Act, 2012 (Act 843) to manage student data to the satisfaction of parents and all stakeholders.
Ghana’s Act 843 mandates the Data Protection Commission (DPC) to regulate all institutions (including schools) that process Ghanaian citizens’ data. The DPC regulates how organisations collect, process, store, use, protect, disclose and share data of Ghanaian citizens –which includes children.
In the school environment, privacy abuses can range from grades pasted on notice boards to the non-consensual exposure of student information and photos on the Internet. In today’s climate of heightened privacy and security, it is more important than ever for parents and adult-age students to be vigilant about who has access to their education records.
Privacy and Security Concerns
Privacy: Aside from the school, do you know who has access to your child’s information? Even within the school, how is your child’s information being used? Which other institutions have access to your child’s academic records? What parents need to know is that their child’s personal information could be shared within the school or with other third-party processors.
Personal identifiable information like your child’s name, address, phone-number, weight, pictures, video, psychological profile, discipline records, health records, special education records, disability status, family information, income status (anything in your child’s education record) can be shared outside the school – with companies, researchers, government and NGOs – without your consent or knowledge.
Security: How safe is the information when it is stored (at rest) or shared (in transit)? Essentially, how hard (or easy) would it be for a hacker to get access to your child’s information? There are different levels of security, and not all data is encrypted when stored or transferred to other parties.
Rights of Parents/Students
- Right to be informed
The right to information allows students/parents to know what personal data is collected about them/their children, why, who is collecting data, how long it will be kept, how they can file a complaint, and with whom will they share the data.
- The right to give and withdraw consent.
Parents/students have the right to give their consent to the school to process their personal data. They also have the right to withdraw that consent, and the process of withdrawal should be as convenient/easy as it was to collect the data.
- Right of access
Parents/students have a right to submit subject access requests and obtain information from the organisation about whether their personal information is being processed.
- Right to rectification
The right to rectification allows parents/students to ask the school to update any inaccurate or incomplete data they have on their children/students.
- Right to erasure
This right is also known as the right to be forgotten. It allows parents/students to ask for their personal data to be deleted if: the personal data is no longer necessary, consent is withdrawn, or the personal data has been unlawfully processed.
If a parent/student exercises their right to erasure, the school must notify any third parties with whom the data was shared and request the erasure of that data.
- Right to restrict processing
Parents/students can request that the school limits the way it uses their personal data. To put it plainly, the school is not obligated to delete the data; however, they must refrain from processing it.
- Right to prevent the processing of personal data for direct marketing
Parents/students can request a stop to the processing of their personal data for direct marketing, as this is their absolute right.
- Right to freedom from automated decision-making and profiling
Parents/students have the right to freedom from the processing of personal data that is done without human involvement. This includes different profiling, which may include evaluating certain personal aspects relating to an individual that analyses or predict aspects of behaviour like performance at school, economic situation, health, personal preferences, interests, reliability, behaviour or location.
- Right to compensation
Parents/students have the right to compensation where it can be established that some form of damage has occurred as a result of the breach of the student’s privacy. Compensation may come in different forms, and not necessarily in monetary terms.
- Right to complain
Parents/students have the right to complain to the school first for any resolution regarding their personal data. If the matter is not adequately resolved, then the parent/student can complain to the Data Protection Commission for redress.
The School’s Responsibilities
- Notify parents when collecting personal information, which includes the reason for the collection and who to contact with further questions when needed
- Ensure student information is secure and protected in all forms – paper-based or electronic using their technical and organisational means
- Provide parents and students access to their information – providing the appropriate means for parents to always do so
- Seek consent from parents before disclosing a child’s personal information for reasons unrelated to schooling
Schools and Social Media
Undoubtedly, social media platforms have become an advertising tool for schools to market their brands and services. The question is: are schools allowed to post pictures or tweets about my child? Schools and their teachers have a professional responsibility for using social media, and should seek consent before posting identifiable information about a student.
Inappropriate use of social media by schools or teachers may result in privacy-harm to the child. This could lead to parental actions such as lawsuits, civil action or even criminal charges against the school. Inappropriate use of social media includes:
- Posting student work that contains identifiable information without consent
- Posting photos or videos of students without consent
- Tweeting about a student in a way that discloses their personal information without consent
- Disclosing confidential information about the school, students, or colleagues.
The writer is a Data Protection Officer, IIPGH and Data Privacy Consultant and Practitioner at Information Governance Solutions)
For comments, contact author [email protected] or Mobile: +233-243913077
